No Stress Web Success

Hey — for tons of portfolios, small business sites, landing pages, and simple blogs, pure HTML + CSS (especially with Tailwind) is the fastest, cheapest, and most secure choice. No WordPress updates, no plugin headaches, no database to worry about — just files that work. Worried about contact forms? Don’t be. Point your form at a form service or a tiny serverless function and you’ve got email, spam protection, and low maintenance. Start simple — you can always add complexity later. Join Fivepenny Web Studio for episode 12 of No Stress Web Success and visit us at fivepennyweb.com for all your WCAG accessibility questions and concerns.

Hey friend — quick heads up from Episode 11 on WCAG 1.4.1: color is great, but it can’t be the only way your site shares meaning. If someone took the color away, would they still know what to click, what’s urgent, or which events are for kids? Join us today as we break down this rule and provide you with quick actions steps to help you determine how your website displays information and color. If you want help figuring out a specific page, swing by fivepennyweb.com and send a note — I’d love to help.   Resources: WAVE Chrome extension  Silktide Chrome extension

A critical PHP vulnerability hit the news this week, and if you have a WordPress website, it affects you. The good news is that you don’t need to be technical to handle it. You just need to know who is responsible for the fix and what to ask. In this episode of No Stress Web Success, Lisa explains the PHP vulnerability in plain English: what it allows, why updating WordPress or your plugins won’t fix it, and why the repair has to happen on the server. You’ll learn the difference between the PHP your website uses and the PHP installed on the hosting server, and how shared hosting, isolated hosting (like Pressable and SiteGround), and private servers (like Cloudways and xCloud) change who protects you. We also break down what “patching” really means: installed, restarted, and checked. Don’t panic, but do ask. Here are five questions to send to your host or web developer: On my plan, who is responsible for patching PHP: you, me, or my developer? Has the October 21st PHP security release been applied to my site’s server, and when? What PHP version am I on, is the whole server covered, and is that version still supported? If the full fix isn’t in place yet, what protection is active right now, and when will the real fix land? After patching, will anyone check my site for signs of anything that happened before the fix, and what happens if you find something? As always, if you have questions about your own site, reach out to us at fivepennyweb.com and leave us a review wherever you listen to your favorite podcasts.

In part two of our look at WCAG 1.3.1, Info and Relationships, we tackle the places where nonprofit websites struggle most: forms, tables, and meaning that depends on color or layout. You’ll learn how to make sure your donation, volunteer, and event forms work for everyone, why a red error message isn’t enough on its own, and how to make schedules and board lists easy to follow. We walk you through a simple page check you can run yourself, with no coding needed, and shares the most common mistakes to avoid. Written for nonprofit leaders and small teams who manage their own websites. Have a question or a page you’re wrestling with? Send it at fivepennyweb.com, and please leave feedback on the podcast wherever you listen.

Securing Your Nonprofit’s WordPress Website Your nonprofit’s website is where donors give, volunteers sign up, and the people you serve look for help. If you manage it yourself, keeping that WordPress website secure is part of protecting your mission, but you don’t have to be a developer to do it. In this episode, Lisa walks executive directors and small marketing teams through the essentials of a secure nonprofit website in plain language. You’ll learn why hosting matters, how to enforce HTTPS, which features to disable (like XML-RPC) and which to restrict instead (the REST API), how to set up two-factor authentication and much more. Some of these you can do this afternoon, and some you can hand to your host or web professional. The 10-point checklist Choose a WordPress-focused host with backups and a firewall. Force HTTPS on every page, and use a hosted payment processor for donations. Keep WordPress core, plugins, and your theme updated. Delete unused plugins and themes, and vet the ones you keep. Review your users, remove old accounts, and use the lowest role needed. Turn on two-factor authentication, starting with administrators. Limit login attempts and retire the “admin” username. Disable XML-RPC if you don’t need it, and restrict (don’t remove) the REST API. Ask your host or developer to confirm the basics: file editor off, correct permissions, a firewall. Run automatic off-site backups, test a restore, and set up vulnerability and uptime alerts. Resource mentioned Check your HTTPS status and confirm your website is showing secured content over HTTPS by visiting: https://www.whynopadlock.com/ Take the next step Visit fivepennyweb.com to learn how Fivepenny Web Studio helps nonprofits build accessible, secure WordPress websites. Enjoyed the episode? Please leave a review wherever you listen. It helps other nonprofit leaders find the show.