Charity Website Maintenance: Protecting Your Supporters' Trust

Charities are founded on trust. Trust is what turns a one-off donation into a monthly direct debit, a curious visitor into a volunteer, and someone going through a difficult time into a person who asks for help.

The good news is that trust in the sector is strong. The Charity Commission's Public Trust in Charities 2026 research found that 57 per cent of the public have high trust in charities. 

Trust has held at a high level since 2020, and only doctors are trusted more. But the share of people with low trust in charities has crept up from 9 per cent in 2024 to 11 per cent. That's important because the Commission describes trust, engagement and giving as a “virtuous (and vicious) cycle”.

Your website is often where people go to check whether you deserve that trust. When asked how they'd check a charity was genuine, 45 per cent of respondents said they'd look at the charity's own website, second only to the Charity Commission's register.

That makes your website evidence as much as a fundraising tool. And evidence only counts if it's accurate, secure, and working well. You can see exactly where we’re going with this… website maintenance matters.

Charity Website Maintenance Is a Trust Issue

So, why are you reading this? Perhaps your website launched a few years ago, and nobody's quite sure whose job it is to look after it. Maybe an update broke the donate form in the middle of a campaign. Or perhaps a trustee read about another charity's data breach and asked, quite reasonably, whether this is likely to happen to you. 

In this guide, we'll take you through what charity website maintenance involves, why it matters more for charities than for most organisations, what to check and how often, and what to ask of anyone you trust to do it for you. 

If you want to roll back a step, our guides to SEO for charities and charity branding are a good place to start, and our practical guide to website management covers the day-to-day tools in more detail.

What Is Charity Website Maintenance?

Charity website maintenance is the ongoing work of keeping a charity's website secure, accurate, accessible, and in full working order after it launches. 

Maintenance covers software and security updates, backups, monitoring, testing donation and contact forms, checking third-party integrations, and keeping key information, from your trustee list to your latest accounts, up to date.

It's a slightly narrower job than website management, which also takes into account publishing new content, analytics, and SEO.

Support is what happens when something goes wrong, or someone needs help: fixing a bug, answering a question about the CMS, or getting the site back up after an outage. Maintenance is planned; support is (mostly) reactive.

Continuous improvement is about making your website better over time, with new features, UX changes, or performance optimisation. It's valuable, but it shouldn't come at the expense of the basics of website care. 

In reality, every website needs a bit of all three. In our experience, maintenance is the one that's easiest to neglect, because when it's done well, nobody notices it's happened at all.

Why Website Maintenance Matters More for Charities

Every organisation with a website needs to maintain it. Without maintenance, you could run into all sorts of trouble like security issues and performance problems. But a few things make the stakes higher for charities.

Your website is where supporters research you. The Charity Commission's research also shows what the public want to see once they get to your website. Over half (55 per cent) say it matters that most of the money raised goes directly to the cause, 51 per cent that the charity makes a real and demonstrable difference, and 40 per cent that it's easy to see how much has been raised and how it's been spent. 

There's a reassuring flip side. In the Commission's focus groups, participants accepted that some overheads are necessary, and “investment in technology that keeps donor data secure” was on the list they were happy with. Supporters understand that looking after their data costs money.

You hold sensitive data. Donor details, Gift Aid declarations, volunteer records and, for many charities, information about vulnerable beneficiaries. The government's Cyber Security Breaches Survey 2025/2026 found that around one in five charities (22 per cent) hold personal data that isn't protected by techniques such as encryption or anonymisation. That’s a problem waiting to happen.

Attackers aren't picky about who they target. The same survey found that 28 per cent of charities, roughly 57,000 across the UK, reported a cyber security breach or attack in the last 12 months.

Admittedly, most of those were phishing emails rather than hacked websites. But a compromised website is about the most public way there is to lose supporter confidence, and it's often where their data is collected in the first place. 

Meanwhile, the share of charities treating cyber security as a high priority for senior management fell from 68 per cent to 60 per cent in a year, driven by smaller charities (down from 64 per cent to 53 per cent among those with an income under £100,000).

Trustees carry the responsibility. If your website is compromised and personal data is exposed, the clock starts ticking. Under UK GDPR, a reportable personal data breach needs to go to the ICO without undue delay and, where feasible, within 72 hours. A significant data breach is also something the Charity Commission expects trustees to report as a serious incident.

💡 Further reading: Charity Branding: Building a Digital Identity That Inspires Trust

What Does Charity Website Maintenance Include?

In many ways, website maintenance looks no different for charities than it does for any other website. However, there are a few things you’ll want to keep a closer eye on as a charity. 

For each area, we've said who's usually best placed to look after it: you (meaning your in-house team) or your developer (whether that's an agency, a freelancer, or someone in-house).

