I was sitting in a cafe on a Sunday morning, scrolling through Twitter and drinking my coffee. I saw people retweeting something from Donald Trump. Then I realized he had taken a direct attack against one of our hosted advocacy groups.
I packed up my coffee and my bagel, and I went home.
"When Donald Trump takes a direct attack against your advocacy group, that means there's going to be a bump in traffic, and there's probably going to be security threats."
Nothing catastrophic happened that morning. But the point is that I was watching. Because when you host advocacy and campaign sites at the national level, Sunday mornings can turn into war rooms without warning.
The threat landscape these organizations operate in is unlike anything a normal business faces, and the hosting infrastructure behind them needs to reflect that reality.
WordPress powers everything from local campaign sites to WhiteHouse.gov. It's the platform of choice across the political spectrum, and for good reason: it's flexible, well-supported, and has a deep ecosystem for donations, petitions, and advocacy tools.
We've been hosting advocacy organizations, national PACs, and campaign sites for years. What we've learned is that the hosting profile for these organizations is fundamentally different from anything else in the WordPress ecosystem.
It's not a variation of nonprofit hosting. It's not just "business hosting with more traffic." It's a category of its own, and treating it as anything other than that puts the mission at risk.
The Advocacy Hosting Profile: Quiet, Then Everything at Once
Most websites grow traffic gradually. A blog post does well, a newsletter drives some clicks, and a social campaign builds over weeks. You can see it coming. You can plan for it.
Advocacy and campaign sites don't work that way.
These sites are quiet for weeks, sometimes months, with traffic at baseline levels. Then something happens. A candidate makes a statement. Legislation drops. A news cycle picks up your issue. A viral moment hits. And suddenly your site is handling 50 to 100 times its normal traffic.
The numbers from recent election cycles tell the story. When Biden withdrew and endorsed Harris on July 21, 2024, ActBlue processed $81 million in 24 hours from 888,000 donors. The campaign raised $200 million in the first week.
On election night 2024, internet traffic peaked 15% above normal after the first polls closed, with DNS request volume 325% higher than the previous week. In the UK, DNS traffic to Labour's website spiked 866% on election day.
These aren't gradual curves. They're vertical lines on a chart.
And it's not only the unpredictable spikes. Predictable fundraising deadlines compound the challenge. Year-end giving drives 23-52% of annual online revenue in December alone, with December 31 accounting for 5% of total annual nonprofit revenue.
Giving Tuesday 2024 generated $3.6 billion in donations from 36.1 million participants. FEC quarterly filing deadlines trigger major fundraising pushes for political organizations. Your infrastructure has to handle both predictable and unpredictable peaks, and sometimes they fall on the same day.
What makes this pattern so dangerous for hosting is that it's not always easy to see coming. A fundraising email to 50,000 supporters is predictable. A viral moment driven by someone else's content is not.
"A lot of times that attention is not driven by the content that they're producing, but the content that others are producing."
A candidate says the wrong thing, a clip goes viral, and something gets divulged. Suddenly, your site is the focal point of national attention, and you had no say in the timing. That Sunday morning Trump tweet is the perfect example. Nobody on our advocacy client's team woke up that day expecting to be in the president's crosshairs. But they were, and the hosting infrastructure needed to be ready regardless.
This is why we prepare for maximum expected traffic from day one, including unpredictable spikes. We don't wait for a client to tell us they're about to be in the news. If we've done our jobs correctly, the optimizations are already in place.
"Autoscaling is for those who realistically cannot predict what the spikes are going to be and they're so erratic that you need that capability."
That's the honest framework. Most organizations don't need autoscaling. They need proper provisioning, correct caching, and a CDN that keeps 90%+ of traffic off the origin server. We don't default to the most expensive solution. We default to the right one.
When Hosting Fails at the Worst Possible Moment
The consequences of inadequate hosting are abstract for most organizations. A few minutes of downtime, some frustrated visitors, maybe a support ticket. For advocacy and campaign sites, the consequences are concrete and permanent.
Consider what happened to WinRed on May 30, 2024. After Trump's guilty verdict, donors flooded the platform. WinRed crashed within an hour, showing a maintenance page during what would become a $34.8 million fundraising day.
Nobody knows how much money was lost during that outage window. But given the velocity of donations that day, even 30 minutes of downtime likely cost millions in contributions that would never be recovered.
ActBlue, by contrast, processed $81 million in 24 hours upon the Harris announcement. The platform stayed up because it was purpose-built for exactly this scenario.
