THE SHORT ANSWER
Public educational site → PayPal-hosted giving / membership
These are architecture judgments for this scenario, not audited provider rankings or promises that any setup is breach-proof.
CHOOSE SOMETHING YOU CAN MAINTAIN
Three technologies. Different responsibilities.
Here, “outdated” means unsupported or known-unpatched components. React is assumed to be built into static files; adding a live server, accounts or an API changes the assessment. Simple HTML is assumed to have no backend or remote scripts.
Outdated WordPress
UpsideUseful editorial tools for a growing library of lessons and resources.
TradeoffOutdated donation and membership extensions can put years of donor history at risk.
For this businessA swapped donate link can divert charitable funds even when the site has no donor database.
Current React, many dependencies
UpsideSupports accessible interactive educational material and local learning tools.
TradeoffA full membership app adds authentication and data responsibilities that free learning pages do not need.
For this businessTreat imported educational widgets and account integrations as dependencies with an owner.
Simple HTML + self-contained JS
UpsideExcellent for durable public educational resources and PayPal links.
TradeoffManual publishing and membership reconciliation take more effort as the organization grows.
For this businessKeep donation exports outside public directories; protect the PayPal and registrar accounts.
FROM ADVICE TO ACTION
The details that matter.
Separate a donation from a membership purchase
Make the purpose of each payment visible before the visitor leaves your site. Do not imply that all membership payments are tax-deductible donations. PayPal’s US confirmed-charity rate is 1.99% plus $0.49 for eligible domestic charity transactions; approval and the transaction type matter. A general educational mission does not automatically qualify an account for that rate.
Sources: PayPal US: Merchant fees in the United States (external) ↗
Keep PayPal as requested; choose records separately
PayPal remains the payment destination in this guide. A donor CRM can track thank-you messages and renewal follow-ups using the minimum necessary records. The free tools below can support a low-volume manual import workflow. Do not assume they automatically synchronize direct PayPal payments or ongoing subscriptions; verify any integration before relying on it.
Sources: Givebutter: Givebutter pricing (external) ↗ · HubSpot: HubSpot free tools (external) ↗ · Bigin by Zoho: Bigin editions and pricing (external) ↗
Free fundraising tools have different payment models
Givebutter has a free Standard CRM; its own donation processing has separate tip and fee rules. Zeffy also has a free donor CRM, but its checkout is not PayPal, so it is not the primary recommendation for this PayPal-only scenario. Changing processors may require donors to authorize recurring gifts again. Keep access to historical receipts and avoid a migration just to obtain a free feature.
Sources: Givebutter: Givebutter pricing (external) ↗ · Zeffy: Zeffy donor management (external) ↗
What information goes where?
Donor names, email addresses, amounts and membership status can identify personal interests or affiliations. Keep donor reports private, and never publish a donor name without appropriate permission.
On your public site
Descriptions, prices, public images, policies and direct provider links. No customer checkout form is required.
In private services
Necessary payment, customer or client records. Protect provider logins and any copies on your devices.
Link out before asking for payment information. Avoid hidden fields, query strings or analytics events containing customer details. A hosted checkout reduces collection on your server; it does not mean that the provider, your logs or your private business records contain no personal information.
See the data-flow and PCI explanationDo you need to pay the host for security?
For public lessons with external PayPal links, included HTTPS and a tested restore process are usually a sensible starting point. A membership area with private records increases the maintenance burden; consider a managed platform before buying add-ons for a weak shared-hosting setup. Required payment compliance services are separate from an optional host bundle.
The baseline still includes working HTTPS, protected accounts, a clean backup and someone responsible for changes. An included scanner is useful, but a scanner is not a patch, a restore test or an incident-response service.
Use the hosting spending guideKEEP THE TOOLBOX SMALL
Start at $0. Know the limits.
A donor CRM becomes useful when acknowledgments and renewals are difficult to track. These three $0 options can retain direct PayPal as the payment route using a deliberate manual record/import process. Givebutter is nonprofit-specific; the other two are small general CRMs.
Givebutter
Standard CRM
Unlimited contacts
Donor histories and acknowledgments.
Direct PayPal gifts need reconciliation/import. Its own checkout and optional Plus features have separate fee terms.
Check plan & pricingHubSpot
Free CRM
2 users · 1,000 contacts
A modest customer or donor relationship list.
Paid marketing and advanced automation have separate limits. Do not use this free tier for clinical records.
Check plan & pricingBigin by Zoho
Free
1 user · 500 total records
Repeat buyers, requests and a simple follow-up pipeline.
Records include notes and activities. Express is $7/user/month billed annually ($84/year). Not inventory management.
Check plan & pricingPrices checked September 25, 2026, USD before taxes. Free plans are not free payment processing. These are the three cheapest suitable entry subscriptions in our reviewed shortlist, tied at $0—not an exhaustive ranking of every vendor. Verify features, region, limits and upgrade costs.
What are the odds of customer data being stolen?
A static learning site has lower local donor-data exposure when records stay elsewhere. A neglected membership database creates elevated avoidable exposure. Donation-link tampering and PayPal account takeover can cause financial harm without any database theft.
Ask your designer.
Is an up-to-date PayPal plugin safe on old WordPress?
No assurance follows from that combination. The plugin cannot repair the old core, other plugins, the theme or the hosting account. Patch the whole system or use clean static pages with hosted PayPal links.
Do memberships require a login on our website?
Only if there is an actual access-controlled service. Recurring payments and a private membership roster can operate without public-site accounts.
Does accepting charity payments mean we qualify for PayPal’s charity rate?
No. The rate is subject to eligibility and approval. Check the actual account and transaction classification.
Sources for this business
- PayPal US: Payment Links ↗
- PayPal US: Merchant fees in the United States ↗
- Givebutter: Givebutter pricing ↗
- HubSpot: HubSpot free tools ↗
- Bigin by Zoho: Bigin editions and pricing ↗
Shared technical evidence and research limitations appear in the source library.