In short: If your club's website has been hacked or is on unpatched PHP, you do not need a large budget but you do need clear responsibility. One board member asks the host for the patch level, secures the access and, if necessary, decides to switch the site off temporarily. Member data takes priority over the events calendar.
How club websites are typically built
Most club and association sites run on WordPress or Joomla, set up by a dedicated member, often many years ago. Typical features: events and fixtures, photo galleries, a members' area with minutes, online membership applications with a SEPA direct debit mandate, donation forms and registrations for courses, tournaments or trips.
Associations additionally run portals for member companies or local groups, committee areas with confidential documents and seminar bookings. Almost all of this is based on PHP and sits on inexpensive web hosting.
Which member data sits on the server
Online membership applications contain names, dates of birth, addresses and bank details. In sports clubs many members are minors, and applications then also name the legal guardians. Some details belong to the special categories under Art. 9 GDPR, such as health information in rehabilitation and disability sports, or membership of trade unions and religious communities.
Forgotten files often sit on the server as well: member lists as a spreadsheet for the treasurer, exports for mailing the club magazine, old backups. These are precisely the files that are quickly copied in an attack.
With associations, other data comes in: contacts and key figures of member companies, draft position papers, minutes of board and committee meetings. What was discussed there in confidence can, if leaked, weaken negotiating positions or set members against each other. For associations, the members' area is therefore often more sensitive than the public website.
Club and website hacked: what this means in concrete terms
- Misuse of bank details: With names and IBANs, forged direct debits or fraud emails in the club's name can be prepared.
- Reputation in the community: A club site that redirects to dubious offers is noticed by members, sponsors and the local press.
- Reporting duty: Clubs are also controllers under the GDPR. In a data leak, a report to the supervisory authority within 72 hours may be necessary. Larger clubs have a data protection officer for this; smaller ones turn to the umbrella organisation or legal advice.
The typical gap: volunteering and board changes
In a club, often only one person knows the technical details. If they leave or the board changes, login details are missing and nobody knows which PHP version is running. A CMS update does not close PHP2Shell. With ordinary web hosting, the host is responsible for PHP, but the enquiry has to come from the club.
Determine within the board who is responsible for the website, and store access to the domain, hosting and admin area so that at least two people can reach it. Protect admin accounts with two-factor login.
First steps for the board
- Ask the host in writing: has PHP for our package been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or patched by backport, and restarted?
- Without a clear answer, or if anything looks unusual, switch the site off temporarily. Dates can be distributed by circular email in the meantime.
- Ask the host to retain logs from 20 October 2026 onward.
- Remove old member lists, exports and unused plugins from the server and delete surplus admin accounts.
- If there are indications of a data leak, involve the data protection officer or the umbrella organisation.
Setting sensible priorities on a small budget
No club has to implement every security measure at once. A sensible order is by damage: first protect or remove everything that contains bank details and children's data. Then the pages with a login, that is, the members' area and admin access. Last come events, reports and galleries, which are public anyway.
Often the cheapest solution is to hand functions over rather than operate them yourself. Membership applications and direct debit mandates can be handled through a club management service run by a provider, instead of a self-built form. Associations with portals for member companies should check whether confidential committee documents sit there that would be better kept in a separately protected system. The less data sits on the club website, the less effort the next vulnerability causes.
How does PHP SOS help?
- We help the board get access back and clarify the patch level with the host.
- If you suspect a problem, we check the site for malicious code and unknown accounts and clean it up through our emergency help.
- We tidy up selectively: what a club does not need is removed rather than secured further.
- We give you a short, understandable handover, so that the next board also knows what is where.
Frequently asked questions
Is the board liable if the club website is hacked?
The club is responsible for its members' data, and the board represents the club. Whether and how far personal liability comes into play depends on the individual case and the club's statutes. That is a question for legal advice or the umbrella organisation.
Our webmaster has left. How do we get the access details?
The contracting party of the host is usually the club. With proof of authority to represent the club, such as an extract from the register, the board can have access reset at the host. Afterwards, the login details should be kept in one place to which at least two board members have access.
What costs nothing and helps immediately?
Ask the host in writing about the PHP patch level, delete unused admin accounts, remove plugins that are no longer needed and delete old member exports from the server. This lowers the risk considerably but is no substitute for a review if there are already signs of a hack.