Today we're going to build on that and talk about the everyday habits that keep your website safe over the long haul.
Here's the thing about website security: it isn't something you set up once and forget. It's more like caring for your church building. You lock the doors every night, you keep track of who has keys, you check the smoke detectors now and then, and you have a plan if something goes wrong. None of it is complicated, but it does take a little consistency.
The good news is that a handful of simple practices will protect your church from the vast majority of problems. Let's walk through them one at a time, starting with one of the most overlooked: how many people have the keys.
Not Too Many Admins
Think about the keys to your church building. Would you hand a master key to every volunteer who helps on Sunday morning? Of course not. The more master keys floating around, the more likely one gets lost, copied, or used by someone who shouldn't have it.
Your website works exactly the same way. An administrator (or admin) is someone with full control: they can change anything, delete pages, add or remove other people, and sometimes even change billing or close the account. Every admin account is a master key.
It's very common for church websites to collect admins over the years. A former youth pastor, the person who built the site in 2015, a volunteer who helped once with a big event, a web designer who's long gone. Each of those accounts is a door that's still unlocked, often with an old password that may have been reused elsewhere.
Here's our rule of thumb: keep it to two administrators. Usually that's the pastor or a key staff leader, plus one trusted backup. Two is enough that the church is never locked out if one person is unavailable, and few enough that you always know exactly who holds the master keys. Everyone else gets a lesser role with only the access they actually need.
The further down the ladder, the more people you can safely include, because each step down can do less harm by mistake or if a password is stolen.
Setting Up Roles the Right Way
Most website platforms, including Squarespace, Wix, and WordPress.com, let you choose a permission level for each person you invite. The names vary a little from platform to platform, but the idea is always the same: give each person the smallest amount of access that still lets them do their job. Security folks call this the "least access" principle, but you can just think of it as common sense.
Here's how that might look at a typical church:
Person
Suggested role
Why
Senior pastor or executive pastor
Administrator
Final responsibility for the website
One trusted staff member or elder
Administrator (backup)
So the church is never locked out
Church secretary or office manager
Editor
Updates events, announcements, and pages every week
Media or worship volunteer
Contributor or editor for sermons
Posts sermon audio and video only
Youth or kids' ministry leader
Contributor
Updates their own ministry page or events
Treasurer or finance team
Billing access only, if offered
Manages payments without editing the site
Outside web designer
Temporary access, removed when finished
Never give permanent ownership to someone outside the church (unless it is a subscription and they are continually working on the website.)
A few tips as you set this up:
Never share one login among several people. Each person should have their own account. Shared logins make it impossible to remove one person without changing everything.
Use church email addresses where possible. That way, access is tied to the role, not to someone's personal inbox.
Start small and add access later. It's much easier to give someone more permission when they need it than to clean up after someone had too much.
Write it down. Keep a simple list of who has access and what level they have. You'll use it in the security calendar later in this lesson.
A Simple Password and Login Policy
In Lesson 5 we touched on strong passwords and two-step verification. Now let's turn those ideas into a simple policy your whole team can follow. It doesn't need to be fancy. A half-page agreement that everyone understands is far better than a long document no one reads.
Here's a starting point you can adapt:
Every person has their own login. No shared accounts, ever.
Every password is long and unique. At least 12 to 15 characters, and never reused from another account. A phrase of three or four random words works well.
Two-step verification is required for every administrator, and strongly encouraged for everyone else.
Passwords are stored in a password manager, not on sticky notes, in a notebook in the office, or in a shared document.
No one shares their login, even with a trusted friend who is "just helping out." If someone needs access, invite them with their own account.
Log out on shared computers. If you update the website from the church office or a library computer, always sign out when you're done.
When in doubt, ask first. If an email, text, or phone call asks for a password or a code, stop and check with another leader before responding.
It's also wise to protect the church email accounts tied to your website. If someone gets into the email account used for your website or domain, they can often reset every other password. That makes your church email one of the most important accounts to secure.
Be Careful What You Add, and What You Collect
Two more habits round out a secure website: being thoughtful about what you plug into your site, and being careful about the information you gather from people.
What you add
Over time, it's tempting to add all sorts of extras: a chat widget, a fancy calendar, a code snippet someone found online, or an app that promises more features. Each of these can be useful, but each one is also another door into your website.
Stick with well-known, trusted services for giving, forms, calendars, and video.
Be cautious about pasting code from websites or forums unless you know exactly what it does and where it came from.
Remove what you no longer use. An old form, an abandoned plugin, or an extension from a past event should be deleted, not just hidden.
Keep things updated. If your platform uses plugins or extensions (as WordPress.com can), install updates promptly. Older versions are a common way in for attackers.
What you collect
The safest information is the information you never collect in the first place. Before you add a form, ask: "Do we really need this?"
Only ask for what you'll use. A newsletter sign-up needs a name and email, not a home address and birthday.
Handle prayer requests with care. Let people choose whether their request is shared publicly, kept with the prayer team, or seen only by the pastor. Never post someone's personal request without permission.
Protect children. Be very careful with children's names, photos, and details online. Get written permission from parents before posting photos of minors, and avoid pairing a child's full name with their picture.
Know where form responses go. Make sure submissions go to a church email address that's checked regularly, not to a former staff member's inbox.
Backups and a Plan for When Something Goes Wrong
Even careful churches run into problems now and then. Someone accidentally deletes the events page. A password gets stolen. A volunteer makes a change that breaks the homepage on a Saturday night. Having a plan ahead of time turns a crisis into a minor inconvenience.
Keep your own copies of what matters. Platforms like Squarespace keep your site running, but it's still wise to keep your own copies of the things that would be hard to replace: your logo, photos, sermon files, page text, and any lists of members or subscribers. Store them in a church-owned cloud folder, not on one person's laptop. Some platforms also offer an export tool, which is worth trying once so you know how it works.
Know who to call. Write down your platform's support contact, your domain registrar's support contact, and your two administrators' phone numbers. Put this somewhere everyone on your website team can find it.
Have a simple "something's wrong" plan. If you suspect a problem, follow these steps in order:
Don't panic, and don't ignore it. Tell one of your administrators right away.
Change passwords for the website, domain, and church email, starting with any account you think was affected.
Review who has access and remove anyone you don't recognize.
Contact your platform's support team. They deal with this every day and can often restore or lock things down quickly.
Let people know if needed. If members may have received strange emails or seen odd content, a short, calm note from the pastor goes a long way.
Make It a Rhythm: A Simple Security Calendar
The best way to keep a website secure is to make security a regular habit rather than something you only think about after a problem. Here's a simple rhythm any church can follow.
A great tip is to tie these to things already on your church calendar. For example, review access at the start of each new ministry season, or check your domain renewal when the annual budget is prepared. When security rides along with existing routines, it actually gets done.
Your Five Action Steps for This Lesson
Count your administrators. Log in to your website platform and list everyone with full admin access. If there are more than two, choose your two and move everyone else to a lower role or remove them.
Match every person to the right role. Using the roles table in this lesson, give each remaining person the smallest permission level they need, and make sure no one is sharing a login.
Write your one-page password and login policy. Adapt the seven-point policy above, share it with everyone who has access, and ask each person to read and agree to it.
Make your backup and emergency list. Save copies of your logo, photos, and key files in a church-owned folder, and write down support contacts and your two admins' phone numbers.
Put the security calendar on the church calendar. Add the monthly, quarterly, and yearly checks to your church's calendar, with a name next to each one.