1. Security Updates and Patching

Your CMS, its plugins, and the server software all receive regular security updates, and applying them promptly is one of the most effective ways to protect your website. It's also one of the most commonly neglected. Only 20 per cent of charities have a policy to apply software security updates within 14 days, compared with 34 per cent of businesses.

Speed matters a lot. Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42 per cent increase on the year before, and found that the most heavily targeted vulnerabilities were typically attacked within hours of being made public. 

WordPress core itself had just six reported vulnerabilities, all low priority; 91 per cent were in plugins. So the lesson applies whatever platform you're on: know exactly what's installed on your website, and keep that list as short as you can.

Platforms have lifecycles as well. Every major version of a CMS eventually stops receiving security fixes. Craft CMS 4, for example, reached the end of its security support on 30 April 2026, while Craft 5 is supported until the end of 2031. If you're running a version that's out of support, routine updates won't fix the problem. It’s time to upgrade. 

But it’s not just your CMS. On 21 October 2026, the National Cyber Security Centre told UK organisations to update any system running PHP, starting with anything facing the internet (PHP is the language underneath WordPress, Drupal and Craft alike), and to consider taking systems offline where they couldn't protect them in time. 

We took our clients' staging sites offline that morning and recommended taking live sites offline for the most exposed few hours while patches went on.

Who looks after it: your developer.

2. Backups and Restores

If the worst happens, a recent backup gets you back online with your content and supporter data intact. Just over half of charities (57 per cent) back up data securely via a cloud service, according to the Cyber Security Breaches Survey.

Backups should be automatic, stored somewhere separate from your web server, and tested by restoring one every so often. Quarterly is usually sensible.

Who looks after it: your developer.

3. Donation Journeys and Forms

Your donation form is probably the most valuable page on your website. A plugin update, an expired API key, or a change at your payment provider can stop donations going through, or stop them reaching your CRM, and it may be days before anyone notices.

So, test it regularly. Make a small real donation every month, and follow the whole user journey: payment, confirmation email, Gift Aid declaration, and the record landing in your CRM. Do the same for contact, volunteering, and referral forms. If you run services, a broken referral form can matter even more than a broken donate button, because the person on the other end may need urgent help.

There are potential compliance issues, too. If supporters enter card details on a page you host (including through an embedded payment form), version 4.0 of the Payment Card Industry Data Security Standard (PCI DSS) added two requirements that became mandatory on 31 March 2025. 

Requirement 6.4.3 means keeping an inventory of every script on your payment page, with a written justification for each one. 

Requirement 11.6.1 means monitoring that page for unauthorised changes, at least weekly (or as often as your own risk assessment says). 

Exactly what applies depends on how your donation form is built, so ask your payment provider which self-assessment questionnaire you fall under. Either way, the fewer marketing and tracking scripts on your donate page, the easier this gets.

Who looks after it: you for the monthly test, your developer for the scripts and integrations.

4. Third-Party Integrations and Suppliers

Websites almost never stand alone. Most are connected to a CRM, a payment provider, an email platform, event booking software, and an analytics tool or two. Each of those connections is a possible way in for someone who shouldn't be there.

The 2020 ransomware attack on Blackbaud, a CRM provider used widely across the sector, shows how this can play out. The ICO received 125 breach reports, and the Charity Commission said 50 charities had reported serious incidents, including the National Trust, Crisis and Young Minds. The breach happened at the supplier, but it was the charities that had to explain it to their supporters.

Even so, only 9 per cent of charities formally review the cyber security risks posed by their immediate suppliers. Maintenance means keeping an up-to-date list of every service connected to your website, what data it holds and who has access; removing integrations you no longer use; and revoking logins and API keys when staff, volunteers or agencies move on.

Who looks after it: both of you.

5. Content Accuracy

This is the part of maintenance that's entirely in your hands. Your supporters will notice quickly if your website features an “upcoming” event from last spring, a trustee who has left, or an old helpline number. They're all small things, but they add up.

Stanford's Web Credibility Project found that people find websites more credible when they show they've been updated or reviewed recently, and that small errors like typos and broken links do more damage to credibility than most site owners expect. That research is over 20 years old (!), so take the detail with a pinch of salt, but the principle has aged pretty well.

Start with the high-value pages people use to judge you: your charity number and registered address, your trustee and leadership pages, your latest annual report and accounts, any impact figures quoted around the site, service information such as helpline numbers and opening hours, and your events listings.

Who looks after it: you.

6. Accessibility

Accessibility is one of those things that tends to erode after launch. Every new page, image and PDF is a chance for things to slip: images uploaded without alt text, headings chosen for their size rather than their place in the structure, or a new widget that can't be used with a keyboard.

Charities have a duty under the Equality Act 2010 to make reasonable adjustments for disabled people, and as our guide to charity website accessibility explains, WCAG is the benchmark that duty is judged against in practice. Spot-check key templates and recently published content every quarter, and make sure everyone who edits the website knows the basics.

