Nonprofit website maintenance works best as a fixed rhythm rather than a reaction to problems: a short weekly pass (confirm the backup ran, apply updates, click through the key pages), a monthly pass (test every form end to end, check speed on a phone, review new content for accessibility, review security), a quarterly pass (content accuracy, user and plugin cleanup, analytics) and a once-a-year inventory of renewals, licenses and ownership. On a typical WordPress site the routine takes about an hour a week, and most of it can be done by a non-technical staff member with a checklist and a calendar reminder.
This is the routine our Customer Success team runs on the nonprofit WordPress sites we look after, written down so you can print it or paste it into a shared document. Our earlier posts cover what website maintenance costs and the five mistakes we see most often; this one is the operational list.
What does nonprofit website maintenance include?
A WordPress site has four moving parts: core (the software itself), plugins (add-ons for forms, donation processing, SEO settings, caching and so on), the theme (the design) and PHP (the server-side language WordPress runs on, whose version your host controls). Around them sit content, users, backups, the domain, hosting and the SSL certificate (what makes the address start with https). Maintenance is the habit of checking all of it on a schedule, so a broken donation form turns up in a routine pass rather than on December 1. Our guide to WordPress for nonprofits covers why most sites we support run on it, and the rhythm below applies to other platforms too; only the update steps differ.
What should you check every week?
Confirm the backup actually ran. Open your backup tool, check that the latest backup is dated within 24 hours, and glance at its size: a sudden drop from last week’s usually means the database or the uploads folder was skipped. Once a quarter, restore a backup to a staging copy of the site; a backup that has never been restored is an assumption, not a backup. Our backup guidelines cover retention and where copies should live.
Apply updates, in the right order. WordPress.org documentation states that since WordPress 5.6, new installations have automatic updates on for minor and major core releases by default, while plugins and themes only update automatically in special cases unless you turn that on per plugin. Our weekly order: backup, plugins, then the theme, then load the homepage, the donation page and one form page to make sure nothing visibly broke. The same documentation recommends backing up before updating, which is why the backup check comes first.
Click through the key pages. Homepage, donate page, contact page, your busiest program page and the latest post, on desktop and on a phone. You are looking for missing images, shifted layouts, a donate button that no longer stands out, a popup that cannot be closed on mobile, or a form that fails to render. This takes about five minutes and catches most update side effects.
Read Site Health. WordPress has a built-in diagnostic under Tools, then Site Health, which groups findings into critical issues, recommended improvements and passed tests. Anything new in the critical list should get a ticket that week rather than waiting for the quarterly review.
What should you check every month?
Test every form end to end. Submit a real test through the donation form, the contact form, the newsletter signup and any volunteer or event forms. End to end means four outcomes: the confirmation page appears, the receipt email arrives, the record reaches your CRM or email tool, and the internal notification lands in an inbox someone reads. That last one is where forms fail silently, often because the notification still goes to a staff member who has left.
Check speed on a phone. Run the homepage and donation page through Google’s PageSpeed Insights and note the mobile numbers. Google’s thresholds for good Core Web Vitals are a Largest Contentful Paint (time until the main content appears) of 2.5 seconds or less, an Interaction to Next Paint (response time to a tap) of 200 milliseconds or less, and a Cumulative Layout Shift (how much the layout jumps) of 0.1 or less, measured at the 75th percentile of visits. A slide usually traces to a new plugin, an oversized image in a recent post or a third-party embed.
Review new content for accessibility drift. Every new post or page is a chance to skip alt text or drop a heading level. The WebAIM Million 2026 report (top one million home pages, scanned February 2026) found low-contrast text on 83.9% of pages, missing image alt text on 53.1% and missing form input labels on 51%: the same errors that creep in through routine publishing. For each new page, check alt text (meaningful, or marked decorative), heading order, link text that says where the link goes, contrast on new colored sections, and an HTML alternative for new PDFs. Our default standard is WCAG 2.2 AA (Web Content Accessibility Guidelines, level AA), and this monthly pass is what keeps a site there.
Do a short security review. Remove or downgrade users who have left and look for administrator accounts you do not recognize. Confirm the SSL certificate is valid and not expiring soon (the browser padlock shows the date). Check each plugin’s WordPress.org page for when it was last updated; in our experience, outdated or abandoned plugins are the usual way a nonprofit site gets compromised, and replacing them early is the fix.
What should you check every quarter?
Content accuracy pass. Staff and board pages, program descriptions, event dates, impact numbers, the footer copyright year, phone numbers and addresses. Search the site for the previous year (for example, “2026” in January 2027) to find pages that quietly went stale, and retire or redirect pages for programs that no longer run.
User and plugin cleanup. Delete inactive plugins and themes rather than leaving them installed; the Site Health screen lists both, and WordPress documentation recommends removing themes you are not using. Reduce administrator accounts to the people who genuinely need full control and give everyone else the Editor or Author role.
Analytics and search review. In Google Analytics 4, confirm donation and form conversions are still recording; a thank-you page change often breaks tracking unnoticed. In Google Search Console, check the page indexing report for new 404 errors (pages that no longer exist) and set redirects. Run a broken-link checker across the site.
