Your website is probably more important than your governance suggests
In many organisations, the website has quietly become part of the operating system.
It may have started as a simple place to publish information, share updates and explain what the organisation does. But over time, it has probably taken on more responsibility.
It may now handle enquiries, donations, event registrations, grant applications, member resources, document access, course delivery, payments, stakeholder communication, public reporting or all of the above.
That shift often happens gradually.
A form is added here. A resource library is added there. A payment integration is connected. A few plugins are installed. A supplier builds something useful. A staff member finds a workaround.
Before long, the website is no longer just a communications tool. It is part of how the organisation operates.
The problem is that the website’s governance does not always keep pace with its growth.
Responsibility can become scattered. One person knows how to update the pages. Another person has the hosting login. A previous supplier set up the forms. A former staff member created the email integration. Someone in communications manages content. Someone in operations worries about risk. The board may only hear about the website when a redesign is proposed or something goes wrong.
That is where website governance matters.
Your website is not just a communications tool. It is an operational asset. If nobody clearly owns it, reviews it, maintains it, secures it, or measures whether it still supports the organisation, you do not have website governance. You have hope.
And hope is not a governance model.
This does not mean every organisation needs a complex digital policy framework or a board subcommittee for the website. It does mean the organisation should know who is responsible for the website, what condition it is in, what risks it carries, how changes are approved, and what happens if something breaks.
For boards and leadership teams, website governance is not about getting involved in day-to-day website updates. It is about having confidence that the platform your organisation relies on is owned, understood, maintained and reviewed.
That starts with a simple question.
What is website governance?
Website governance is the set of responsibilities, processes, standards and review practices that keep a website accurate, secure, accessible, compliant, useful and aligned with the organisation’s purpose.
That sounds formal, but the idea is simple.
Website governance answers questions such as:
- Who owns the website at the leadership level?
- Who manages it day to day?
- Who can publish content?
- Who approves major changes?
- Who manages external suppliers?
- Who reviews user access?
- Who checks whether old content is still accurate?
- Who understands what data the website collects?
- Who knows what should happen if the website goes offline?
Without clear answers to those questions, the website may still function, but the organisation is relying on informal knowledge, assumptions and goodwill.
That might work for a while. It often does. The website loads. Staff can update pages. Forms seem to send correctly. Donations, registrations or enquiries may keep coming through. From the outside, everything may appear under control.
But weak governance usually shows up when something changes.
- A key staff member leaves.
- A supplier relationship ends.
- A plugin breaks.
- A form stops sending submissions.
- A board member asks who has access.
- A privacy concern is raised. A redesign begins, and nobody can explain why certain parts of the website work the way they do.
Website governance reduces that dependency on memory, habit, and individual heroics.
It is not the same as website maintenance, although the two are connected.
Website maintenance asks, “Is the website technically up to date?”
Website governance asks, “Is the organisation managing the website responsibly?”
Maintenance may involve plugin updates, backups, performance checks and security monitoring. Governance sits around those activities and asks who is accountable for them, how they are reviewed, what standards apply, how decisions are made, and how risk is reported.
That distinction matters because a website can be technically maintained but poorly governed.
The plugins may be updated, but nobody may know who approves new ones. Backups may exist, but nobody may have tested whether they can be restored. Forms may be working, but nobody may know where the data is stored. Admin accounts may still exist for people who left years ago.
Website governance is not about making the website more bureaucratic. It is about making responsibility visible.
For organisations that rely on their website to communicate, serve, educate, collect information, process transactions, or maintain public trust, that visibility matters. It helps leadership understand whether the website is simply being used or managed as the operational asset it has become.
Why boards should care
Boards do not need to manage the website day-to-day.
They do not need to know which plugin was updated last week, how the homepage template is built, or whether the contact form uses one form plugin or another. That is not the board’s role.
But boards should care whether the website is properly governed, because it is often connected to areas the board already has responsibility for: risk, reputation, service delivery, privacy, accessibility, stakeholder trust, and organisational continuity.
