Nonprofit Fundraising Platform & Security Remediation
whjesp.orgSummary
Willie Hutch Jones Educational and Sports Programs has served Buffalo since 1984. After retiring from professional basketball, Willie Hutch Jones founded it with Leroi Johnson and the late Bernard Mitchell, having seen how few opportunities existed for young people in the community they grew up in.
Forty years on, WHJESP gives under-served youth free access to sports, STEAM projects, and wellness programmes. Basketball, tennis, softball, baseball, swimming, volleyball, and soccer all run under the same banner. The people who fund that work are individual donors and local sponsors, which makes the website less of a brochure and more of a fundraising desk.
The Problem
For a nonprofit, the site has one commercial job: turn interest into a donation or a sponsorship. WHJESP's was not built to do that. Giving and sponsorship were pages rather than paths, and a sponsor who committed money got very little visible recognition back, which is the thing that makes a sponsor renew.
Underneath, the site had inherited real security debt from previous hands. The theme carried critical vulnerabilities, a commercial plugin had been installed from a pirated distribution, an error log sat exposed in a public directory, and WordPress core was two major versions behind. None of it was visible to a visitor, and all of it was a risk to an organisation that accepts donations online.
The Solution
We ran two tracks at once. The first built the fundraising infrastructure the organisation actually needed: a donation flow with its own confirmation step, a sponsorship page with defined tiers, and a sponsor strip that carries Platinum and Gold supporters across every page of the site rather than burying them on one.
The second closed the security debt. We remediated the vulnerability classes in the theme, removed the pirated plugin and the exposed files, brought WordPress core current, cleared out six plugins nobody was using, and hardened the server itself.
Alongside both, we built the pages the programmes run on. Programme listings, a Project Play baseball and softball page, and an annual S.T.E.A.M. Fair page that gets updated each year instead of rebuilt.
What we built
Two jobs running in parallel. Build the things that bring money in, and close the things that put the organisation at risk. If you run a nonprofit, the first list is probably what you came here for.
A donation flow, not a donate button
A dedicated giving page with its own confirmation step, so a donor gets an acknowledgement rather than being dropped back on the homepage.
The moment after someone gives is the moment they are most willing to do something else, whether that is sharing, subscribing, or giving again next year. Most nonprofit sites waste it. A confirmation step is also where receipting and follow-up start.
Sponsorship with defined tiers
A sponsorship page that sets out packages and benefits by tier, so a prospective sponsor can see what a given level actually gets them.
Sponsors are buying visibility and association, not making a donation. If the benefits at each level are vague, the conversation stalls or defaults to the cheapest tier. Writing them down moves sponsors up the ladder.
Sponsors visible on every page
A site-wide strip above the footer that carries Platinum and Gold sponsors across the whole site, not just the sponsorship page.
This is the renewal argument made concrete. When a sponsor can point a board at their logo appearing on every page of an organisation their community trusts, next year's conversation is much shorter.
Programme and event pages
Templates for programme listings, a Project Play baseball and softball page, and an annual S.T.E.A.M. Fair page with a matching homepage feature.
Recurring programmes need pages the staff can update each season rather than rebuild. The event page is designed to be re-dated and refilled each year, so the cost is paid once.
Critical vulnerabilities closed
Three classes of vulnerability in the theme were remediated: injection through unsanitised query input, cross-site scripting through unescaped output, and unsafe file inclusion.
These are the vulnerabilities that let an attacker read a database or run code as your site. On an organisation that collects donations and holds contact details for young people and their families, that is not an abstract risk. The fix was input validation, output escaping, and safe include paths throughout.
Pirated and abandoned code removed
A commercial plugin installed from a pirated distribution was removed, along with an exposed error log and a stale backup file sitting in public directories.
Pirated plugins are one of the most common ways WordPress sites get compromised, because the crack is often the payload. They also receive no security updates. If you inherited a site and do not know where its plugins came from, this is worth an afternoon.
Core and plugin hygiene
WordPress core brought current from two major versions behind, and six unused plugins removed entirely.
Every plugin is code you are trusting and surface you are defending. Removing what nobody uses is the cheapest security and performance work available, and almost nobody does it.
Server hardening and performance
Security headers, blocked access to sensitive paths, the database locked to local access, and PHP execution disabled in the uploads directory. Performance was rebuilt against a Lighthouse audit with script deferral, resource hints, and asset cleanup.
The hardening is the layer beneath the application, and it is usually nobody's job. The performance work matters because donors on phones on slow connections are still donors, and every second of load time costs some of them.
The services behind this
This project was a platform build followed by an ongoing maintenance and optimisation relationship, with the security remediation running through both.
Run a nonprofit?
If your site is meant to bring in donations and sponsorships but is not really built to, or you have inherited something you are not sure is safe, that is the work we do. Tell us where you are and we will tell you what it takes.