What are the once-a-year items?
Renewals. Domain name, hosting, SSL certificate if it is not automatic, premium plugin and theme licenses, the donation or form platform subscription and the email sending service. For each, write down the vendor, renewal date, account owner and which card pays. The failure we see most often is a domain registered to a former employee’s personal email with an expired card. Turn on auto-renew and make the billing email a shared organizational address.
Ownership inventory. Confirm that the organization, not an agency, volunteer or former staff member, holds the registrar account, the hosting account, the WordPress administrator login, the analytics property and the payment processor, and that at least two current staff can access each. Our website ownership guide has the full list and a template.
PHP version. Site Health flags an outdated PHP version as a security issue. According to php.net’s supported versions page as of September 2026, PHP 8.2 receives security fixes only until December 31, 2026, PHP 8.3 until December 31, 2027, PHP 8.4 until December 31, 2028 and PHP 8.5 until December 31, 2029. If your host still has you on 8.2, schedule the move for early 2027 and test it on a staging copy first.
Annual reviews. A full accessibility review of the whole site, a full performance review, a re-read of the privacy policy against what the site actually collects, and a check that the theme and core plugins are still supported by their developers.
The printable nonprofit website maintenance checklist
| Frequency | Task | Done means |
|---|---|---|
| Weekly | Verify backup completed | Latest backup within 24 hours, normal size |
| Weekly | Update plugins and theme | Backup first; Updates screen clear |
| Weekly | Click through key pages | Home, donate, contact, top program page, latest post |
| Weekly | Review Site Health | No unaddressed critical issues |
| Monthly | Test all forms end to end | Confirmation page, receipt, CRM record, internal notification |
| Monthly | Mobile speed check | Within Core Web Vitals thresholds |
| Monthly | Accessibility check on new content | Alt text, headings, link text, contrast, PDFs |
| Monthly | Security review | Users current, SSL valid, no abandoned plugins |
| Quarterly | Content accuracy pass | Stale dates, people, programs, numbers fixed |
| Quarterly | User and plugin cleanup | Inactive plugins and themes deleted; admins minimized |
| Quarterly | Analytics and search review | Conversions recording; 404s redirected; links fixed |
| Quarterly | Restore test | A backup restored to staging |
| Yearly | Renewals inventory | Every renewal listed with owner, date, payment method |
| Yearly | Ownership inventory | Organization holds every account; two staff on each |
| Yearly | PHP version review | PHP branch with security support through next year |
| Yearly | Full accessibility, performance, privacy review | Findings logged and scheduled |
Who should own the checklist?
One named person, a backup person and a log. The log can be a spreadsheet with the date, what was updated (plugin names and versions), what was tested and anything that looked odd. It matters the day a form stops working and you need to know whether it broke before or after a particular update.
Many organizations we work with run the weekly items in-house and hand the monthly and quarterly items to a support plan, because form testing, speed diagnosis and accessibility review go faster for someone who does them across many sites. The checklist is the same either way; what changes is who is accountable when a box stays empty. Our post on maintenance costs explains what drives the price of outside help.
Nonprofit Website Maintenance FAQs
How often should a nonprofit website be maintained?
Weekly for backups, updates and a click-through of key pages; monthly for form testing, mobile speed, accessibility of new content and a security review; quarterly for content accuracy, cleanup and analytics; and yearly for renewals, ownership and the PHP version. On a typical WordPress site that is roughly an hour a week plus a longer quarterly session.
Do WordPress automatic updates make manual maintenance unnecessary?
Not on their own. WordPress.org documentation says new installations since version 5.6 apply minor and major core releases automatically, but plugins and themes only auto-update in special cases unless you enable it per plugin, and plugins are where most conflicts and vulnerabilities live. Someone still needs to back up, update and check the site every week.
How do we know a backup actually works?
Check weekly that the latest backup completed and is a normal size, and once a quarter restore it to a staging copy. A restore test is the only way to prove the backup includes the database, uploads and theme, and that you know the steps before an emergency.
What is the right way to test a donation form?
Make a small real donation (or use the processor’s test mode) once a month and verify that the thank-you page loads, the receipt email arrives, the gift appears in your CRM and the internal notification reaches a monitored inbox. Refund the test gift and note it in your maintenance log.
Which PHP version should our nonprofit website run in 2027?
As of September 2026, php.net lists security support for PHP 8.2 ending December 31, 2026, PHP 8.3 ending December 31, 2027, PHP 8.4 ending December 31, 2028 and PHP 8.5 ending December 31, 2029. A site entering 2027 should be on at least 8.3, ideally 8.4, after testing plugin compatibility on a staging copy.
What happens if we skip maintenance for a few months?
Usually nothing visible at first. The typical results are a form that quietly stops delivering notifications, a slower site, an outdated plugin that becomes a security opening, and a backlog of updates that is riskier to apply all at once than one week at a time.
If you would rather have this rhythm run for you, our website support and maintenance service covers the weekly, monthly and quarterly items above for nonprofit WordPress sites. Elevation has worked only with nonprofits since 2007, and this is the checklist our own team follows.
