Are Church Websites Putting Their Organizations at Risk?

A website may not be the first thing that comes to mind when church leaders think about organizational risk. But an overlooked website can create very real exposure — from a domain that falls into the wrong hands to former employees retaining access, outdated policies remaining public, or visitor data being collected without proper consent.

Churches and ministries can be particularly vulnerable. With limited staff and resources focused on ministry, websites are often managed by a staff member or volunteer for a season and then neglected. Over time, important security, privacy, and compliance safeguards can easily fall through the cracks.

Here are 10 things you can do right now to protect your organization and thrive on the web:

(Several figures below come from a census we ran this year of 4,699 congregations.)

1. Maintain your domain registration.

In a survey of 3,651 church websites, 211 domains were no longer registered. They were unclaimed and purchasable by anyone, at a web address people still trust, which creates opportunities for impersonation, fraud, or reputational harm. Register your domain to the organization rather than to a volunteer, on a bank card that outlives any one person, with registrar lock and auto-renew on. At least two trusted people should have access to the domain registrar account and put the expiration date on both their calendars. Then decide now what happens if the church closes. The domain should pass to your regional office, not onto the open market. Once you lose your domain, it can be difficult or impossible to get back.

2. Keep track of who can sign in.

Every organization has more accounts than it remembers, and some belong to people who left under circumstances leadership would rather not revisit. Keep a written list of every system used to run your church, and who can sign in and access those systems, including your website and online presence. Revoke access the same day you collect the building key.

3. Make it hard to impersonate you.

A common attack on churches is an email that looks like the pastor asking a member to buy gift cards. There are three settings you can make in your domain's DNS records that will make spoofing emails from your domain much more difficult, and they are called SPF, DKIM, and DMARC. Don't worry if you've never heard of those terms — just contact your email or DNS provider and ask whether they are set up correctly. SPF and DMARC are easily auditable, and DKIM can be tested with a few actual emails.

4. The lock icon on your browser doesn't mean you're safe.

It means the connection is encrypted, not that the site is trustworthy: a fraudulent donation page can still show a lock icon. Nearly all the church sites we checked were served securely, but more than half still loaded an image, font, or script over an insecure connection, which weakens the page and causes security warnings to appear, scaring users away. Always redirect HTTP to HTTPS (the "S" means secure), check that your own URLs all start with HTTPS, and set the certificate to auto-renew. When a certificate expires, your homepage becomes a full-page browser warning, and most visitors will not click past it.

5. Know what visitor data you're collecting and whether you have consent.

Many organizations are surprised to learn how many third-party services collect visitor data through an otherwise simple website. Analytics tools, ad pixels, embedded video, and social media share buttons can all share visitor data with outside companies. All it takes is one plug-in or script that was added without much thought. Some jurisdictions require disclosure of tracking technologies or consent before tracking users. Your legal counsel can tell you which rules apply to you, but you should know what loads on your site and why.

6. Your website is a record.

What your website says today is what a court, a reporter, or a hurting family finds later. A staff page listing someone who has since been removed. A child protection policy three revisions out of date. A "report a concern" form pointed at an inbox nobody has opened since 2019. In our census, over 350 active sites still displayed a copyright year of 2024 or earlier; the oldest went back to 2003. Review the site when you review the policies.

7. Build for people who cannot see your screen.

Some courts have found that websites can fall under the ADA, though where your jurisdiction stands is a question for your attorney. Images that are part of a page's content should have text descriptions called alt text so that screen readers can describe images for the visually impaired. We found that four sites in five left at least one image undescribed. Even without the ADA, organizations that exist to serve people should make their websites accessible to everyone. Alt text is only the first step toward an accessible website.

8. Tell search engines what you are.

Structured data is increasingly important for how search engines understand and present organizations online, yet we found that only 18 sites out of 3,651 published all the basic information that a stranger needs. Structured data is simply a small block of code that tells search engines exactly what a page represents: what kind of organization it is, where it is located, and when it meets. Two web-hosting platforms marketed specifically to churches got structured data right on only 3% and 2% of sites. Getting structured data right can improve how your organization appears in search results, help search engines and AI better understand your website, and strengthen your local search visibility.

9. Check your place in the directory.

Does your regional office or denomination publish a church finder tool? For one in ten churches listed, we found that the link or website was broken in some way. Some congregations were listed with no website at all, and hand-checking found that only a third of them had a website. Look up your own church in the denominational directory today and alert your denomination about any issues.

10. Facebook is the visiting room. Your website is the front door.

Facebook is great for people who are already connected to your church, but it's difficult for new people to find your church there. We opened 50 church Facebook pages as a signed-out stranger, and the median page contained only 48 characters of readable text, usually just the church's name and its town. That's not enough for a full introduction. Our study found that although younger adults still have Facebook accounts, they prefer other platforms. Not everyone has a Facebook account. A well-maintained website serves as the real front door that says what you want to everyone without restrictions.

______________________________

Not sure where your organization may be exposed? Aeris Labs will provide a free website audit for any church or ministry. We analyze over 80 measurements across 13 categories and explain the results in plain language so you know what's working and what needs to improve.

Contact us at aerislabs.org to request your audit.

To see the research behind these recommendations, see the full article on our website.

Rob Hughes
Founder, Aeris Labs

aerislabs.org

______________________________

Rob Hughes has been developing websites since the 1990s, building a career spanning technology, ministry, and media. He holds a B.S. in Mechanical Engineering and an MBA from CSU Sacramento. He holds an Artificial Intelligence and Machine Learning certificate from Caltech and Snowflake SnowPro certification. Rob also holds a ministry certificate from Cru's Institute of Biblical Studies. He served 12 years with Cru as a full-time missionary and six years on the board of his local church. Combining decades of technology experience with firsthand ministry leadership, Rob brings a unique perspective to helping churches and ministries navigate the rapidly changing digital and technological landscape.