Nonprofit Website Design: What a $5M+ Organization’s Site Must Get Right

By ·

Volunteers in blue shirts set out boxes of food at an outdoor community food distribution.

Good nonprofit website design, for an organization with a budget of $5 million or more, does three jobs at once. It explains the mission to people who have never heard of you, and it takes gifts on a phone without friction. It also has to meet legal and security rules that no template can settle for you, and two federal accessibility deadlines moved in 2026.

  • Build the donation form for mobile first; in M+R’s 2025 data mobile brought 52% of visits but 28% of revenue.
  • HHS-funded organizations face WCAG 2.1 AA from May 11, 2027 (15+ employees). Build to WCAG 2.2 AA, which also meets 2.1.
  • A donation page that embeds a processor’s card form has to be protected against tampered scripts to qualify for the short PCI questionnaire.
  • Post your Form 990, check state solicitation wording, and check whether Colorado, Delaware, Minnesota, Maryland or Oregon privacy law reaches your lists.

This is for the executive director, development director or communications lead planning a rebuild. The design sections reflect our design practice; the rules sections, which make up most of the post, cite the primary source for each point. Nothing here is legal advice. Your counsel should confirm how each rule applies to your organization.

Start with the people the site serves

A larger organization has more audiences than a small charity, and they want different things from the same pages.

  • Donors want to know what a gift does and give in under a minute.
  • The people you serve want to find help, check eligibility or apply, on a phone or under stress.
  • Volunteers and members want sign-ups, schedules and event details.
  • Foundations, major donors and board members want evidence: annual reports, audited financials, the Form 990, leadership and governance.

Write down the two or three tasks each group comes to do, then design the navigation around those tasks. If someone seeking services has to dig past several fundraising banners to find the intake form, the priorities are backwards.

Design the program pages first

Design the program page template before the home page. It is where a donor decides your work is real and where someone looking for help decides whether to call. A good one follows the same order every time: who the program is for, what happens when you take part, how to get help or apply, what it achieved last year with dates and numbers you can stand behind, and then how to support it.

Put the donate action in two places. A persistent button in the header serves the donor who arrived ready to give. A short appeal at the foot of each program page, tied to that program, serves the reader you just persuaded. Skip pop-up appeals on program and intake pages, because they cover the very content a person in need came to read.

Use photographs of your own people and places, with consent, and caption them; stock images say little about your work. The home page then becomes a set of doors into these program pages, plus one clear line about the mission.

Giving on mobile and on desktop

M+R’s Benchmarks 2026 study reports medians from 180 nonprofits of every size that chose to share their 2025 data. It is not a random sample, but it is a useful picture. Mobile devices, phones and tablets together, accounted for 52% of all visits but 28% of revenue. Desktop users “made up the majority of donation transactions (57%) and revenue (72%).”

Conversion follows the same pattern. On primary donation pages, 11% of desktop users completed a gift, against 8% of mobile users. The average desktop gift was $168 and the average mobile gift was $88. Across all traffic sources, the median was 1.6% of visitors donating and $1.33 in revenue per visitor.

Build and test the donation form on a phone first, since mobile devices bring the larger share of visits and convert at a lower rate than desktop. Then give the desktop version the same care, because that is where the larger gifts happen. Our piece on donor loyalty and the website covers the confirmation page, receipt, impact page and monthly option.

Accessibility: the federal dates moved in 2026

Three federal frameworks can reach a nonprofit website, depending on who funds you and what you run.

HHS Section 504 rule, if you receive HHS funding

In 2024 the Department of Health and Human Services adopted a rule requiring recipients of its financial assistance to make web content and mobile apps meet WCAG 2.1 Level AA. “Recipient” includes private organizations, and it covers money received “directly or through another recipient,” so a subgrantee of a state agency spending HHS funds is in scope.

An interim final rule published on May 11, 2026 moved both deadlines back a year (see the table below). HHS said the change “does not alter the substantive requirements” of the 2024 rule, and that it will consider proposing changes to the substance during the extension.

