How to Create a Nonprofit Website Maintenance Schedule: Weekly, Monthly, Quarterly, and Annual Tasks
Key takeaways
- A website without a documented maintenance schedule deteriorates and undermines funder due-diligence credibility.
- Weekly, check the donation flow loads, scan analytics for 404s or traffic drops, and read the uptime alerts.
- Monthly, make a test donation, review your top five pages, run an accessibility scan, and check the certificate expiry date.
- Quarterly, audit all programme pages, deep-scan accessibility, sweep for broken links, and restore a backup to prove it works.
- Annually, publish the new annual report, run a full WCAG 2.2 AA audit, and review credentials and governance.
- Assign each task to a role rather than a named individual so responsibilities transfer when people leave.
Summary
A practical maintenance schedule for nonprofit websites: what to check weekly, monthly, quarterly, and annually to keep the site accurate, accessible, secure, and credible.
A website without a maintenance schedule deteriorates. Content goes stale. Accessibility compliance drifts. Donation forms break without anyone noticing. Annual reports expire. And when a funder visits during due diligence, they see an organisation that does not maintain its most public-facing asset.
This checklist is the task-by-task companion to the governance framework. For why a maintenance schedule is a governance question, not a technical chore, start there.
Where there is no documented maintenance schedule, updates happen reactively, when someone notices a problem or a colleague requests a change. This is not maintenance. It is crisis management masquerading as governance.
Here is the maintenance schedule I work to. The cadences are my practice rather than a regulatory requirement, and they keep the site credible without consuming disproportionate time.
Weekly
Check the donation flow. Visit your donation page on mobile, click through the donation process to the payment step (you do not need to complete a payment every week, but confirm the form loads and the button works). If the donation flow is broken, you are losing money every day it remains unfixed.
Check for broken pages. Glance at your analytics for any pages returning 404 errors or pages with sudden traffic drops. These indicate broken links or accidentally unpublished content.
Read the week's uptime alerts. The monitor runs without you, so the weekly job is to see what it caught. UptimeRobot's free tier covers 50 monitors on a five-minute check. Watch the donation page as its own monitor: a homepage monitor will not tell you the donation page is down.
Monthly
Complete the donation flow test. Once a month, make a test donation (many platforms allow test mode or very small amounts). Confirm the confirmation email arrives, the thank-you page or message displays, and the donation appears in your platform dashboard.
Review the top five pages for accuracy. Homepage, About, top programme page, governance/annual report page, and contact page. Is everything current? Are there staff members listed who have left? Programme descriptions that no longer match delivery?
Run an accessibility scan. axe DevTools on your homepage. Note the violation count. Compare to last month. If it is increasing, something is being published without accessibility consideration.
Check analytics for anomalies. Open GA4. Review acquisition overview, top pages, and key events. Look for sudden changes: traffic drops, key events that have stopped firing, or unusual referral sources.
Check the SSL certificate expiry date. Click the padlock in the address bar and read the certificate's valid-to date. Let's Encrypt's default certificates run for 90 days, with renewal recommended at 60, so a monthly check cannot miss the 30-day margin. It matters more than it used to: Let's Encrypt ended its expiration notification emails on 4 June 2025, so if the renewal automation quietly stops, nothing tells you until the browser does. Red Sift Certificates Lite, the alternative Let's Encrypt names, watches up to 250 certificates free.
Process the content request queue. If you maintain a queue of internal content requests (and you should: see The One-Person Comms Team), work through the highest-priority items.
Quarterly
Content accuracy audit. Review all programme pages, not just the top five. Check that every programme currently listed is still active and accurately described. Archive or update pages for discontinued programmes.
Accessibility deep scan. Run axe DevTools on five to ten pages across different templates (homepage, programme page, blog post, donation page, governance page). Compare the aggregate results to the previous quarter.
Search performance review. In Google Search Console, review impressions, clicks, and average position for the quarter. Note any significant changes. Identify queries where the site appears on page two. Those are your striking distance opportunities.
CMS housekeeping. Review draft items that were never published. Archive outdated content. Check that all CMS fields are being used consistently (e.g. meta descriptions filled in, categories assigned).
Restore a backup. An unverified backup is not a backup. NCSC's guidance is that once you have made a backup you need to know how to restore it and to check that it contains all your important data. Restore the latest one into a staging or local copy, open it, confirm the content and the database are both current, and record the date you did it.