Here's the detail that makes the infrastructure argument even stronger: 60% of those donors were first-time contributors of the 2024 cycle. First-time donors are slower. They're less committed. They're more likely to abandon a page that loads slowly or behaves strangely. If that infrastructure had struggled under the load, the drop-off rate among those new donors would have been devastating.
But ActBlue is a dedicated fundraising platform with infrastructure designed for political fundraising at scale. Most advocacy organizations are running WordPress sites on standard hosting.
The question every campaign manager and advocacy director should ask: What happens to your WordPress site when your moment arrives?
We saw this play out firsthand with the North Carolina Budget and Tax Center. They published time-sensitive reports tied to state legislature sessions. Reports that influenced government hearings, which required constituent action within narrow windows. Every time they released a report, their site went down. Bluehost couldn't handle the traffic spike.
"They ran up the tiered support ladder, and the only suggestion was to upgrade their plan because they had checked their infrastructure and nothing was wrong."
That's the budget hosting playbook. Your site crashes, you call support, they tell you the server is fine, and they try to sell you a bigger plan. No guarantee the upgrade would help. No analysis of the actual cause of the failure. No proactive monitoring. Just a sales pitch during a crisis.
We moved them to a properly provisioned server with appropriate caching and CDN configuration. They haven't had a downtime issue since.
Targeted Attacks: Not Random Bots, Someone Who Wants You Offline
Here's where advocacy hosting diverges most sharply from every other category. Most day-to-day website security threats are non-targeted. Bots scan the internet for vulnerable WordPress installations, try default credentials, and probe for known exploits. It's background noise that a decent firewall and security plugin handle without you ever knowing.
Advocacy and campaign sites face something entirely different: people deliberately trying to hurt them.
Cloudflare blocked over 6 billion HTTP DDoS requests targeting U.S. election-related websites in just the first six days of November 2024. That's not background noise. That's a coordinated campaign.
For comparison, in November 2020, Cloudflare blocked approximately 25 million such requests. That's a 240x increase in four years.
The documented attacks from the 2024 cycle are staggering:
- On October 29, a campaign website was hit with an attack peaking at 345,000 requests per second.
- Two days later, the same target took a sustained attack for over an hour at 213,000 requests per second.
- On November 1, a state political party website received over 2 billion malicious HTTP requests in a single 24-hour period.
- On election day itself, South Dakota's election website was attacked for over two hours during peak voting hours.
Internationally, the pattern is the same. Pro-Russia hacktivists attacked Dutch political parties during the EU elections. The UK's Conservative Party website was hit four separate times during their election campaign. Romania's presidential election was ultimately annulled partly due to 85,000 cyberattacks on the election infrastructure.
The attackers aren't just random hacktivists. State-sponsored groups have documented programs targeting U.S. political organizations. Russia's CARR (likely funded by GRU unit 74455) conducted DDoS attacks through at least September 2024. Iran's IRGC compromised an email account associated with Trump's campaign in June 2024. China's Salt Typhoon operation compromised nine major telecommunications providers, gaining access to communications of presidential candidates.
These four nations sponsored 77% of all suspected cyber operations since 2005. When you're hosting a campaign or advocacy site, you're operating in a threat environment that includes nation-state adversaries with essentially unlimited resources.
In July 2024, CISA and the FBI jointly released a public service announcement warning that DDoS attacks were expected against election infrastructure. When the U.S. government officially warns that attacks are coming, the question isn't whether your site will be targeted. It's whether you're ready when it happens.
And it's not only DDoS. In July 2024, hacktivists stole over 200GB of data from the Heritage Foundation, exposing 72,000 unique email addresses, usernames, passwords, and phone numbers. The breach was politically motivated, timed for maximum impact during the election cycle.
Think tanks and policy organizations are high-value targets, not just campaigns.
We've experienced this directly with our clients.
Two weeks before a national election, one of our campaign clients was targeted by a DDoS attack. The goal was clear: block the donation page, cut off contributions during the final fundraising push. This wasn't a random bot. This was deliberate, timed for maximum damage.
The FBI got involved. I was on the phone with agents reviewing our server logs, working through the forensics of a targeted cybercrime.
"Those are very stressful times. It's not something we just sit around and hope that our firewall catches."
The response was hands-on and multi-layered:
- We dug through firewall logs to identify and block IP addresses and ranges.
- We wrote rate-limiting rules on the fly during the active attack.
- We locked the site down to US-only traffic to cut off the foreign bot network.
- We addressed the attack at the server level, the firewall level, and the application level simultaneously.