The rule has exceptions for archived content, older documents not used to access programs, and third-party posts, among others. Archived content qualifies only if it was created before the compliance date, is kept only for reference, is never updated, and sits in an area clearly labeled as archived.

ADA Title II, if you deliver services for a government

The Department of Justice’s 2024 rule under Title II covers state and local governments, again to WCAG 2.1 AA. It reaches web content a public entity provides “directly or through contractual, licensing, or other arrangements.” DOJ’s fact sheet gives the nonprofit example directly: governments that contract with “non-profit organizations that run drug treatment programs on behalf of a state agency” have to make sure those contractors follow Title II. A DOJ interim final rule in April 2026 moved the compliance dates, also by about a year.

ADA Title III, depending on what you operate

Title III covers public accommodations. DOJ has issued no web regulation under Title III. Its Title III rules (28 CFR part 36) do not apply to any “religious entity.” DOJ’s 2022 guidance states its position that the ADA applies to the services public accommodations offer, “including those offered on the web.” Nonprofit status does not exempt an organization, and the regulation’s list of public accommodations includes “homeless shelter, food bank, adoption agency, or other social service center establishment.” Whether a given site is covered depends on the facts and on how courts in your circuit read the law.

RuleWho it reachesStandardCurrent date
HHS Section 504Recipients of HHS financial assistance, including subrecipientsWCAG 2.1 AAMay 11, 2027 (15+ employees); May 10, 2028 (fewer)
ADA Title IIState and local governments, including services run for them by contractorsWCAG 2.1 AAApril 26, 2027 (population 50,000+); April 26, 2028 (smaller)
ADA Title IIIPublic accommodations, per DOJ’s positionNo web regulationNone set

The practical answer for a rebuild is the same in all three cases. The current WCAG 2.2 Recommendation from the W3C is dated December 12, 2024, and “Content that conforms to WCAG 2.2 also conforms to WCAG 2.0 and WCAG 2.1.” Specify 2.2 AA in the contract, and have PDFs and the donation form tested with a keyboard and a screen reader before launch. Our accessibility guide covers testing.

Nonprofit donation page security

A donation page that embeds a card form is a payment page, and the scripts it loads can be tampered with. The card industry’s standard, PCI DSS, added two requirements aimed at this: 6.4.3, managing “all payment page scripts that are loaded and executed in the consumer’s browser,” and 11.6.1, a “change-and-tamper-detection mechanism” for payment pages. The PCI Security Standards Council says both became effective on 31 March 2025.

An organization whose donation form is hosted by a payment processor may be able to validate with the short self-assessment, SAQ A. A 2025 SAQ A eligibility criterion asks the merchant to confirm “that their site is not susceptible to attacks from scripts that could affect the merchant’s e-commerce system(s).” The PCI Council’s FAQ says this applies when the processor’s form is embedded in your page, for example in an iframe, and does not apply when your site redirects the donor to the processor’s page. You can meet it with controls like those in 6.4.3 and 11.6.1, run by you or a third party, or with confirmation from a compliant processor that provides the embedded form.

The choice changes the design work. An embedded form keeps donors on your branded page, and it brings the script question with it. Every analytics tag and widget on that page becomes something to inventory and justify. Decide the approach before design starts, and ask your acquirer or processor which questionnaire it expects. The Council notes that it “does not define compliance requirements for any organization.” Those come from your acquirer and the card brands.

Disclosures your pages may need

Your Form 990. A tax-exempt organization doesn’t have to mail copies of its exemption application or annual return to people who ask, if it has made them “widely available.” Posting them online counts when the page “clearly informs readers that the document is available and provides instructions for downloading it,” the file reproduces the return as filed, and anyone can open it without special software. PDF meets the format test, a third-party database of exempt organization documents also works, and in-person inspection rules still apply.

State solicitation disclosures. Some states require set wording wherever you ask for money. Florida’s statute requires charities that are registered or required to register in Florida, and some exempt ones, to “conspicuously display” a set statement on “every solicitation, confirmation, receipt, or reminder of a contribution,” and on a website that statement goes on any page that lists a mailing address or phone number for gifts or “provides for online processing of contributions.” Other states have their own rules. Build the donation page and confirmation email so state-specific text can be added without a redesign.

