The Healthy Nonprofit Website: An Ownership Guide
A website you can’t log into, update, or recover isn’t really yours. Here’s what ownership actually requires, and the rhythm that keeps a site healthy.
The short answer
Nonprofit website ownership means your organization controls the domain, hosting, admin accounts, licenses, and analytics. It also means someone on staff can produce any of them within a day. A healthy site adds a maintenance rhythm on top: weekly backups and updates, monthly testing, and a quarterly review.
Ask who owns your website and most nonprofits point to a line in an old agency contract. But nonprofit website ownership isn’t really a legal question — it’s an operational one. The site is yours when your team can log in, change what needs changing, and recover from a bad day without waiting on anyone’s goodwill. By that test, plenty of organizations don’t own their websites at all. They rent them from whoever holds the passwords.
This guide is that test in checklist form: what you should control, the habits that keep a healthy nonprofit website healthy, and the honest line between what your team can carry and where outside support earns its keep.
The ownership inventory
Six things, and for each one the same question: who on your staff could produce it within a day?
If any of these comes back “we’d have to ask our old developer,” fix that before anything else on this page. Ownership you can’t exercise isn’t ownership.
The health checklist, by rhythm
A healthy site is rarely the product of heroics. It’s small habits on a schedule.
Weekly. Verify that backups actually completed. A backup nobody has checked is a hope, not a plan. Apply CMS and plugin updates, then click through the site’s most important pages to confirm nothing shifted.
Monthly. Load your key pages on a phone and notice what’s slow. Submit every form that matters, donation form included, and confirm the confirmation arrives. Check the month’s new content for accessibility drift: missing alt text, skipped heading levels, low-contrast text. WCAG 2.2 AA is the baseline worth holding, and drift is how sites quietly fall below it.
Quarterly. Read the site the way a stranger would: staff lists, program descriptions, event dates, board pages. Outdated content erodes trust faster than an outdated design. Then do a short security review: remove user accounts that no longer belong, delete plugins you stopped using, and confirm exactly who holds admin rights.
The staffing reality
A communications team can genuinely own most of this: content edits, publishing, images, form tweaks, and the weekly and monthly checks above. None of it requires code. It requires access, a checklist, and a calendar.
Some work does need a developer: untangling a plugin conflict after an update, changing templates or theme code, wiring up an integration, responding when the site goes down or gets compromised. There’s no shame in that list. It’s specialist work at organizations far larger than yours, too. The only real problem is when it has nobody’s name next to it.
Warning signs of an unhealthy site
These patterns show up again and again in the sites we inherit:
- Simple content changes wait weeks, because nobody feels safe touching the site.
- Everything lives in one person’s head (often a volunteer), and the plan for their departure is hoping they don’t.
- Passwords are unknown, or sitting in the inbox of someone who left two years ago.
- The domain or hosting is registered to a former agency, and emails about it go unanswered.
- No one can say when a backup was last tested, or whether one exists.
None of these fix themselves. Each one gets more expensive the longer it waits, because the fix eventually has to happen during an emergency instead of before one.
When to bring in support, and what good looks like
Bring in ongoing support when the checks keep slipping, when the person who “did the website” moves on, or when the list of things you’re afraid to touch keeps growing. That’s not failure; it’s the point where a partner costs less than the risk.
Good support has a shape you can ask for in writing: a named human who knows your site, not just a ticket queue. Response expectations stated plainly, so you know what happens when something breaks on a Friday. Proactive monitoring: uptime, updates, and backups watched before you notice a problem, not after. Reporting in plain language. And full ownership stays with you, so leaving would be easy. That last one is the tell: a partner confident in their work doesn’t need to hold your keys.
That’s the standard we hold ourselves to. We’ve worked only with nonprofits since 2007 — more than 1,000 organizations — and we host on Pressable with 99.999% uptime. But whoever you hire, the standard above is the standard.
Answers, up front.
Start with the domain: confirm who is listed as the registrant and request a transfer in writing. You have the right to your domain, your content, and your data, and most agencies cooperate once asked directly. If they stall, escalate politely and copy your leadership. A new partner can sequence the handover so the site never goes down.
Less than most teams fear, as long as it’s regular. A quick weekly check, one focused monthly session, and a quarterly review will carry most nonprofit sites. The expensive version is the opposite pattern: months of nothing, then a scramble after something breaks.
Usually not. A communications team can own content, publishing, and the routine checks. Developer needs tend to be occasional and unpredictable (a conflict after an update, an integration, a redesign), which is why most nonprofits pair a capable internal owner with a support partner rather than hiring.
It depends on a few drivers: how complex the site is, how many plugins and integrations it runs, how often content changes, and how quickly you need a response when something breaks. A simple brochure site and a site with member logins and event registration sit at very different points. Scope those honestly and the pricing conversation gets short.
Want a partner in the upkeep?
We keep nonprofit websites healthy every day: monitoring, updates, and a named human who knows your site. Book a call to talk through yours.