For many organisations, the website is one of the most public expressions of credibility. It is where people go to understand who you are, what you do, how to contact you, how to apply, how to donate, how to register, how to access resources, or how to decide whether your organisation can be trusted.
If the website is inaccurate, insecure, inaccessible or unreliable, the problem does not remain neatly inside the “website” category.
It can affect how the organisation is perceived. It can interrupt services. It can frustrate members, donors, applicants or stakeholders. It can expose personal data. It can weaken confidence. In some cases, it can create compliance, privacy or accessibility issues that leadership cannot simply delegate away and forget.
This is why website governance belongs in the broader governance conversation.
The board does not need to know which plugin updates failed last month. But it should know whether anyone is responsible for knowing.
That is the real governance issue.
The board should know whether the website has clear ownership. It should know whether admin access is controlled. It should know whether risks are reviewed. It should know whether backups are tested, not merely assumed. It should know whether the website collects personal information, where that information goes, and who has access to it.
Most importantly, the board should know whether the organisation has a reliable process for making decisions about the website.
That does not mean every website change needs board approval. In fact, that would be a terrible governance model. Good website governance does not drag leadership into every small content edit, design tweak or technical update.
Instead, it makes sure the right decisions are owned at the right level.
A staff member should not need board approval to fix a typo. A communications manager may be able to approve routine content. A senior leader may need to approve a major change to donation flows, member access, public reporting, data collection, or the presentation of services online.
The board may need to be involved only when the website poses strategic, financial, reputational, or operational risk.
The point is not control. The point is clarity.
When website governance is weak, important decisions often happen informally. A plugin was added because someone needed a quick fix. A new form is created because a department needed data. A supplier is given admin access because it was convenient. An old page stays live because nobody owns it.
None of these decisions may seem serious on their own. But over time, they create a website that the organisation depends on without fully understanding.
A well-governed website gives the organisation confidence that the platform is not just working today, but being managed responsibly for tomorrow.
I’ve created a governance starter kit resource to help you get started.
👉 Download the free Website Governance Starter Kit
The warning signs of weak website governance
Weak website governance does not usually announce itself loudly.
The website may still load. Staff may still be able to publish updates. Forms may still appear to work. Event registrations, donations, enquiries or member logins may still be coming through. From the outside, everything can look reasonably under control.
But governance problems often sit underneath the surface, quietly accumulating until something changes.
The first warning sign is dependency.
If one staff member knows how the website works, one supplier controls most of the technical setup, or one person quietly handles every content decision, the organisation may be carrying more risk than it realises. That person may be capable, generous and highly committed, but they have also become a single point of failure.
The second warning sign is unclear ownership.
The website might be “owned” by communications, managed by operations, supported by IT, edited by programme staff, hosted under an account created years ago, and maintained by an external developer. Everyone touches part of it, but nobody is clearly accountable for the whole thing.
That is when simple questions become surprisingly hard to answer.
Who owns the domain name? Who controls the hosting account? Who has administrator access? Who approves new plugins or integrations? Who decides whether an old page should stay live? Who checks whether the website is still meeting user needs?
Access is another common governance gap.
Many organisations have websites with admin accounts for former staff, past suppliers, volunteers, committee members, or people who only needed access for one short project. These accounts may have been created for sensible reasons at the time, but if they are not reviewed, they become unnecessary risk.
Content and data can drift, too.
Important pages may stay live long after the information has changed. Old reports, policies, resources, or service descriptions may remain available because no one is responsible for reviewing them. Forms may collect personal information, but no one can be entirely sure where the submissions go, who can access them, or why they are still retained.
The same applies to technical changes.
If updates are applied directly to the live website without testing, new plugins are added because they solve an immediate problem, or custom code exists without documentation, the organisation may not know how fragile parts of the website have become until something breaks.
None of this is necessarily dramatic. That is part of the problem.
Weak website governance usually does not announce itself as a crisis. It quietly accumulates until something breaks, someone leaves, a privacy question is raised, or a major change exposes the gaps.
By then, the organisation is not just fixing a website issue. It is untangling years of informal decisions.
