Nonprofit Website Audit Checklist Before a Rebuild | Socialectric

Most nonprofit website rebuilds fail for the same reason: they begin too early. Before the organisation has diagnosed what is actually wrong. Before the stakeholder priorities have been mapped. Before the accessibility failures have been documented. Before anyone has asked what success looks like in twenty-four months rather than on launch day.

A structured audit changes this. It answers the question that should precede every rebuild decision: what is the website failing to do, for whom, and why?

This checklist covers what a thorough nonprofit website audit should assess. It is designed for Communications Directors, Executive Directors, and Board members who want to understand what the audit should cover and what findings should inform the decision to rebuild, remediate, or leave the site as it is.

Before you begin: clarify what you are auditing against

An audit produces findings. Findings require a standard to measure against. Before any audit begins, the organisation needs to answer: what should this website be doing, and for whom?

This is not as obvious as it sounds. Most nonprofit websites are built to serve a combination of funders, donors, beneficiaries, programme partners, the media, regulators, and the general public. These audiences have different needs, different levels of institutional significance, and different tolerances for a website that does not quite work.

A stakeholder priority exercise — ideally informed by the salience framework, which scores audiences on power, legitimacy, and urgency — produces a clear hierarchy. The top two or three stakeholders define what the website must do. Without this hierarchy, the audit produces a list of observations rather than a prioritised set of findings connected to institutional consequences.

Section 1: Governance and institutional credibility

The governance section of the audit assesses whether the website meets its obligations to the most powerful and legitimate external audiences: institutional funders, regulators, and the Board.

Check that the charity registration number is visible on the website, ideally in the footer of every page. Check that the registered address is present and accurate. Check that named trustees or Board members are listed and current. According to Charity Commission guidance, registered charities must make this information publicly available. A website that does not display it is in breach of regulatory expectations.

Check whether the current annual report is accessible from the website within two to three clicks from the homepage. The current year's report, not last year's. The Charity Finance Group has consistently found in its sector research that funders rate annual report accessibility as a significant factor in initial grant assessment. Check whether audited accounts or a financial summary are accessible alongside it.

Check whether a safeguarding policy is published. For organisations working with children or vulnerable adults, the absence of a visible safeguarding policy is a significant credibility failure under Charity Commission guidance and an immediate concern for institutional funders. Check whether a GDPR-compliant privacy policy is current and linked from every data collection point.

Score each item: present and current, present but outdated, or absent.

Section 2: Accessibility (WCAG AA)

WCAG AA compliance is a legal obligation for many established nonprofits, and it is one of the most commonly failed standards across the sector. The WebAIM Million 2025 report, which analyses the top one million websites, found that 95.9% have detectable WCAG failures. The most common failures — low contrast text, missing form labels, missing image alternative text — appear on over 80% of pages tested. They are almost always introduced through post-launch editorial activity rather than at the point of build.

Run an automated scan using axe DevTools, WAVE, or a similar browser extension across the homepage, a programme page, and the contact or donation page. Note all violations, not just critical ones.

Manually test keyboard navigation across the same pages. Can every interactive element — links, buttons, forms, navigation — be reached and activated using only the keyboard? Is the focus indicator visible at every step? Test the donation flow end-to-end using keyboard navigation only.

Check colour contrast across body text, headings, links, and button labels. The minimum ratio for normal text is 4.5:1. Note any failures, particularly in branded colours that may have been assumed to be compliant without testing. For guidance on resolving these, the colour accessibility and brand governance post covers the specific approach.

Check heading hierarchy on each page. Every page should have exactly one H1. Headings should follow a logical H1 to H2 to H3 sequence without skipping levels. Record the Lighthouse accessibility score for the homepage, a programme page, and the donation or contact page.

Section 3: Content currency and accuracy

The content audit assesses whether what is on the website is accurate, current, and serving the right stakeholders.

Start with the homepage. Does it clearly communicate what the organisation does, who it serves, and what it is asking the visitor to do? Is the content current — no references to past campaigns as if they are ongoing, no out-of-date statistics or impact data? According to the M+R Benchmarks report, more than half of all nonprofit website traffic arrives on mobile devices, with the proportion higher still for social media-driven traffic. The homepage must work on a phone screen, not just on the desktop where it was designed.

Check programme and service pages. Are all active programmes represented accurately? Have any programmes ended without their pages being updated or removed? Check the news or blog section. When was the last post published? If the most recent post is more than six months old, the section communicates an organisation that is not maintaining its website — a credibility concern for funders conducting due diligence.

Note any content that makes specific numerical claims — impact statistics, beneficiary numbers, financial figures — and check whether those figures are dated and sourced. Undated, unsourced statistics are a credibility risk with institutional funders and journalists. This is directly connected to how funders assess website credibility during grant assessment.

Section 4: Stakeholder journeys

The stakeholder journey assessment maps how the primary audiences identified in the initial priority exercise actually experience the current site.

For each primary stakeholder group, follow the path they would take on the website and answer: can they find what they need? Can they complete what they came to do? Where do they hit friction, dead ends, or missing information?

For institutional funders, the typical journey involves understanding the organisation's mission, assessing the evidence of impact and governance, locating financial information and governance documents, and identifying how to make contact for a grant conversation. Walk through this journey and note every point of friction. The grant reviewers checklist post covers in detail what programme officers look for at each stage.

For individual donors, the journey typically involves understanding what their gift will support, finding evidence of the organisation's credibility and impact, and completing a donation. Test the donation flow end-to-end. Does it complete? Is the confirmation page a meaningful acknowledgement or a bare transaction confirmation?

Note the number of clicks required to reach the most important destination for each stakeholder. For primary stakeholders, no critical information or action should be more than two to three clicks from the homepage.

Section 5: Technical infrastructure

The technical section covers the foundational infrastructure that supports everything above.

Verify that SSL is active and valid. Run a Google PageSpeed Insights test on the homepage, a programme page, and the donation or contact page. Note the Largest Contentful Paint, Cumulative Layout Shift, and Interaction to Next Paint scores. A score below 70 on mobile for any of these pages is a priority concern for a site that serves a predominantly mobile audience.

Check for broken links. A crawl tool such as Screaming Frog's free tier, which covers up to 500 URLs, will identify 404 errors across the site. Broken internal links create dead ends for users and waste crawl budget that affects search engine visibility.

Check metadata. Does every page have a unique title tag? Is each title tag under 60 characters? Does every page have a meta description? Verify that a robots.txt and sitemap.xml are present and correct. Check that the sitemap has been submitted to Google Search Console and that there are no indexing errors in the coverage report.

Using the audit findings

The audit produces findings across five areas. Not all findings are equal. Some are urgent governance failures — absent annual reports, inaccessible donation flows, broken trustee pages — that need addressing regardless of platform or rebuild decision. Others inform the decision about what to fix and whether to rebuild.

A finding is not useful unless it is connected to a consequence. A missing alt text finding is useful when it is connected to the consequence: screen reader users cannot understand this image, which is a WCAG failure and a legal risk under the Equality Act 2010. An outdated programme page is useful when it is connected to the consequence: a funder reading this page will find information that is no longer accurate, which affects their confidence in the organisation.

The audit also informs platform decisions. If the primary cause of accessibility failures is that the CMS gives editors too much unguarded freedom, that is an architecture problem. If governance documents are consistently hard to find because the information architecture has no logical place for them, that is a structural problem. Both point toward a rebuild. If the failures are editorial — content is not being updated because nobody is responsible — a rebuild solves nothing. The rebuild versus remediate framework covers how to make this decision with governance evidence.

Frequently Asked Questions