The website was built by a volunteer who was good at it and has since moved on to a new job and a new city. The trustees think it is “fine”. Then a donor emails to say the donate button gave an error, the treasurer cannot find who the domain is registered to, and the plugin that sends receipts has not been updated for longer than anyone can remember.
Nonprofit website maintenance has the same technical core as any other site, but it sits on top of different pressures: very little spare money, people who give their time rather than a contract, a board that changes every few years, and donors who are trusting you with their goodwill and, often, their card details. This article is for charity managers, trustees and small NGO leaders in North America, Britain, Australia and further afield who want the site to stay safe and useful without it becoming a full-time worry.
Start with the question nobody can answer
If a trustee asked you tomorrow, “who owns our website?”, could you answer in a minute? Three separate things need an owner, and in small organisations they are often registered in three different people’s names.
- The domain name (your web address). If it lapses, the site and every email address on it can stop working at once.
- The hosting account, where the website files and database actually live.
- The website’s own admin login, plus the accounts for the donation service, the email newsletter and the analytics tool.
All of them should belong to the organisation: an official email address, a named role holder and a second person who knows where the details are kept. We go into this more in who is responsible for website maintenance. Write the answers on a single page and store it where the next treasurer will look. A good test is to ask whether the organisation could keep going if the current volunteer vanished tomorrow. In far too many cases, it could not.
Nonprofit website maintenance: what routine upkeep covers
Under the surface, a WordPress site needs steady technical care: updates to the core software, the theme and every plugin; a backup kept away from the web server; security scans; and an alert if the site goes offline. Volunteers often do this when they remember and skip it when they do not, which is understandable but is exactly how sites get hacked. If you want to see what a paid arrangement typically spells out, the page on website maintenance in India lists the monthly work a team in India covers for clients abroad, and it makes a clear checklist to measure any proposal against, whether it comes from us or anyone else.
What upkeep is not: new features, a redesign, a fundraising campaign or writing your copy. Those are separate jobs and should be quoted separately. Keeping the two apart stops a maintenance arrangement from slowly turning into unpaid design work, and it helps a board see what it is paying for.
The donation path is the one thing you must test
If the site collects gifts, the route from “Donate” to “Thank you” is the most valuable thing on it. Check it end to end, regularly, as a donor would, on a phone and on a computer.
- Button and link. Do all the “Donate” buttons on the home page, in the menu and on campaign pages lead to the current donation page?
- The form or service. Most small organisations use a hosted donation service or a payment provider, so card details are entered on the provider’s pages and not stored in your site’s database. Confirm which applies to you, because it changes how much risk sits on your own website.
- Test gifts. Make a small real or test donation where the provider allows, and follow it to the end. Did the thank-you page appear? Did the receipt email arrive, and in the inbox rather than spam?
- Reporting. Does the donation show up where your finance person expects it?
- Recurring gifts. If you offer monthly giving, check that the option still works after any plugin update and that the wording about cancelling is clear.
Receipts and acknowledgments often have rules attached, depending on where you are registered and what you promise donors. That one is for your own adviser to answer. What a maintainer can do is confirm that the technical chain (form, payment, email) is intact and that nobody has changed it without telling you.
Volunteers, staff and the handover problem
Nonprofits lean on goodwill, and that works until the person with the passwords is unavailable. A few habits make a huge difference:
- Give each person their own login. Shared accounts mean nobody knows who changed what.
- Give the lowest level of access that lets someone do their job. A volunteer posting event news does not need the ability to install plugins or delete the site.
- Review the user list twice a year and remove people who have left. This is a security job as much as a tidy-up.
- Keep a short “how we do things” document: how to add an event, publish a news item, resize a photo, update the board list.
- Name a deputy for every task.
It helps to separate two kinds of work, because they need different people. Content (news, events, photos, volunteer stories) belongs to the staff and volunteers who know the organisation. Machinery (updates, backups, security, fixes) can be handled by a paid or specialist helper so that it does not depend on goodwill. That split lets volunteers do what they enjoy and keeps the risky parts under dependable care.
Content a visitor or funder will check
Charities and NGOs get checked more than most small organisations. Journalists, funders, partners and cautious donors look at the site to decide whether you are who you say you are. A few pages carry more weight than they appear to:
- About and governance. Current trustees or board members, and a registration or charity number if one applies in your country. Remove people who have stepped down.
- Annual report and accounts. The latest version, easy to find, with older ones archived rather than deleted.
- Contact details. A real address and a real person or role, not an old inbox.
- Policies. Privacy policy, safeguarding statement, complaints procedure, as relevant to your work and place. Whether you need them is not for a web team to say, but whether they are current and linked is a website task.
- Programme and impact pages. Describe what you did, not what you hope to have done. Keep claims you can support and dates visible.
An out-of-date “upcoming event” from two years ago is a common and quietly damaging item. Put a recurring reminder to clear past events. Event pages that expire on their own date are better still, if your setup allows it.
Campaign peaks and giving days
Charities do not get steady traffic. They get a spike when a campaign launches, a news story breaks, a giving day arrives or a newsletter lands. A site that copes on an ordinary Tuesday may struggle then.
Two weeks before a known peak, ask your maintainer or host to check four things: that the site is fully updated and backed up, that pages are not heavy with large images, that the donation journey works on a phone, and that someone will be watching on the day. Avoid changing plugins or themes in the days around the peak. If you can, freeze changes until it is over. Put the dates of known peaks in the same calendar as renewals and board meetings.
Working with a small budget
Most nonprofits cannot buy everything at once, so charity website maintenance has to be ranked by what hurts most if it fails:
- Domain, hosting and backups in the organisation’s name.
- The donation and contact paths working and tested.
- Updates and security checks applied regularly.
- Uptime watching, so you hear about an outage from a monitor and not a donor.
- Speed, accessibility and design improvements.
Items 1 to 4 are what a maintenance arrangement is for. Item 5 is worth doing, but later. If you are weighing offers, read our note on what goes into a maintenance quote, which explains why two quotes for the same site can differ. A written quote that names what is included and what is extra will serve a board far better than a vague promise.
New organisations face a similar squeeze, and the thinking in startup website maintenance carries over: pay for the parts that protect you first, and leave the extras until the money exists.
If part of the work is done overseas
An overseas team can suit a nonprofit, because the technical work is routine and does not need to sit in the same building as the people who know your cause. What matters is clarity. Agree in writing who holds the logins, how you reach the team, how they will report, and what happens to donor and supporter data held on the site. If you have supporters in several countries, ask the team and your adviser how that data should be handled, because the rules vary. Keep a recent backup somewhere you control; a spare copy outside your host is part of what the 3-2-1 backup rule describes.
A one-page check for the next board meeting
- Domain, hosting and key accounts are in the organisation’s name; two people know where the details are.
- A test donation worked this month; the receipt arrived.
- Updates and a backup were done this month, and the report says so in words we understand.
- Every person with a login still needs one.
- Board list, report and contact details are current.
- Past events cleared; the next peak date is in the diary.
None of this is complicated, and good nonprofit website maintenance mostly asks for attention rather than heroics. If you would like a plain, unhurried look at where your own site stands, start with a free review of your site and take the findings to your next meeting.