The Credit Card Validation Scheme
There's another attack vector that most hosting providers have never encountered. We've dealt with stolen credit card validation schemes run through campaign donation forms.
Here's how it works: criminals use campaign donation forms to test whether stolen credit card numbers are valid. They run small transactions, one after another, using your donation form as a validation tool.
The effect on your infrastructure is similar to a DDoS attack: thousands of fraudulent transactions hitting your server and payment gateway simultaneously.
But the real damage goes beyond server load. If your payment gateway detects the pattern, it can flag your account. They might freeze contributions entirely, blocking legitimate donors from giving at the exact moment you need them most.
Our response was to increase minimum donation amounts to stop the validation testing, implement additional rate-limiting on donation forms, and work at every layer of the stack to distinguish fraudulent from legitimate traffic.
Some of these schemes may have been targeted. When you're a campaign accepting political donations, the line between criminal fraud and political sabotage gets blurry.
Donation Processing: Where Seconds Equal Dollars
For most websites, a slow page is an annoyance. On an advocacy site during a fundraising push, a slow page costs revenue.
The data is unambiguous. As page load time increases from 1 second to 3 seconds, the chance of a visitor leaving increases by 32%. At 4 seconds, conversion drops by more than 450% compared to a 1-second load.
The Obama campaign proved this definitively: by reducing donation page load times from 5 seconds to 2 seconds, they increased conversions by 14%, generating an additional $34 million in donations.
These numbers assume normal traffic. During a spike, everything gets worse. When a server is under load, page render times climb. Payment gateway API calls start timing out. The WordPress database, which handles write operations for every donation, becomes a bottleneck.
Donors who see a slow or unresponsive page don't wait. They leave, and in political fundraising, they rarely come back. The moment passes.
We've never had a donation process fail due to pure legitimate traffic load. That's the result of proper planning: adequate server resources, effective caching strategies, and CDN configurations that keep 90% or more of traffic off the origin server.
"That doesn't mean I'm not nervous. If a client is getting highlighted on CNN or Fox News, I'm watching Google Analytics real-time reports. Seeing hundreds or thousands of people hitting a website is a little nerve-wracking for the guy who's responsible for making sure that the donation page stays up."
The key is that the anxiety is professional awareness, not panic. By the time a client's moment arrives, the infrastructure should already be in place to handle it. We don't cram websites onto undersized servers and hope for the best. We make educated estimates of worst-case traffic and prepare accordingly.
How Donation Infrastructure Actually Works
Understanding the technical flow helps explain why hosting matters so much for the reliability of donations. When a donor clicks "contribute," several things happen in sequence:
- WordPress renders the donation form
- The donor enters their information
- JavaScript on the page tokenizes the payment data (Stripe.js or PayPal SDK handles this client-side, so card numbers never touch the WordPress server)
- The WordPress donation plugin sends the tokenized request to the payment gateway
- The gateway processes the charge and returns success or failure
- WordPress records the donation in its database and sends a confirmation email
Step 3 is where organizations most often get it wrong. If your payment integration isn't using client-side tokenization, raw card data passes through your server, creating a PCI compliance nightmare. We insist on Stripe for a reason: the tokenization architecture is the cleanest, and it keeps financial data off the WordPress server entirely.
Each step in this chain depends on the previous one, and each can become a failure point under load. The WordPress server needs enough resources to render pages quickly. The database needs capacity for concurrent write operations. API connections to payment gateways must complete within timeout limits.
When any of these steps slow down, you get cascading problems:
- Transaction timeouts where the charge went through on the gateway, but WordPress didn't get the confirmation.
- Donors refreshing and clicking "Donate" again, potentially creating duplicate charges.
- Abandoned donations from people who gave up on a page that wouldn't load.
We don't store any financial information on client websites and wouldn't accept clients who do. The gateway handles transaction processing (we prefer Stripe, but also work with Square and PayPal). Our responsibility is to ensure the API connections are stable, the site has adequate resources, and the infrastructure between the donor and the gateway is fast and reliable.
What Proper Preparation Looks Like
We prepare for spikes before they happen. Clients don't need to call us before sending a fundraising email or announcing a campaign initiative.
"If we've done our jobs correctly, then all the optimizations are already in place."
That preparation has multiple layers.
CDN and edge caching keep most traffic off the origin server. For advocacy sites, this means informational pages, issue pages, press releases, and blog posts are served from Cloudflare's 310+ global data centers, not from the WordPress server.