Website governance is not the same as redesigning the website
Many organisations only discover their website governance problems when they decide it is time for a redesign.
On the surface, a redesign sounds like a design, content and technology project. The organisation wants a better-looking website, clearer navigation, improved user experience, cleaner messaging, stronger performance, and perhaps a more modern WordPress setup.
All of that may be needed.
But once the project begins, deeper issues often appear.
Nobody is quite sure which content should stay, which pages are out of date, or who has the authority to approve changes. Old resources are still being accessed by users, but nobody knows whether they are up to date. Forms are sending data to inboxes, CRMs or spreadsheets that were set up years ago. Plugin licences belong to a supplier, a former staff member, or to no one, as no one can quite remember. Analytics exists, but nobody knows who checks it or what decisions it informs.
The redesign then becomes more than a redesign.
It becomes a content audit, a systems review, an access cleanup, a supplier handover, a risk discussion, a data-mapping exercise, and sometimes a quiet organisational therapy session.
That is not necessarily bad. Redesign projects often reveal things that need attention anyway. But it does mean the organisation may be trying to solve governance problems within a design project, usually under time and budget pressure and amid competing internal opinions.
A redesign can give you a better-looking website. It cannot automatically give you a better-governed one.
A new design will not decide who owns the content review. A new theme will not clarify who approves major website changes. A new navigation structure will not document where form data goes. A new homepage will not remove old admin accounts, test backups, define supplier responsibilities, or create an incident response process.
Those things need to be owned deliberately.
This is especially important for organisations using WordPress, because WordPress websites often grow in layers. A site may start with a few pages and a contact form, then slowly become a membership hub, resource library, donation platform, event registration system, learning portal or application gateway.
By the time a redesign is being discussed, the website may already be carrying operational weight that was never properly documented.
That is why website governance should be considered before a major redesign, not only during or after one.
Before asking “What should the new website look like?”, leadership should also ask what the current website does, who relies on it, what systems it connects to, what risks it carries, who owns the decisions, and what should be fixed, retired, documented or protected before the rebuild begins.
Without that clarity, a redesign can accidentally preserve old problems inside a fresh new layout.
The goal is not to slow down the redesign. It is to prevent the organisation from spending money on a new website while leaving the same risks unmanaged.
The core areas of website governance
Website governance does not need to begin with a 40-page policy document.
For most organisations, it starts with something much simpler: making the main areas of responsibility clear.
Who owns the website? Who manages it? Who approves changes? Who checks whether it is still accurate, secure and useful? Who understands the risks? Who knows what happens if something goes wrong?
The answers do not need to be complicated, but they do need to be visible.
Good website governance does not mean every decision goes to the board. It means the right decisions are owned at the right level.
Ownership and accountability
The first question is simple: who owns the website?
Not just who updates it. Not just who logs into WordPress. Not just who talks to the developer. Who is actually accountable for the website as an organisational asset?
In many organisations, this answer is unclear. Communications may own the content. Operations may worry about risk. IT may handle access or hosting. An external supplier may manage updates. Programme teams may create pages or resources.
That split is normal, but it needs structure.
A healthy governance model separates leadership accountability from operational responsibility. Someone at the leadership level should be accountable for ensuring the website is managed responsibly. Someone operational should manage day-to-day coordination. Others may own specific content, systems, services or technical tasks.
The important thing is that everyone knows where responsibility sits.
Content governance
Content governance is about what gets published, who approves it, how often it is reviewed, and when it should be removed.
This matters because website content rarely fails all at once. It drifts.
A staff profile becomes outdated. A service description no longer matches reality. An old grant round still appears in Google’s index. A policy document is replaced internally, but the old version stays live. A resource page keeps growing until nobody knows which items are still current.
For boards and leadership teams, this is not just a housekeeping issue. Outdated or inaccurate content can affect public trust, service delivery, funding, compliance, accessibility and reputation.
Good content governance defines who owns key sections of the website, how approvals work, how often important pages are reviewed, and who has the authority to archive or remove content that no longer serves the organisation.