Broken link sweep. The weekly analytics glance only catches pages people visit. A crawl catches the rest: Screaming Frog's free SEO Spider covers 500 URLs at no cost, which is enough for most charity sites, and Search Console's page indexing report lists anything returning "Not found (404)". Redirect what moved, fix what broke.
Integration check. Confirm all third-party integrations are working: donation platform, email sign-up, analytics, cookie consent, any CRM connections. Test each one.
Annually
Annual report update. As soon as the new annual report is approved by the Board, publish it on the website and archive the previous year’s version. This is the single most important annual content update for funder credibility.
Governance documents review. Check that all governance documents are current: privacy policy, accessibility statement, safeguarding policy (if applicable), trustee listing, financial accounts. Update review dates on each document.
Full accessibility audit. Conduct a comprehensive WCAG 2.2 Level AA audit including manual keyboard testing and screen reader testing. See what conformance asks of a Webflow build.
Performance audit. Run PageSpeed Insights on the homepage and three key pages. Compare to the previous year’s baseline. Address any significant performance regressions, and see what to measure and how often.
Credential and access review. Audit all platform credentials. Remove access for anyone who has left the organisation. Confirm the credential register is current. See how to set up CMS editor access, and what the Board needs to know about website security.
Governance policy review. Review and update the website governance policy itself. See what a website governance policy should include.
Board reporting. Prepare an annual website governance report for the Board summarising the year’s key metrics, compliance status, and recommendations for the coming year. See the analytics that actually matter for Board reporting.
Who Is Responsible
The maintenance schedule should assign each task to a specific role, not a named individual. When people leave, the role’s responsibilities transfer. Document this in your website governance policy.
For most nonprofits with a single Communications Director, weekly and monthly tasks sit with them. Quarterly and annual tasks may benefit from specialist support through the Monthly Partnership, which includes proactive site maintenance and accessibility monitoring as part of the subscription.
Two clicks. Three things.
Send the address of your website. Within two working days you get a short email naming the three things a funder would hold against it, including what AI assistants like ChatGPT and Google’s AI Overviews currently say about you. No report, no call, no follow-up unless you ask.
Received. Your three things arrive within two working days.
That did not send. Email hello@socialectric.com with your website address and I will reply from there.
Frequently asked questions
- How often should a nonprofit website be maintained?
On four cadences, weekly, monthly, quarterly and annually, and these are my practice rather than a regulatory requirement. Updating reactively, when someone notices a problem or a colleague asks for a change, is not maintenance. It is crisis management.
- What should be checked weekly?
Three things. Visit the donation page on mobile and click through to the payment step to confirm the form loads and the button works. A broken donation flow loses money every day it goes unfixed. Then glance at analytics for pages returning 404 errors or sudden traffic drops, which usually mean broken links or content accidentally unpublished. Then read whatever your uptime monitor sent you that week, with the donation page monitored separately from the homepage.
- What belongs in the monthly check?
A completed test donation, confirming the email arrives, the thank-you message displays and the donation reaches the platform dashboard. An accuracy review of the homepage, About, top programme page, governance page and contact page. An axe DevTools scan compared against last month's violation count. A GA4 check for anomalies. A look at the TLS certificate's expiry date, which matters more now that Let's Encrypt has stopped sending expiry emails. And working through the content request queue.
- What are the quarterly tasks?
A content accuracy audit across all programme pages rather than just the top five, an accessibility deep scan over five to ten pages spanning different templates, a Search Console review of impressions, clicks and average position, CMS housekeeping for unpublished drafts and unused fields, a crawl for broken links, a restore of the latest backup into a staging copy to prove it actually restores, and a test of every third-party integration.
- What are the annual tasks?
Publishing the new annual report as soon as the Board approves it and archiving the previous version, which is the single most important annual update for funder credibility. Then a governance documents review, a full WCAG 2.2 AA audit including manual keyboard and screen reader testing, a performance audit against last year's baseline, a credential and access review, a review of the governance policy itself, and an annual website governance report for the Board.
- Who should be responsible?
Assign each task to a role rather than a named individual, so the responsibilities transfer when people leave, and record the assignment in your website governance policy. In most nonprofits with a single Communications Director, the weekly and monthly tasks sit with them.