We consistently achieve CDN hit rates above 90%, meaning 90% or more of traffic never touches the web server at all. The more traffic you get, the more efficient this system becomes.
Server provisioning is based on maximum expected traffic, not average. We don't skimp. We don't put advocacy sites on the smallest plan and expect the CDN to handle everything. The server behind the CDN needs to comfortably handle the remaining dynamic traffic: donation forms, action pages, petition signatures, and the WordPress admin.
Security infrastructure is layered. DDoS protection at the CDN level. Web Application Firewall rules specific to WordPress. Rate limiting on sensitive endpoints like login pages and donation forms. Geographic filtering when appropriate. Bot management to distinguish legitimate traffic from automated attacks.
This isn't an add-on. It's a baseline requirement for any site operating in the advocacy and campaign space.
Monitoring is proactive. We don't wait for a client to call and tell us their site is down. Our monitoring detects issues before they become outages, and when we see resource usage climbing, we act.
If a site needs more resources, we move it to a higher-capacity server. No questions asked, no additional charges.
When We've Had to Go Further
Sometimes preparation means building something temporary for a specific moment.
We had an international nonprofit client that was about to be featured on a major TV network in one of the world's most populous countries. The TV station warned them directly: "Make sure your website can handle traffic. Past profiles have crashed websites and lost donation opportunities."
In under 48 hours, we deployed a full load-balanced architecture. A load balancer in front of the web server, distributing traffic to regional nodes: European traffic went to a European server, South Asian traffic went to a South Asian node, and US traffic went to the scaled-up original server in New York. Three continents covered.
The broadcast went off without a problem. The client collected donations throughout. The spike lasted about two hours, then subsided. We left the infrastructure up through the weekend, then brought everything back down on Monday. The client only paid for additional resources for that single weekend.
That story illustrates two things. First, the technical capability to deploy multi-region infrastructure quickly when the moment demands it. Second, the mindset that hosting is something you actively manage, not something you set and forget.
The Free Protection Ecosystem Most Campaigns Don't Know About
One of the most underserved areas in advocacy hosting is awareness of free, enterprise-grade protection programs that already exist. Most campaign managers and advocacy directors have never heard of them.
Cloudflare Project Galileo has been providing free enterprise-level security to at-risk organizations since 2014. It now protects over 2,600 organizations in 111 countries, mitigating approximately 96 million DDoS attacks per day. Eligibility includes news-gathering organizations, civil society groups, and organizations that promote political or artistic speech. Partner organizations include the EFF, Freedom of the Press Foundation, CDT, and the ACLU.
Google Project Shield offers free DDoS protection powered by Google Cloud Armor. It expanded to cover U.S. political campaigns, candidates, and PACs in 2018. The application process is straightforward and is typically approved within 48 hours.
Defending Digital Campaigns is a nonpartisan nonprofit that has provided over $7.9 million in free cybersecurity products and services since 2019. In the 2024 cycle alone, they fortified over 360 campaigns with $4.6 million in donated security tools.
Their partners include Cloudflare, Google, Microsoft, and Yubico. They were founded by former Clinton and Romney campaign managers, which gives you a sense of the bipartisan urgency behind the initiative.
Cloudflare for Campaigns, distributed through Defending Digital Campaigns, provides free DDoS and WAF protection to eligible political websites.
The problem isn't that these programs don't exist. It's that nobody explains how to layer them with your WordPress hosting to create genuine defense in depth.
A campaign can use Cloudflare for Campaigns for edge-level DDoS protection, Google Project Shield as an additional layer, and managed WordPress hosting with its own security stack behind it all. But someone needs to configure and manage the integration, and that's where having a hosting partner who understands this ecosystem matters.
What to Look For in Advocacy Hosting
If your organization operates in the advocacy, campaign, or political space, here's how to evaluate whether your hosting can handle the mission.
Does your host understand your traffic pattern? Standard hosting assumes gradual growth. Advocacy sites need infrastructure that handles quiet periods efficiently and absorbs massive spikes without degradation.
Ask your host how they handle a 50x traffic increase in two hours. If the answer involves upgrading your plan after the fact, that's the wrong answer.
Is DDoS protection a baseline or an upsell? For advocacy sites, DDoS protection isn't a premium feature. It's a minimum requirement. If your host charges extra for it, or only includes basic network-layer protection, that's insufficient for the politically motivated threat landscape you operate in.
"If you're paying less for your hosting than you did for your last fancy coffee at Starbucks, then you're doing it wrong."
