When a volunteer builds your website or app, the risk is rarely bad intent. It is that one person holds the keys, nobody updates the code, and the knowledge leaves when they do. Ten questions about access, updates, dependencies, backups and handover turn a favor into something your organization can safely own.
Access and ownership
1. Who owns the accounts? The domain, hosting, code repository and app store accounts should belong to the organization, with the volunteer added as a user. If the volunteer's personal email is the owner, fix that first.
2. Who else can get in? Ask for a list of everyone with admin or deploy access. Remove anyone who no longer needs it.
3. Is two step login on? Turn it on for hosting, the domain registrar and the code repository. These are the accounts an attacker would love.
Updates and dependencies
4. Who updates it, and how often? Software that is never updated collects known weaknesses. For a WordPress site, the WordPress handbook says to always keep up to date with the latest version and to delete unused plugins. Get a named person and a rhythm.
5. What is it built from? Ask for a list of the libraries and plugins in use. For an app or custom site this is a dependency inventory, sometimes called an SBOM. Without it you cannot tell whether a newly announced flaw affects you.
The demo below shows what an inventory looks like and why it helps.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a package and look at how one direct dependency pulls in several others. That hidden list is what you ask your volunteer for.
Data and recovery
6. Where is the data, and what is collected? Donor, student or client data deserves a clear owner. If you collect more than you need, collect less.
7. Are there secrets in the code? Passwords, API keys and payment credentials should not sit in the repository or in a shared document. Ask how they are stored.
8. How is it backed up, and has anyone restored one? The WordPress handbook says to back up regularly, including the database, and to protect backups. A backup you never restored is a hope. Ask for a test.
Handover
9. Is there a one page handover document? Where it is hosted, how to deploy, who to call, where the credentials are kept. If the volunteer disappeared tomorrow, could someone else keep the site alive?
10. What happens if you want to stop? Agree in writing, in friendly terms, that the organization can take over or move the project at any time.
Make it routine
Ask the questions once, then review them yearly with a short checklist. Treat the volunteer as a valued contributor who deserves a sustainable setup, not a single point of failure.
Quick check
Who should own the hosting and domain accounts?
The organization. The volunteer should be a user on those accounts, not the owner, so access survives if they leave.
What is a dependency inventory?
A list of the libraries and plugins a site or app is built from. It lets you check quickly whether a new vulnerability affects you.
Safeguard offers dependency scanning and SBOM generation, and a free scan at gold.safeguard.sh/scan is a low effort way to see what a project contains. Our WordPress hardening checklist covers the site side.
Sources
- Hardening WordPress, WordPress Developer Resources
Last reviewed: 19 October 2026.