Registration. The Charleston Principles, adopted in 2001 by the National Association of State Charity Officials as “advisory guidelines,” say existing registration statutes “generally, of their own terms, encompass and apply to Internet solicitations.” Under them, an out-of-state charity with an interactive donation site would register in a state where it specifically targets donors or receives contributions on a repeated and ongoing basis or a substantial basis. Offline activity such as direct mail can trigger registration on its own. Each state interprets its own law, and the Principles are guidance. Tell whoever handles registrations before you launch a national campaign page.

State privacy laws that cover nonprofits

Some state consumer privacy laws exempt charities. Virginia’s law “shall not apply to any … nonprofit organization,” and the California Attorney General says the CCPA “generally does not apply to nonprofit organizations.”

Others don’t. Colorado’s Attorney General says its law “applies to entities, including nonprofits,” that do business in Colorado or target its residents and process data on 100,000 or more of its residents a year (or meet a lower threshold if they sell data). Delaware, Minnesota, Maryland and Oregon exempt only narrow kinds of nonprofit, such as those that fight insurance fraud. Delaware’s threshold falls from 35,000 to 10,000 consumers on January 1, 2027. Maryland’s threshold is 35,000 consumers. These are examples, not the full list.

A national organization’s donor, advocacy and newsletter lists can cross these thresholds. For the website, that means a privacy notice written for these laws and a working way to handle access and deletion requests. It also means deciding which tracking scripts load on which pages.

Search, AI answers and Google Ad Grants

M+R found that organic search traffic “declined over the course of 2025, but still accounted for 39% of all visits.” The study also notes that traffic “is increasingly mediated by AI summaries and social media.” A rebuild that loses rankings loses organic visits. Map every old URL to a new one before launch; our guide to redesigning without losing SEO sets out the steps.

On AI search, Google is direct: “There are no additional requirements to appear in AI Overviews or AI Mode, nor other special optimizations necessary.” A page has to be indexed and eligible to show a snippet. Write specific program pages that say plainly who you serve and where, and keep any structured data accurate. Our article on getting found in AI search gives the wider picture, though it is written mainly for B2B sites. Our AEO agency page describes how we approach this work.

If you use Google Ad Grants, Google requires that “Your entire website must be served over HTTPS” and that the site “have a significant amount of original content that is directly related to your nonprofit’s mission and activities.”

Scoping the nonprofit website redesign

At a larger nonprofit, a website project has many owners, since development, communications, programs, IT, finance and the board all have a stake. Collect their needs at the start.

Before the brief goes out, list:

  • Every system the site talks to: CRM, donation platform, email tool, event and volunteer software, and the payment processor.
  • Who owns registrations, privacy requests and PCI questionnaires.
  • The content you’ll archive rather than migrate, and where the archive will live.

Ask agencies for accessibility test results from a recent launch, and how they handle scripts on the donation page.

A checklist before you sign

  • Audiences and their top tasks written down, with navigation built around them.
  • Donation flow designed and tested on a phone first, then on desktop.
  • WCAG 2.2 AA in the contract, with keyboard, screen reader and PDF testing before launch.
  • Your accessibility deadline confirmed with counsel: HHS (May 2027 or 2028), DOJ Title II if you serve under a government contract (April 2027 or 2028), or Title III.
  • Embedded or redirected donation form decided, with a script inventory for the payment page.
  • Form 990 posted to meet the IRS “widely available” conditions (notice, download instructions, an exact copy, no special software), with the audit and annual report beside it.
  • State solicitation disclosures and registration status checked.
  • Privacy notice and request handling reviewed against Colorado, Delaware, Minnesota, Maryland and Oregon thresholds.
  • Redirect map from every old URL, and Ad Grants rules checked.
  • One named decision-maker for design approval.

Our nonprofit websites page sets out how we run these projects, and you can book a call to talk through a rebuild. To check first whether AI assistants name your organization, request a free AI visibility review.

Sources

, Design & Branding Lead, Innovara Studios. Yona leads design at Innovara Studios: brand identity, product design and the websites we build for clients. How we research and write.