Web TeamMost nonprofits run lean. The website gets built by a volunteer or a board member’s nephew, and then nobody touches it for years. Meanwhile it’s where donors go to check you out and give.
Here’s a practical checklist for nonprofit websites. It’s meant for busy staff, not tech people.
Donations
Your donate button is the most important button on your site. Treat it that way.
Make giving easy
- A “Donate” button is in the top menu on every page
- The donation page loads fast on a phone
- A gift takes as few steps as possible
- Donors can give monthly, not just once
- Suggested amounts are shown, with a line on what each one does
- Apple Pay, Google Pay, or PayPal is offered if your platform supports it
Make it trustworthy
- The page is on https with the padlock showing
- Your organization’s legal name and EIN are easy to find
- A thank you email goes out right away with a receipt
- Someone tests a small donation every month
That last one matters. Payment settings break. API keys expire. Cards on file change. If nobody tests, you can lose donations for weeks without knowing.
Forms
Volunteer signups, event registrations, and contact forms all need to reach a real person.
- Every form sends to a shared inbox, not one staff member’s personal email
- Form emails don’t land in spam (test it)
- Forms have spam protection
- You only ask for the info you actually need
- Form entries are saved on the site too, in case an email gets lost
If staff turns over a lot, the shared inbox piece saves a lot of headaches.
Security on a small budget
Nonprofits get hacked too. Bots don’t check your tax status. The good news is the basics are cheap or free.
Keep things updated
Most WordPress security holes are in plugins. Patchstack found that 91% of new WordPress security holes reported in 2025 were in plugins. Keeping plugins updated, and removing ones you don’t use, covers a lot of ground.
Lock down logins
- Every staff member and volunteer has their own login
- Nobody has admin access unless they need it
- Two-factor login is on for admin accounts
- Logins are removed the day someone leaves
Volunteers come and go. Old logins pile up. Review your user list every few months.
Check your server software
Ask your host what PHP version your site runs on. As of October 2026, PHP 8.1 and older no longer get security fixes, and PHP 8.2 stops getting them on December 31, 2026.
Back it up
- Daily backups run on their own
- Backups are stored off the web server
- Someone has tested a restore
Ownership
This one is big for nonprofits. The site was often set up by someone who isn’t around anymore.
- The domain is registered to the organization, with an org email address
- The domain auto-renews on an org card
- Hosting is in the organization’s name
- At least two people on staff or the board can log in to everything
- Logins are kept in a shared password manager
Accessibility
Your community includes people with disabilities. Your site should work for them. The common standard is WCAG. The basics are simple:
- Images have short text descriptions
- Text is easy to read against the background
- The site works using only a keyboard
- Videos have captions
- PDFs like annual reports are also available as a web page when you can
If you get government grants or work closely with state or local agencies, ask them what accessibility rules apply to you. As of October 2026, the US Department of Justice requires state and local governments to meet WCAG 2.1 AA starting in April 2027 or 2028, depending on their size.
Tell your story
A quick one. Donors want to see impact. Keep your homepage current with real numbers, real photos, and recent news. An events page showing last year’s gala doesn’t help.
Doing this on a budget
You don’t need a big redesign. Most of this list is about keeping what you have healthy. That’s where a monthly plan helps. At Altitude, nonprofits get 45% off every plan, so our Starter plan works out to about $82 a month.
Want to see how your site stacks up? Book a free 30-minute website audit. We’ll walk through this checklist with you on a call.
