Synagogues have always had to think carefully about security. Today, some of those same considerations extend to the synagogue website and the information we share online.
A synagogue website needs to be welcoming and accessible. Prospective members should be able to learn about the congregation. Current members need to find services, programs and other important information. Visitors need to know where you’re located and how to get in touch.
At the same time, synagogues have legitimate reasons to think carefully about website security, staff and member privacy, and how much information should be publicly available.
The goal isn’t to make your synagogue invisible online. It’s to be thoughtful about what you share, how you protect your website and accounts, and where you can reduce unnecessary risks.
Here are some important areas to consider.
1. Start With Strong, Unique Passwords
One of the simplest things you can do to protect your synagogue’s website and other online accounts is also one of the most important: use a different, strong password for every account.
Reusing passwords creates an unnecessary vulnerability. If a password is compromised through one website or service, attackers can try that same email address and password combination elsewhere.
That matters for more than your WordPress website. Think about all the systems a synagogue may use: email, ShulCloud, social media, online giving, email marketing, domain registration, web hosting and numerous other services.
A password manager can make unique passwords much easier to manage. Instead of staff members creating passwords they can remember — and inevitably reusing them — a password manager can generate and securely store different passwords for each service.
Just as importantly, passwords shouldn’t be passed around among staff members in emails, text messages or spreadsheets.
2. Use Two-Factor Authentication Wherever Possible
A strong password is important. Two-factor authentication adds another layer of protection.
With two-factor authentication, knowing the password alone isn’t enough to access an account. A second form of verification is required.
Enable it wherever it’s available, particularly for accounts that could provide access to sensitive information or other systems.
Pay particular attention to your synagogue’s:
- Website administrator accounts
- Email accounts
- Web hosting
- Domain registrar
- ShulCloud or other synagogue management system
- Email marketing platform
- Social media accounts
- Online giving and payment services
Your domain registrar and primary email accounts deserve special attention. Access to either can potentially give someone a pathway into other systems.
3. Be Careful About Who Has Administrator Access
Synagogues often have an unusual technology challenge: lots of people may help manage things over the years.
Staff members come and go. Board members change. Volunteers help with the website. A consultant may need temporary access. Someone creates an account for a project and nobody remembers it three years later.
Periodically review who has access to your website and other important online systems.
Does every WordPress user with administrator privileges still need them? Are there accounts belonging to former employees or volunteers? Could someone accomplish what they need with a lower level of access?
As a general rule, people should have the access they need to do their jobs — and no more.
And when someone leaves the organization, removing or changing their access should be part of the transition process.
4. Keep Your Website Software Up to Date
For a WordPress website, security isn’t a one-time setup.
WordPress itself, the website’s theme and its plugins all need to be kept current. Updates frequently include fixes for newly discovered security vulnerabilities.
That doesn’t necessarily mean blindly clicking “Update” every time something appears. Updates can occasionally create compatibility problems, which is why regular backups and ongoing website maintenance are important.
It does mean that a website shouldn’t sit untouched for years with outdated software running behind the scenes.
Regular backups, software updates, security monitoring and malware scanning should all be part of the ongoing care of a synagogue website.
5. Think Carefully About Publishing Staff Email Addresses
Synagogues naturally want to make their staff accessible. Someone visiting the website should be able to figure out how to contact the rabbi, religious school, executive director or office.
That doesn’t necessarily mean every individual staff email address needs to be displayed publicly.
Email addresses published on websites can be collected automatically and used for spam, phishing attempts and other unwanted messages. Jewish organizations may have additional reasons to limit how easily someone can collect an entire staff directory.
There are several ways to balance accessibility with privacy.
You might use a contact form, provide general addresses for certain departments, or publish individual contact information selectively rather than displaying a complete directory of email addresses.
The right approach will vary by synagogue.
The important thing is to make the decision intentionally rather than simply assuming every piece of contact information needs to be public.
6. Be Thoughtful About Photos and Personal Information
Photos are an important part of a synagogue website.
In fact, I generally encourage synagogues to use photographs of their actual community whenever possible. Authentic images of people praying, learning, celebrating and spending time together can tell the story of a congregation far better than generic stock photography.
But there is a difference between showing your community and identifying everyone in it.
Consider whether members need to be named in publicly accessible photos, particularly children. Have policies in place regarding photography and permission to use images, and be sensitive to members who may have personal or professional reasons not to appear publicly.
You can show that your synagogue is filled with real people and real relationships without turning your website into a public directory of everyone who participates.
7. Don’t Hide the Information People Actually Need
Security considerations can sometimes push organizations too far in the opposite direction.
A synagogue still needs to be findable.
People need to know where you’re located. They need a way to contact you. Prospective members need to understand who you are. Someone thinking about attending a Shabbat service shouldn’t feel as though they’re trying to uncover secret information.
Your synagogue’s street address, main telephone number and general contact information are usually already available through search engines, maps and online directories. Removing useful information from your own website may inconvenience legitimate visitors without meaningfully improving security.
Instead, distinguish between information that helps people connect with your synagogue and information that doesn’t need to be publicly available.
That’s a much more useful question than simply asking, “Should we put this online?”
8. Pay Attention to What Your Website Reveals
Sometimes the issue isn’t one individual piece of information, but what someone could learn by putting several pieces together.
For example, does the website publish detailed staff schedules? Does it identify when the building will be empty? Does a page contain an old document with information that should no longer be public? Are membership directories, internal forms or other documents accessible through links that were never intended for the general public?
It’s worth periodically looking at your website from an outsider’s perspective.
And don’t forget about old content. A page doesn’t necessarily stop being accessible simply because you’ve removed it from the navigation.
9. Have a Plan for When Something Goes Wrong
No website or online account can be made completely immune to security problems.
What’s important is being prepared to respond.
Know who is responsible for the synagogue website and whom staff should contact if they notice something unusual. Maintain reliable website backups. Make sure more than one appropriate person knows how to reach your hosting company, domain registrar and other critical service providers.
If an account may have been compromised, respond quickly: change the affected credentials, review account access, enable or reset two-factor authentication where appropriate, and investigate what happened.
Having a plan before there’s a problem makes a stressful situation much easier to manage.
Security Without Disappearing
There is an understandable tension here for synagogues.
We want our communities to be open and welcoming. We want people searching for Jewish life to find us. We want prospective members to see who we are and current members to have easy access to the information they need.
At the same time, being a Jewish institution means taking security seriously — both in the physical world and online.
Those goals don’t have to be in conflict.
Good online security is largely about making thoughtful choices: protecting accounts, maintaining the technology behind the website, limiting unnecessary access and being intentional about what information is made public.
Your synagogue can take those precautions while still having a website that is warm, visible and welcoming.
In fact, that’s exactly what a good synagogue website should be.