It also recognises that not all content carries the same risk. A blog post, annual report, donation page, grant application form, public policy statement and member-only resource should not all be governed in the same way.
Technical governance
Technical governance is the process around the website’s platform, hosting, updates, backups, performance, monitoring and support.
This does not mean the board needs to understand technical implementation. It means the organisation should know that technical responsibility is clear.
Who manages WordPress updates? Are plugin and theme updates tested before being applied? Is there a staging site? Who monitors uptime? Who checks performance? Who manages hosting? Who owns the domain name? Who is responsible for SSL, DNS, backups and restore testing?
These questions matter because technical issues can quickly become operational issues.
A failed update can break a donation form. A hosting problem can take down event registrations. A poorly managed plugin can create a security risk. A slow website can affect users trying to access information or complete forms.
Technical governance is not about perfection. It is about having a known process, clear responsibility, and sufficient visibility so that the organisation is not relying on guesswork.
Security, access and data governance
Security, access and data governance are closely connected because they all relate to control.
Who can access the website? What can they change? What information does the website collect? Where does that information go? Who can see it?
WordPress websites often accumulate user accounts over time. Staff, volunteers, board members, committee members, suppliers, designers, developers, SEO consultants, marketing contractors and temporary project workers may all have been given access at some point.
Some still need it. Many probably do not.
Former staff should not retain administrator access. Suppliers should not have more access than they need. Shared logins should be avoided. User roles should match actual responsibilities, not convenience.
The same principle applies to data.
If the website collects information through contact forms, donation forms, event registrations, grant applications, membership forms, newsletter signups, course enrolments or payment systems, the organisation should know what data is collected, where it goes, who can access it, how long it is retained, and which third-party systems are involved.
None of this is automatically wrong.
The governance issue is whether the organisation understands and manages it.
Accessibility and user experience governance
Accessibility and user experience are often treated as design concerns, but they are also governance concerns.
If people cannot use the website, complete a form, read a document, navigate on mobile, find key information, or access services in a reasonable way, the organisation has a broader responsibility issue.
For many organisations, the website is a front door. It may be the first place someone goes to apply, donate, register, ask for help, access resources, understand eligibility, or check whether the organisation is credible.
That front door needs to work for the people the organisation serves.
This is not about chasing design trends. It is about making sure the website continues to serve real people effectively.
Continuity and incident governance
The worst time to decide who owns a website incident is during the incident.
If the website goes down, is compromised, breaks after an update, stops sending form submissions, loses access to a payment gateway, or exposes an urgent error, the organisation needs more than panic and a group email.
Continuity governance asks what happens when something goes wrong.
Who is notified? Who investigates? Who contacts the host? Who contacts the developer? Who can restore a backup? Who communicates internally? Who communicates externally if users are affected? How long can the organisation tolerate the website being offline? Which parts of the website are most critical?
An organisation with a simple brochure website may have a fairly light continuity process. An organisation taking payments, handling grants, running events, providing member access or delivering online learning needs something more deliberate.
The goal is not to imagine every possible disaster. It is to make the likely ones less chaotic.
A well-governed website has clear responsibilities, known recovery steps, tested assumptions, and sufficient documentation so that the organisation is not dependent on one person remembering what to do under pressure.
Together, these areas form the practical foundation of website governance.
They do not require the board to run the website. They simply give leadership a clearer view of how the website is owned, managed, reviewed and protected.
👉 Download the free Website Governance Starter Kit
What website governance looks like for WordPress organisations
WordPress is not the governance problem.
In fact, WordPress can be an excellent platform for organisations that need flexibility, control and room to grow. It can support simple websites, complex publishing workflows, donations, memberships, events, learning platforms, resource libraries, application forms, integrations and custom functionality.
That flexibility is one of its strengths.
But it is also why governance matters.
A WordPress website often grows in layers. It may begin as a fairly simple public website with a handful of pages and a contact form. Then, over time, more features are added. A donation form. An event registration plugin. A member-only resource area. A course platform. A CRM integration. A document library. A payment gateway. A tracking script. A supplier-built feature that solved a problem at the time.