Who looks after it: you for content, your developer for templates and components.

💡 Further reading: How to Run a Website Accessibility Audit (UK Guide)

7. Performance and Uptime

Charity website traffic can be up and down. A TV appeal or a news story can push visitor numbers well beyond normal levels in a matter of hours. In those moments, it’s important your website can cope with the volume.

Uptime monitoring with alerts, regular speed checks on your donate and service pages, and making sure your SSL certificate and domain name renew automatically are all part of the job. An expired security certificate, for instance, puts a browser security warning between supporters and your donate button, and a lapsed domain takes the whole website offline.

Who looks after it: your developer or hosting provider for monitoring and certificates; (probably) you for the domain, which should be registered in the charity's name.

8. Search and AI Visibility

Broken links, redirect chains from old campaign URLs, and pages that have dropped out of Google's index all affect how easily people can find you, and increasingly, whether AI tools cite you. A monthly check of Google Search Console will help you catch those issues.

We've covered this in detail in our SEO for charities guide and Full Technical SEO Checklist, so we won't repeat it here.

Who looks after it: both of you.

Charity Website Maintenance Checklist

How often you do each of these will depend on the size of your website and how much it does, but this is a sensible starting point for most charities.

Every Week

• Apply critical security updates
• Check uptime and error alerts
• Check your payment page for unauthorised script changes 

Every Month

• Apply routine CMS and plugin updates, testing them on a staging site first
• Make a test donation and follow it through to your CRM
• Submit test entries to your contact, volunteering and referral forms
• Check Google Search Console for errors and broken links
• Archive past events and out-of-date news

Every Quarter

• Restore a backup to check it works
• Review who has admin access to your CMS and connected services
• Remove plugins and integrations you no longer use
• Spot-check accessibility on key templates and recently published content
• Run speed tests on your homepage, donate page and main service pages

Every Year

• Publish your latest annual report and accounts, and update impact figures
• Review trustee, leadership and contact information
• Check your CMS version's support dates and plan any upgrades
• Review suppliers, data processing agreements and who holds which logins
• Confirm your domain and SSL certificate are set to renew automatically
• Give your trustees a short update on website security and maintenance
• Review your privacy policy and cookie consent

Who Should Own Website Maintenance in a Charity?

Ownership is a sticking point in plenty of organisations, and charities are no exception.

Only 30 per cent of charities have a trustee with explicit responsibility for cyber security, and the Charity Digital Skills Report 2026 found that almost half of charities don't have a trustee with relevant digital expertise. But without a named owner, none of this gets done.

Name an owner. Even if a developer or agency does the technical work, someone inside the charity should know what's been done, what's coming up, and who to call.

Put it on the board's agenda. A short annual update for trustees is plenty: which platform you're on and how long it's been supported, any incidents in the past year, who your suppliers are, and what's planned. Keep it in plain English.

Decide what stays in-house. Content accuracy and form testing are well within reach. Security patching, server updates, and platform upgrades usually need a developer. 

Write down what happens when it goes wrong. Only 19 per cent of charities have a formal incident response plan. It can just be a single page. But you need one.

Use free help. The NCSC's cyber security guidance for small organisations is free, practical and written for non-specialists, and Cyber Essentials gives you a recognised baseline to work towards. Just 13 per cent of charities have the technical controls in place across all five Cyber Essentials areas, so most have some way to go.

What to Ask Your Website Maintenance Partner

If you're outsourcing website maintenance to an agency, or reviewing an arrangement you already have in place, the questions below are what we’d ask first. They're the same ones we'd expect to answer ourselves.

💡 Further reading: How to Choose the Right Web Design Agency

How quickly do you apply critical security updates? You want a clear answer in hours or days, plus a plan for out-of-hours emergencies (like the PHP one above).

Do you test updates before they go live? Updates should go to a staging copy of your website first, so a broken plugin doesn't take your donate page down with it.

Where are our backups kept, and when did you last test a restore? Ask for a date. A backup that's never been restored can’t be considered fully tested.

What do you monitor, and who gets the alert? Uptime, errors, and security warnings should reach a person directly; in a shared inbox, everyone tends to assume someone else has seen it.

What are your response times, and are they in writing? Ideally, these belong in the service level agreement (SLA).

Who owns the hosting, the domain, and the code? You should have full control and be able to move your website to another supplier without starting again.

Do you support websites you didn't build? Many agencies do (we do), so you don't need a rebuild to get your existing website looked after.

Trust Is Earned, Then Maintained

Charities spend years building trust. A hacked donation page can damage that equity in an afternoon, and a website that isn’t up to date and accurate wears it down more slowly.

Most of what protects that trust is routine: updates applied promptly, backups that have been tested, forms that someone checks monthly, and information that's kept accurate. 

None of it is exciting, and none of it will make your next annual report. But it's how you show the people who gave you their money, their time, and their data that their trust was well placed.