WordPress
WordPress: security and supported releases
Official security model; keeping software maintained matters.
Reviewed September 25, 2026Home / Field guide
SHOW YOUR WORK
Good advice should come with a paper trail.
Primary sources, real plan pages and clearly stated limits. Research reviewed September 25, 2026; provider terms and prices can change.
How this guide was researched
We prioritize official security guidance, standards bodies, regulators and vendors’ own documentation. Prices reflect the published US-oriented entry plans, not a negotiated quote. Architecture recommendations are our synthesis of the data flows and maintenance needs in each scenario.
What this guide does not claim
No provider was penetration-tested. Advertised features are not independent certifications. “Cheapest” means a suitable starting subscription in the reviewed shortlist. Breach-report statistics are not converted into unsupported predictions for your customers.
37 sources shown · External links need internet access.
WordPress
Hardening WordPress
Updates, access controls, backups and defense in depth.
Reviewed September 25, 2026React
React Server Components security advisory
The December 2025 server-component vulnerability did not affect client-only React. This is an architecture example, not a current patch-version guide.
Reviewed September 25, 2026OWASP Top 10:2025
Software Supply Chain Failures
Dependency, build and distribution risks require ongoing management.
Reviewed September 25, 2026FTC
Protecting Personal Information: A Guide for Business
Inventory, minimize and protect retained personal information.
Reviewed September 25, 2026Verizon
2026 Data Breach Investigations Report findings
31% of analyzed breaches began with vulnerability exploitation; this is not a probability that a particular website will be breached.
Reviewed September 25, 2026PCI Security Standards Council
FAQ 1604: outsourced payments and ASV scans
SAQ A external scanning requirements can apply even to redirect or embedded checkout websites; June 2026 clarification.
Reviewed September 25, 2026PCI Security Standards Council
FAQ 1588: SAQ A script eligibility
Distinguishes embedded payment forms from redirects for one specific script-related eligibility criterion.
Reviewed September 25, 2026Hawk Host
Budget shared-hosting reference
Research baseline only, not an endorsement. Starter annual offer: $31.30 initially; advertised renewal equivalent $5.22/month. Includes SSL and daily offsite backups; promotional terms can change.
Reviewed September 25, 2026itch.io
Accepting Payments and Getting Paid
Direct payments and the collected-by-itch.io payout model have different responsibilities.
Reviewed September 25, 2026itch.io
Creator FAQ
Marketplace and creator revenue-share model.
Reviewed September 25, 2026Steamworks
Steam Direct fee
$100 per product; recoupable after $1,000 adjusted gross revenue. Taxes can apply.
Reviewed September 25, 2026Buy Me a Coffee
Buy Me a Coffee: frequently asked questions
5% platform transaction fee; check additional payment-processing costs.
Reviewed September 25, 2026eBay
Selling fine jewelry
Resale listings, accurate item descriptions and conditional authentication eligibility.
Reviewed September 25, 2026Etsy
Etsy Creativity Standards
Generic resale is not automatically eligible; qualifying vintage items must be at least 20 years old.
Reviewed September 25, 2026Etsy
Fees & Payments Policy
$0.20 listing fee and 6.5% transaction fee; processing and other applicable charges are additional.
Reviewed September 25, 2026Stripe
Payment Links
Provider-hosted payment pages; processing, optional features and regional prices vary.
Reviewed September 25, 2026PayPal US
Payment Links
Payment links can be shared without operating a checkout on your own website.
Reviewed September 25, 2026PayPal US
Merchant fees in the United States
Confirmed eligible charity transactions: 1.99% plus $0.49 USD domestic; eligibility and payment type matter.
Reviewed September 25, 2026HHS
Covered Entities and Business Associates
HIPAA depends on covered-entity/business-associate status, not simply the title of a practice.
Reviewed September 25, 2026Zoom
HIPAA Business Associate Agreement
BAA availability and account setup; an ordinary video call is not proof of a compliant care workflow.
Reviewed September 25, 2026Bandcamp
What are Bandcamp’s fees?
Standard 15% digital revenue share; payment processing is additional. Eligibility can change the share.
Reviewed September 25, 2026Bandcamp
How do I get paid on Bandcamp?
Platform payment collection and seller payout process.
Reviewed September 25, 2026Amazon KDP
Linking from Your Website
Official direct-link pattern for a book’s detail page using its ASIN.
Reviewed September 25, 2026Printful
How much does Quick Stores cost?
No Quick Stores subscription charge; product, fulfillment and shipping costs still affect margins.
Reviewed September 25, 2026Printful
Is Quick Stores available in my area?
US-resident merchants with US tax residence and US shipping destinations only at review time.
Reviewed September 25, 2026Printify
What is Printify Pop-Up Store?
Hosted storefront does not remove the seller’s merchant-of-record responsibilities.
Reviewed September 25, 2026Kit
Kit pricing
Free newsletter plan supports up to 10,000 subscribers; limited automation and plan conditions apply.
Reviewed September 25, 2026MailerLite
MailerLite pricing
Current Free tier: 250 subscribers, 2,500 emails/month; older free-tier limits are no longer a safe assumption.
Reviewed September 25, 2026Brevo
About Brevo pricing plans
Free: 300 emails/day, up to 100,000 contacts, one seat; paid Starter from $9/month.
Reviewed September 25, 2026HubSpot
HubSpot free tools
Free CRM: up to two users and 1,000 contacts. Paid marketing limits and costs differ.
Reviewed September 25, 2026Bigin by Zoho
Bigin editions and pricing
Free: one user, 500 total records; Express $7/user/month billed annually. Records include activities and notes, not just contacts.
Reviewed September 25, 2026Sessions Health
Sessions Health pricing
Free up to three active clients; Professional $39/month for the first practitioner. Native video costs extra; an external video solution can be used.
Reviewed September 25, 2026Practice Better
Practice Better plans
Sprout is free for three clients. Starter for ten clients: $35/month monthly or $25/month with annual billing; feature limits apply.
Reviewed September 25, 2026Carepatron
Carepatron pricing
Free tier: unlimited clients, 1 GB storage; pricing table lists a 100-appointment limit. Verify the limit period, BAA and workflow fit before onboarding clients.
Reviewed September 25, 2026Givebutter
Givebutter pricing
Standard CRM is free with unlimited contacts. Donations and optional Plus features have separate terms; direct PayPal records need deliberate reconciliation.
Reviewed September 25, 2026Zeffy
Zeffy donor management
Free donor CRM and imports. Its own checkout is not a PayPal checkout; do not assume it satisfies a PayPal-only payment requirement.
Reviewed September 25, 2026