Checklist: Securing Donor Data on a Shared Hosting Account

Updated 2026-05-18 · Hosting Reviews

Keeping donor information safe is non‑negotiable, especially when you’re running a nonprofit website on a shared hosting account. This securing donor data shared hosting checklist walks you through the exact tools, settings, and steps you need to protect contributions while staying on a tight budget.

Pick the Right Hosting Environment

For most charities, a shared‑hosting plan is the most cost‑effective start. Look for a provider that offers:

• Free SSL certificates (HTTPS is mandatory for any donation form).
• Daily backups or at least automated weekly backups.
• Built‑in security tools such as malware scanning and DDoS protection.
• One‑click WordPress installation if you plan to use that CMS.

If you expect high traffic spikes during fundraising drives, consider a cloud or VPS upgrade later. For now, a shared plan in the $3‑$15/month range is plenty for a modest nonprofit site.

Secure the Basics: Domain, SSL, and Updates

Start with a clean domain name that reflects your cause. Register it through your host to keep billing simple. Hostinger, for example, bundles a free domain for the first year with many of its shared plans.

Next, enable the free SSL certificate that comes with your hosting package. Most control panels have a single button to activate HTTPS—do it immediately after your site goes live.

Finally, keep every component up to date: the CMS (WordPress, Joomla, etc.), plugins, themes, and the underlying PHP version. Out‑of‑date software is the #1 way attackers breach shared accounts.

Hardening WordPress (or Your Chosen Platform)

If you’re using WordPress, follow these quick hardening steps:

1. Install a reputable security plugin (e.g., Wordfence, Sucuri) that offers firewall and login protection.
2. Change the default "admin" username and use a strong, unique password (at least 12 characters, mix of letters, numbers, symbols).
3. Limit login attempts and enable two‑factor authentication.
4. Move the wp-config.php file one directory up from the web root if your host allows it.
5. Disable file editing from the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.

For other platforms, look for similar security extensions and apply the same principles: strong admin credentials, limited login attempts, and regular updates.

Protect Donor Data at the Application Level

Donor information should never be stored in plain text. Use a reputable donation plugin or service that encrypts data and complies with PCI DSS standards. Recommended options include:

• GiveWP (WordPress) – stores donor data securely and integrates with Stripe or PayPal.
• Donorbox – a hosted solution that handles encryption for you.
• Charitable – another WordPress plugin with built‑in security features.

When configuring the plugin, enable the following:

• HTTPS‑only forms.
• Tokenized payment processing (no raw credit‑card numbers touch your server).
• Automatic email receipts that omit sensitive details.

Backup, Monitor, and Test Regularly

Even the best‑hardened site can be compromised. Set up a routine:

1. Daily automated backups to a separate storage location (e.g., Google Drive, Dropbox).
2. Weekly scans with your security plugin to catch malware early.
3. Quarterly test restores to ensure backups are usable.
4. Monthly review of user accounts—remove any that are no longer needed.

Hostinger’s shared plans include automated backups and easy restore points, making this step straightforward for beginners.

Step‑by‑Step: Get Your Nonprofit Site Online in Under an Hour

1. Choose a shared hosting plan from Hostinger (or a comparable provider) that includes a free domain and SSL.
2. Register your domain and point it to the host’s nameservers.
3. Use the one‑click installer to set up WordPress.
4. Activate the free SSL certificate from the control panel.
5. Install a security plugin and configure the hardening settings listed above.
6. Add a donation plugin (GiveWP, Donorbox, etc.) and connect it to a payment gateway.
7. Create essential pages: Home, About, Programs, Donate, Volunteer, Contact.
8. Run a quick speed test (Google PageSpeed Insights) and enable caching via a plugin or host‑provided tool.
9. Set up daily backups and enable weekly malware scans.
10. Publish and promote your site—monitor traffic and donation flow for any anomalies.

Following this checklist you’ll have a secure, donation‑ready nonprofit website without breaking the bank.

FAQ

Is shared hosting safe enough for handling donor credit‑card information?

Yes, as long as you use HTTPS, a PCI‑compliant donation service, and keep the platform fully updated. The biggest risk comes from outdated software, not the shared environment itself.

How much will a fully functional nonprofit site cost per month?

Expect to spend between $3 and $15 for shared hosting, plus any optional premium plugins (typically $0‑$50 one‑time or annual). Renewal rates may be higher than introductory offers.

Can I switch to a VPS or cloud plan later without losing my data?

Absolutely. Most hosts, including Hostinger, provide migration tools or support to move your site to a higher‑tier plan with minimal downtime.