A nonprofit board signs off on a remarkable amount of paper. The annual budget.
The Form 990. Meeting minutes. Bylaw amendments, read line by line. But what
about the organization’s website, which more people read than all of those documents combined, yet boards rarely review formally?
When a website is viewed as a marketing or technical project, it tends to be handed over to whoever is comfortable with those things and revisited only when something breaks. The result is often a church or ministry website that works like a brochure. But the board cannot treat the website as merely a brochure, because it raises at least three questions that belong to governance, not marketing or technology:
1) Who holds the title to your organization’s most valuable asset?
A domain name like yourchurch.org is a leased property, renewed on a schedule and transferable. In every respect that matters to a board, it behaves like the lease on the building. Organizations rarely treat it that way. The domain typically sits in a volunteer’s personal account, renewing against a personal credit card, with one person holding the password.
That works until the volunteer moves, or the card expires, or the relationship ends badly. In our survey of 3,651 churches with listed websites, 211 domains were no longer registered at all: lapsed, available for anyone to buy, at an address people still trusted and still visited. A lapsed church domain is an impersonation opportunity handed to whoever notices first. We found one church whose old domain was hijacked and now serves Indonesian gambling spam. The hijackers took advantage of the trust attached to the church’s name.
Then there is the question: if the organization dissolves, where does the domain go? It should be assigned deliberately, to a regional office, denomination or successor body. Otherwise it goes to auction, and the congregation’s name becomes available to whoever wants it.
Make sure the domain is registered under your organization’s name, using the organization’s email and phone number. At least two trusted people should have access to the registrar account, and they should have the renewal schedule on their calendars.
2) Does your website speak in the present tense?
Everything on a website is a statement the organization is making today. Think of a child protection policy that is three revisions behind the one the board adopted, or a “report a concern” form pointing at an inbox no one has opened since 2019.
Each is a small administrative oversight and a significant evidentiary problem. What the site said on a given day is recoverable years later by a reporter, opposing counsel, or a family trying to understand what the organization told them at the time.
Outdated websites are common and easy to spot. Across the congregations we examined, more than 350 active sites still displayed a copyright year of 2024 or earlier. The oldest read 2003. What does a visitor conclude from a date that old?
The remedy costs very little: when the board reviews its policies, someone should read the website against them in the same sitting. Whether a specific stale page creates real legal exposure is a question for your attorney, and is worth asking with the pages in front of you.
3) Is your website violating visitor privacy?
Many websites send personal information about visitors to third-party companies without the organization even realizing it. A designer installs a plugin, a theme ships with a tag already in it, a volunteer pastes in a snippet from a tutorial. Your organization is nonetheless the party making the disclosure.
Most of Europe requires consent before non-essential tracking. Several US states require disclosure, and a way for visitors to opt out. Which rules apply to your organization is exactly the question your counsel should answer rather than a vendor.
Sensitive pages deserve particular attention. A recovery ministry. A page explaining how to report abuse. A benevolence application. Those visits are among the most private an organization hosts, and they usually carry the same third-party code as every other page, built from the same template.
Questions for the next board meeting:
1) Who holds the title to our domain, when does it expire, and what happens to it if we close?
If the answer names a person rather than the organization, that is the first thing to fix. Put the expiration date on more than one person’s calendar. Don’t lose the lease on your most valuable digital asset.
2) When did someone last read the website as a stranger would, against our current policies?
If the answer is “not since the redesign,” the site may be making representations no one has checked.
3) What does our website send to third parties, who decided that, and do we need to ask for consent?
If the answer is unknown, this will need more investigation by your webmaster.
A website doesn’t have to be expensive or sophisticated to pass these tests. It needs care and accountability. That is the whole standard.
Not sure where your organization stands? Aeris Labs will audit any church or ministry website at no charge: more than 170 measurements across 17 categories, explained in plain language, with the technical detail attached for whoever maintains your site. Bring the results to your attorney if anything raises a question worth asking. Visit Aeris Labs to request an audit.
