Click each donate button and read whose name appears on the payment page, search the page code for the receiving account, rebuild buttons inside the payment account, and compare gifts received with the website every month.

Gifts that stopped arriving

Going through the summer appeal, a charity's treasurer notices that no online donations have arrived since spring. The website looks exactly as it did, and the donate button still works.

Then a parent mentions the gift she made through the site in June. There is no record of it anywhere in the charity's payment account.

The button worked perfectly. It simply sent the money somewhere else, and nothing on the page showed it.

What a simple payment button holds

Many simple payment buttons are a small form in the page's code. The visitor sees one button, but the code carries hidden details that travel to the payment service:

The first item decides where every gift goes. Change those few characters and the button keeps looking, and working, exactly the same.

Two quiet ways a button changes

Someone who gets into the site, through an old password or out-of-date software, can edit that one hidden field. No visitor would notice, and nobody at the charity reads the code.

The innocent route is just as quiet. A volunteer copies a neat button from another organisation's site, changes the wording, and never sees the address hidden inside.

Copied code also turns up when a site is rebuilt from an old template, or when a former volunteer's own account, used for testing, was never replaced.

Why nobody notices

Donors pay as usual and receive a receipt from the payment service. The receipt names the account that took the money, but few donors read past the amount.

At the charity, the only sign is silence, and a quiet month in summer looks like any other quiet month.

Sometimes the first real clue is a donor asking why the receipt shows another organisation's name.

Where a button sends the money

Click each donate button and read the payment page before paying. It names the organisation that will receive the money, and that name should be yours.

Then view the page's source in the browser and search for the address inside the button's code. It should be the charity's own account address, letter for letter.

Check every button: the main donation page, the sidebar, event pages and old appeal pages still online. A small test gift, followed until it appears in the account the treasurer actually uses, confirms the whole route.

Buttons that hold no address

Many payment services let you create the button inside your own account. The page then carries only a reference number, and the receiving account stays stored with the service.

Changing where such a button sends money means signing in to the charity's payment account, which someone editing the website does not have.

A donation page hosted by the payment service works the same way. The website links to it, and the receiving account is set inside the service.

A worked example

A youth centre in a suburban neighbourhood runs drop-in evenings, a homework club and summer day camps, and asks families and neighbours for donations through a button on its website.

In the spring a volunteer refreshed the donation page. She started from the button code on a larger charity's site because it looked tidier, and changed the wording but not the hidden address.

The treasurer noticed in July, while comparing the summer appeal with the payment account. Clicking the button showed the other charity's name on the payment page.

The button was rebuilt inside the centre's own payment account, so the page now holds only a reference. Logins to the site were reviewed, and the treasurer contacted the other charity about the gifts.

On the first of each month someone now clicks every button and compares gifts with the website. The check covers the whole route, from button to account, so a change anywhere along it shows up.

Who can edit the page

List every login that can change the website: administrator and editor accounts, file transfer accounts and the hosting control panel. Each one is a way to edit a button.

Remove logins for volunteers and staff who have moved on, and give everyone else their own login rather than a shared one. Keep the site's software, theme and add-ons up to date.

Ask whoever built or looks after the site which accounts exist, including any set up for their own use, and which of them are still needed.

Matching gifts against the website

Once a month, compare the gifts in the payment account with what the website should have produced. Analytics shows visits to the donation page and to the thank-you page that follows payment.

Visits to the thank-you page with no matching gifts, or a long gap during an appeal, mean something between the button and the account has changed.

Send the payment service's notices to a shared address that several people read, so that a silence gets noticed.

The counter-case

A charity whose gifts come by cheque, or through a page run entirely by a payment service, has less code of its own to watch.

The link to that page still sits on the website, though, and a changed link is as quiet as a changed address.

And a charity with few online gifts may think the risk is small. One changed button during the main appeal of the year is not small, and the monthly check takes minutes.

A monthly check of the button

  1. Click every donate button and read the payment page.
  2. Search the page code for the receiving account.
  3. Rebuild buttons inside the payment account.
  4. List everyone who can edit the website.
  5. Remove logins that nobody uses.
  6. Keep the software and add-ons up to date.
  7. Compare gifts received with the website each month.

Step seven catches what the others miss. Whatever changed a button, a gap between visits to the thank-you page and gifts in the account shows up within weeks.

Why major updates are best tried on a test copy before the live site, with one recent release as the example, is covered in WordPress 3.9 and the editor buttons that went missing.

Frequently asked questions

How can a donate button send money to the wrong account?

Many simple buttons carry the receiving account, often an email address, in the page's code. Editing that one field changes where every gift goes, and the button looks the same.

How do we check where our button sends donations?

Click it and read the organisation's name on the payment page, then search the page's source for the account address. Check every button, including old appeal pages.

What is a button that holds no address?

One created inside your payment account. The page carries only a reference number, and changing the receiving account means signing in to the payment service, not editing the website.

Who should be able to edit the donation page?

Only current staff and volunteers who need to, each with their own login. Remove accounts for people who have left, and keep the site's software up to date.

How would we notice gifts going elsewhere?

Compare the gifts in your payment account each month with visits to the donation and thank-you pages. Visits without matching gifts mean something between button and account has changed.

Does this matter if most gifts come by cheque?

Less, but the website still sends donors somewhere, and a changed link is as quiet as a changed address. A monthly check of every button takes minutes.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Donations through the website gone quiet?

Send us the address of your donation page, and we will check where every button on it sends the money.

Start a Conversation