WordPress Security for Nonprofit and Charity Websites

Introduction

Nonprofit websites handle sensitive donor information and process charitable donations. Security breaches damage donor trust and organizational reputation while potentially violating compliance requirements.

Nonprofit Security Challenges

Charitable organizations face unique security concerns:

• Limited budgets - Security spending competes with mission
• Volunteer access - Many users with varying technical skills
• Donor data - Payment and contact information protection
• Compliance - PCI DSS for payment processing
• Target for attacks - Perceived as easy targets

Donation Form Security

Protect charitable giving transactions:

Secure Payment Processing

// Never store full card numbers - use payment processor tokens
function process_donation($donation_data) {
    // Validate donation amount
    $amount = floatval($donation_data['amount']);
    if ($amount < 1 || $amount > 100000) {
        return new WP_Error('invalid_amount', 'Please enter a valid donation amount.');
    }

    // Use Stripe for secure payment processing
    StripeStripe::setApiKey(STRIPE_SECRET_KEY);

    try {
        $charge = StripeCharge::create(array(
            'amount' => $amount * 100, // Stripe uses cents
            'currency' => 'usd',
            'source' => $donation_data['stripe_token'],
            'description' => 'Donation to ' . get_bloginfo('name'),
            'metadata' => array(
                'donor_email' => sanitize_email($donation_data['email']),
                'campaign' => sanitize_text_field($donation_data['campaign'] ?? 'general'),
            ),
        ));

        // Log donation (without card details)
        log_donation($charge->id, $amount, $donation_data['email']);

        return $charge;
    } catch (StripeExceptionCardException $e) {
        return new WP_Error('payment_failed', $e->getMessage());
    }
}

// Rate limit donation attempts
function rate_limit_donations() {
    $ip = $_SERVER['REMOTE_ADDR'];
    $key = 'donation_attempts_' . md5($ip);
    $attempts = get_transient($key) ?: 0;

    if ($attempts >= 5) {
        wp_die('Too many donation attempts. Please try again later or contact us.');
    }

    set_transient($key, $attempts + 1, HOUR_IN_SECONDS);
}
add_action('wpfs_before_donation', 'rate_limit_donations');

Donor Data Protection

// Encrypt donor information
function store_donor_record($donor_data) {
    $encryption = new WPFS_Donor_Encryption();

    // Fields to encrypt
    $sensitive = array('address', 'phone', 'employer');

    foreach ($sensitive as $field) {
        if (isset($donor_data[$field])) {
            $donor_data[$field] = $encryption->encrypt($donor_data[$field]);
        }
    }

    // Never store: full card number, CVV, card expiry
    unset($donor_data['card_number']);
    unset($donor_data['cvv']);
    unset($donor_data['expiry']);

    return $donor_data;
}

// Restrict donor list access
function can_access_donor_data($user_id) {
    $user = get_userdata($user_id);

    $allowed_roles = array('administrator', 'development_director', 'finance');

    foreach ($user->roles as $role) {
        if (in_array($role, $allowed_roles)) {
            return true;
        }
    }

    return false;
}

Volunteer Account Management

// Create limited volunteer role
function create_volunteer_role() {
    add_role('volunteer', 'Volunteer', array(
        'read' => true,
        'edit_posts' => false,
        'delete_posts' => false,
        'publish_posts' => false,
        'upload_files' => false,
    ));
}
add_action('init', 'create_volunteer_role');

// Auto-expire volunteer accounts
function check_volunteer_expiration() {
    $volunteers = get_users(array('role' => 'volunteer'));

    foreach ($volunteers as $volunteer) {
        $expiry = get_user_meta($volunteer->ID, '_account_expiry', true);

        if ($expiry && strtotime($expiry) < time()) {
            // Deactivate account
            $volunteer->set_role('inactive_volunteer');

            // Notify admin
            wp_mail(
                get_option('admin_email'),
                'Volunteer account expired',
                "Volunteer account for {$volunteer->user_email} has been deactivated."
            );
        }
    }
}
add_action('wpfs_daily_cleanup', 'check_volunteer_expiration');

// Set expiry on volunteer creation
add_action('user_register', function($user_id) {
    $user = get_userdata($user_id);
    if (in_array('volunteer', $user->roles)) {
        // Expire in 1 year
        update_user_meta($user_id, '_account_expiry', date('Y-m-d', strtotime('+1 year')));
    }
});

Budget-Friendly Security

Free and low-cost security measures:

• Use free security plugins (WP Folder Shield free tier)
• Enable automatic WordPress updates
• Implement strong password policy
• Use free SSL from Let's Encrypt
• Enable free Cloudflare protection
• Regular manual security audits

Compliance Requirements

// PCI DSS compliance checklist
function verify_pci_compliance() {
    $requirements = array();

    // Requirement 1: Firewall
    $requirements['firewall'] = is_plugin_active('wp-folder-shield/wp-folder-shield.php');

    // Requirement 6: Secure systems
    $requirements['ssl'] = is_ssl();
    $requirements['updates'] = !has_pending_updates();

    // Requirement 8: Unique IDs
    $requirements['unique_accounts'] = !has_shared_admin_accounts();

    // Requirement 10: Logging
    $requirements['logging'] = get_option('wpfs_enable_logging', false);

    return $requirements;
}

Incident Response for Nonprofits

• Have a breach notification plan
• Know your state's breach notification laws
• Document all donor communications
• Consider cyber insurance
• Maintain donor trust through transparency

Conclusion

Nonprofit websites must protect donor trust through secure payment processing, data protection, and proper volunteer management. Budget-friendly security measures and compliance awareness keep charitable organizations safe.