80 best practices for managing a nonprofit website on WordPress

Objectives, targets, strategy

1. Hold a quarterly meeting with leadership where you review and set objectives.
2. Produce and share a monthly website report with analytics on targets.
3. Conduct a monthly meeting with immediate team reviewing the report and targets.
4. Informal weekly check-in meeting going over strategy.
5. Have a dedicate technical account manager who oversees management of all areas of the website.

Hosting, domain, email

6. Host your website with premium managed cloud hosting and priority support.
7. Autoscale hosting plans based off of resource usage so that the site is never down due to traffic spikes.
8. Monitor website’s uptime and respond to downtime.
9. Routinely update hosting software (ex. PHP, MySQL).
10. Only edit DNS settings if you are a specialist as it can disrupt hosting and email.
11. Set up URL redirects for links that have changed.
12. Enroll in domain privacy to not make your contact information public and not get spammed.
13. Monitor email uptime and deliverability.
14. Review your hosting, domain and email service providers yearly and reassess based on your goals.

Security

15. Monitor all website-related accounts, their users and expiration dates.
16. Automatically set up SSL renewals.
17. Manually update WordPress core, plugins and themes on a routine schedule and be ready to rollback in case of issues.
18. Only use plugins that are proven with lots of users, great reviews, regular updates and responsive support. Breaches through plugin vulnerabilities are one of the largest threats on WordPress websites.
19. Use as few plugins as possible in order to reduce compatibility conflicts, speed issues and security threats.
20. If you aren’t using these features, disable in Settings the following: open signup, comments and xml-rpc.
21. Protect against email spam with ReCAPTCHA and block offenders.
22. Routinely check Site Health Monitoring in the WordPress dashboard and resolve issues.
23. Manage users and provide them with the role (Administrator, Editor, Author, Contributor, Subscriber) that meets their level of required access.
24. Enforce password security standards for WordPress and all website-related accounts.
25. Get vulnerability alerts from a reputable security service (ex. WordFence).
26. Set up security measures in hosting such as a premium CDN, firewalls, brute-force prevention and DDOS protection.
27. Receive an activity report regularly on bot traffic and blocked login attempts.
28. Set up an automated site scanner for malware.
29. Keep external backups and practice a restoration plan.
30. Enable two-factor authentication for WordPress and website-related services.
31. Limit login attempts for WordPress.

Accessibility and legal

32. Conduct automatic and manual data privacy checks and resolve accordingly.
33. Review all website-related services for privacy practices.
34. Install a cookie consent management tool and test regularly.
35. Update and improve privacy policy statement.
36. Comply with 501(c)(3) rules such as financial and tax transparency.
37. Adhere to copyright and plagiarism laws.
38. Conduct automatic and manual accessibility checks and resolve accordingly.
39. Test accessibility using a screen reader.
40. Update and improve accessibility statement.

Website edits

41. Have a system and process for daily minor website edits.
42. Have a system and process for weekly midsized website additions.
43. Have a system and process for monthly website projects.
44. Maintain a document with website management instructions.
45. Grow a bank of custom website management video tutorials.

UI & UX

46. Check your website regularly for responsive issues and make sure it looks good on all devices and browsers. Check on both virtual and real devices on all screen widths.
47. Complete user experience checks to ensure target audiences can navigate website easily.
48. Test the functionality of every special feature on your website (ex. donations, forms, event signup, subscription, applications, user portals, etc.)
49. Conduct automatic and manual broken link checks.
50. Conduct automatic and manual spelling and grammar checks.
51. Conduct manual brand consistency checks. Brand elements shouldn’t differ in style across pages.
52. Hold regular feedback surveys from each target audience and improve website accordingly.
53. Provide a feedback form on your website.
54. Observe users interacting with your site in-person.
55. Check for console errors and resolve code issues.

Speed

56. Monitor speed metrics such as Core Web Vitals (Largest Contentful Paint, First Input Delay, Cumulative Layout Shift). Use information to improve accordingly.
57. Optimize and cleanup your database routinely.
58. Use a premium CDN.
59. Use caching.
60. Compression and minify your files.
61. Use WebP for your image files.
62. Reduce number of web fonts, plugins, JS and CSS files, redirects and API calls and animations.

Analytics and conversion optimization

63. Review site traffic and user behavior analytics daily.
64. Pay close attention to calls to action and practice conversion optimization methods.
65. Come up with strategic insights and add to monthly report.
66. Improve UI & UX based on analytics findings.
67. Utilize A/B Testing to fine tune what works best.

SEO and content marketing

68. Create and implement an SEO content strategy plan.
69. Conduct a market, audience and keyword analysis.
70. Hold content ideation sessions and a pitch meeting to set up your content calendar.
71. Routinely publish content that brings your target audience value and is optimized for SEO.
72. Optimize technical SEO of new and existing pages.
73. Work with Google Search Console and Bing Webmaster Tools to improve your SEO.
74. Update Google for Nonprofits regularly and ask community for reviews.
75. Use structured data on your website to gain visibility in search results.
76. Monitor your search ranking on websites like SEMRush and Ahrefs.
77. Improve your off-page SEO with genuine backlinks on other websites and social media.

Learning

78. Continually learn the fundamental skills in each of the main categories we talked about in this article.
79. Stay up to date on the latest news and technologies in each of the main categories we talked about in this article.
80. Get a third-party audit in each of the main categories we talked about in this article.