Nonprofit website checklist — what a charity website needs
A practical, board-ready checklist of everything an Australian charity or not-for-profit website needs to be secure, accessible, legally compliant, and effective for the people it serves. Print it, share it, use it.
This checklist covers the seven areas most critical to a well-governed not-for-profit website in Australia. It is designed to be useful for boards reviewing digital risk, managers commissioning a new build, and organisations assessing an existing site.
Items marked as Essential represent baseline requirements. Items marked Compliance relate to legal or regulatory obligations. Grant items are required for Google Ad Grant eligibility or maintenance.
1. Technical foundations
The infrastructure your website runs on determines how secure, fast, and reliable it is.
- HTTPS is active across the entire site, no mixed content warnings
- SSL certificate is valid and not approaching expiry
- The site loads in under three seconds on a mobile connectionTest at pagespeed.web.dev, target 70+ on mobile
- The site is fully functional on mobile devices
- Regular automated backups are running and have been tested
- There are no broken links or pages returning 404 errors
- Core software, themes, and plugins are up to date
- Uptime monitoring is in place
- Domain registration and hosting renewals are not at risk of lapsing
2. Accessibility (WCAG 2.1 AA)
Australian organisations have legal obligations under the Disability Discrimination Act 1992. The standard is WCAG 2.1 Level AA.
- All meaningful images have descriptive alt text
- Text contrast meets minimum 4.5:1 ratio for body text, 3:1 for large text
- All form fields have correctly associated, visible labels
- The site can be navigated entirely by keyboard
- A visible focus indicator is present when tabbing through the site
- Heading structure is logical and sequential (H1, H2, H3)
- Link text is descriptive, no “click here” or “read more” without context
- Videos have captions or transcripts
- The site remains usable when zoomed to 200%
- PDFs published on the site are tagged for screen reader access
- An automated accessibility scan (WAVE or Axe) has been run in the last six months
3. Legal and compliance
Compliance obligations for Australian charities across privacy, governance, and fundraising disclosure.
- Privacy policy is present and covers the Australian Privacy PrinciplesRequired if you collect any personal information, including via contact forms
- Privacy policy accurately reflects how data is collected, used, stored, and shared
- Cookie consent is in place if third-party tracking tools are used
- ABN is displayed clearly on the site
- ACNC registration status is reflected accurately in public-facing descriptions
- Fundraising disclosure requirements are met (varies by state)NSW, VIC, QLD, WA, SA, ACT all have different requirements
- Any testimonials or case studies have appropriate consent and do not identify clients
- Content involving children complies with child safety obligations
4. Content and information architecture
Whether the site serves the people who need it.
- The organisation’s purpose is clear on the homepage without scrolling
- Contact information is easy to find — not buried in the footer
- Service or referral pathways are clearly signposted
- Content is written for the people the organisation serves, not for a general audience
- Reading level is appropriate for the audienceAim for Year 8 reading level for general community audiences
- Key information is available in plain English — not buried in PDFs
- Content has been reviewed within the last twelve months
- Staff contacts and service listings are current
- Annual reports or financial summaries are accessible to the public
5. Google Ad Grant readiness
Required for organisations that hold or intend to apply for the Google Ad Grant.
- The site has a clear mission statement on the homepage
- There are no broken links across the site
- Landing pages used in ads have clear, relevant calls to action
- Content is regularly updated — not a static site unchanged for months
- The site does not carry third-party advertising
- Google Analytics 4 is installed and tracking correctly
- At least one meaningful conversion is configured in GA4
- ACNC registration is current
- Infoxchange (TechSoup) verification is active
6. Analytics and measurement
Whether you have the information needed to make good decisions about your digital presence.
- Google Analytics 4 is installed and collecting data
- Google Search Console is set up and verified
- Meaningful conversions are tracked (form submissions, calls, downloads)
- Analytics data is reviewed at least quarterly
- There are no duplicate tracking tags firing on the same page
- Internal staff traffic is excluded from analytics data
7. Ongoing governance
The systems and accountability structures that keep the website well-managed over time.
- There is a named person responsible for the website’s health and compliance
- Login credentials and access details are stored securely, not in a spreadsheet
- Access credentials are not shared between staff members
- Staff who have left the organisation have had access revoked
- There is a documented process for making content updates
- The board receives regular reporting on digital health and performance
- There is a plan for what happens if the website goes down
- Website costs are included in the annual budget, not treated as one-off expenses
This checklist is most useful as a starting point, not an endpoint. If you find significant gaps, particularly in the compliance, accessibility, or Google Ad Grant sections, a Digital Capacity Diagnosis provides a more structured assessment with a prioritised remediation plan and board-ready findings. It is also useful as supporting documentation for grant applications covering digital capacity building.
Need a more thorough assessment?
A Digital Capacity Diagnosis goes beyond this checklist, structured findings across six areas, plain-English recommendations, and a board-ready report. $1,500 + GST.
Book a Diagnosis →