Plans are available for $2-$20 a month. They're great for hobby sites and personal blogs. If your organization is running a national advocacy campaign or processing political donations, that's not where you cut costs.
Can your host respond when it matters? Not with a ticket queue and a 24-hour response time. When a campaign site is under attack two weeks before an election, or when a donation page is struggling during a viral fundraising moment, you need someone who picks up the phone.
Someone who already knows your site, your infrastructure, and your situation.
"If your organization is mission-critical, then so should your infrastructure."
Does your host monitor proactively? The difference between a managed hosting partner and a server rental company is what happens before the crisis.
Proactive monitoring catches resource usage climbing before it becomes an outage. It identifies suspicious traffic patterns before they become a full DDoS attack. It ensures your site is optimized and your CDN is properly configured before the spike hits.
Does your host understand the compliance environment you operate in? This one gets overlooked because hosting providers assume compliance is someone else's problem. It's not.
Your hosting infrastructure is where donor data lives, where transaction records are generated, and where the technical requirements of political compliance are met or not. More on this below.
Have you considered content moderation risk? Some hosting providers have terms of service that could theoretically be invoked against politically controversial content. While rare for legitimate organizations, it's a real concern for campaign sites working on contentious issues.
Understand your host's content policies before you're mid-campaign and discover you have a problem.
Compliance: The Dimension Nobody Talks About
This is the gap that almost every hosting provider ignores entirely. They assume compliance is the campaign treasurer's problem, not a hosting concern. But your hosting environment is where donor data gets collected, stored, and transmitted. The infrastructure decisions matter.
FEC recording requirements shape your donation forms. For contributions over $50, campaigns must record the contributor's name and mailing address. For amounts over $200, you need your full name, mailing address, occupation, and employer.
Your donation forms must reliably capture this data, and your hosting infrastructure must securely store and transmit it. When your database drops a transaction record during a traffic spike, that's not just lost revenue. It's a compliance gap.
Contribution limits require real-time tracking. The current limit is $3,300 per candidate per election. Your donation infrastructure must enforce these limits, or at least flag them for review.
That means your WordPress database and donation plugin must be responsive enough to check contributor history for every transaction, even during peak load.
State-level requirements add another layer. Many states have their own reporting thresholds, often lower than the federal thresholds. Some states require real-time or near-real-time disclosure of large contributions.
With 17 states and counting now enforcing comprehensive privacy laws that affect how campaign sites handle donor data, organizations operating nationally face a patchwork of requirements that their hosting and data infrastructure must support.
Post-election doesn't mean post-obligation. Campaign sites often go dark after election day, but the FEC requires committee records to be maintained through filing deadlines and beyond.
What happens to your website data when the campaign winds down? Your hosting partner should have an archival plan that maintains data integrity and access for required reporting periods. This is one of the least-discussed yet most consequential hosting decisions a campaign makes.
PCI compliance governs the transaction flow. We handle this by ensuring card data never touches the WordPress server. Client-side tokenization through Stripe means the actual payment data goes directly from the donor's browser to the payment gateway. The WordPress server only handles tokenized references.
This dramatically reduces the compliance surface area, but it requires correct configuration. A hosting partner who understands this architecture can set it up right from the start.
Your hosting partner doesn't need to be your compliance attorney. But they need to understand the compliance environment you operate in well enough to build infrastructure that supports it rather than undermines it.
The Honest Assessment
We don't talk about advocacy and campaign hosting because it's a large market segment. The truth is, the number of organizations that need this specific kind of hosting expertise is relatively small. But for those organizations, the stakes are as high as they get.
When your donation page goes down during a viral fundraising moment, those dollars don't come back. When your site gets taken offline by a targeted DDoS attack two weeks before an election, the FBI gets involved because it's not a tech problem. It's a threat to democratic participation.
When the President of the United States attacks your organization on social media and your hosting can't handle what follows, the consequences extend well beyond website metrics.
We've been through all of these scenarios. Not hypothetically. Not as case studies we read about. These are Sunday mornings interrupted, FBI phone calls, and real-time attack mitigation during some of the most stressful moments our clients have ever faced.
The organizations doing this work deserve infrastructure that matches the seriousness of their mission. That means hosting built for the worst case, not the average case. Security as a baseline, not a feature. And a partner who understands that when the moment comes, there are no do-overs.
If you're evaluating hosting for a mission-critical organization, the framework is straightforward: understand your traffic patterns, prepare for spikes, secure against targeted threats, and ensure your donation infrastructure holds when it matters most. The right hosting partner will handle the complexity so you can focus on the mission.