Why Campaign Websites Get Hacked (and How to Make Yours Boring to Attack)

Campaign sites get attacked at every level of the ballot, and the attacks are rarely sophisticated. They do not have to be, because most campaign websites are soft targets: an old CMS, a shared password, a plugin nobody updated since the primary.

The actual threat model

• Automated exploitation. Bots scan every domain on the internet for known CMS vulnerabilities. Your site gets probed within hours of going live regardless of the size of your race.
• Defacement. Low-skill, high-embarrassment. A hacked campaign site is a guaranteed local news story, and the story is never about your issues.
• Donation interception and credential theft. Rarer, but catastrophic: a compromised donate flow is both a crime scene and a campaign-ending headline.
• DDoS around debates and election day. Timed to when you can least afford downtime.

The architecture answer

You cannot patch your way to safety on a volunteer schedule, so remove the attack surface instead. Publish static files: plain HTML served from a global CDN with built-in DDoS absorption. No database, no admin URL, no plugins. The public site becomes roughly as hackable as a PDF. Handle payments entirely through your processor (WinRed, ActBlue, Stripe) so card data never touches your infrastructure, and keep editing behind a separate authenticated service that is not exposed on your public domain.

This is precisely how Ballot Page publishes every site, with versioned snapshots so any change can be rolled back in one click. The 2 a.m. "who changed the site" question should have a button, not a meeting.