None of those additions is necessarily bad.
The issue is whether the organisation still understands the platform it now relies on.
Good WordPress governance means the organisation can answer practical questions about how the website is owned, maintained, extended and protected.
- Who owns the hosting account, domain name and plugin licences?
- Who has administrator access?
- Are former staff and suppliers removed when their access is no longer needed?
- Are WordPress, plugin and theme updates tested before being applied to the live website?
- Is there a staging environment?
- Are backups automated, secure and tested?
- Is custom functionality documented?
- Are critical plugins still supported?
- Does anyone know what data the forms collect and where that data goes?
These are not abstract technical concerns. They affect continuity, risk and decision-making.
A form plugin is not just a form plugin if it handles grant applications, member enquiries or client intake. A membership plugin is not just a plugin if it controls access to paid resources. A learning platform is not just a feature if users rely on it for certification or compliance. A payment gateway is not just a technical integration if donations, registrations or renewals depend on it.
The more responsibility the website carries, the more governance it needs.
This is where many organisations discover that the problem is not WordPress itself. The problem is years of undocumented decisions.
A plugin may have been installed for a valid reason, but nobody remembers why. A form may have been connected to a staff inbox that no longer exists. A custom feature may have been built by a supplier who is no longer involved. A user account may belong to someone who left the organisation years earlier.
Each of these issues may seem small on its own. Together, they create a platform that is harder to understand, harder to support and harder to change safely.
WordPress is not the governance problem. Undocumented decisions, unclear ownership and unmanaged growth are the problems.
The goal of WordPress governance is not to lock the site down so tightly that nobody can use it. The goal is to make sure flexibility does not turn into fragility.
A well-governed WordPress website can still be flexible. Staff can still publish content. Teams can still improve pages. New functionality can still be added. Suppliers can still support the organisation.
The difference is that decisions are visible, access is intentional, risks are understood, and the platform is managed as something the organisation actually depends on.
What should the board actually ask?
Board members do not need to become website managers.
They do not need to know the name of every plugin, understand the theme structure, or review every content update. That level of detail belongs with the people responsible for managing the website day-to-day.
But board members can ask better governance questions.
The purpose of those questions is not to interfere. It is to create visibility. A board should be able to assess whether the website is being managed responsibly, whether major risks are known, and whether the organisation has sufficient clarity regarding ownership, access, data, continuity, and decision-making.
A practical board-level discussion might start with questions like these:
| Board question | Why it matters |
| Who is accountable for the website at the leadership level? | Without clear accountability, website issues can become everyone’s problem and nobody’s responsibility. |
| Who has administrator access? | Unreviewed access creates avoidable security and continuity risk. |
| Who owns the domain, hosting and software licences? | The organisation needs control over the assets its website depends on. |
| What data does the website collect, and where does it go? | Data collection creates privacy, security and compliance responsibilities. |
| Are backups tested? | A backup that has never been restored is an assumption, not a recovery plan. |
| Which external systems does the website depend on? | Integrations can create hidden operational dependencies. |
| Are key pages reviewed regularly? | Outdated content can damage trust, confuse users and create governance risk. |
| What happens if the website goes down? | Incident response should not be invented during the incident. |
These questions are not designed to make the website feel scary or complicated.
They are designed to help the board understand whether the organisation has a reasonable level of control over a platform it already relies on.
In many cases, the answers will not be perfect. That is normal. The point is to move from assumption to visibility.
Once the board can see the current state clearly, leadership can decide what needs attention, what can wait, and what level of governance is appropriate for the organisation’s size, risk and reliance on the website.
How to start improving website governance
Improving website governance does not need to begin with a major policy project.
For most organisations, the first step is visibility.
Before you can improve how the website is governed, you need to understand what the website currently does, who is responsible for it, what systems it depends on, and where the main risks sit.
That does not mean documenting every tiny detail before anything can change. It means creating sufficient clarity so the organisation can stop relying on memory, assumptions, and informal workarounds.
Start by identifying ownership.
Who is accountable for the website at the leadership level? Who manages it operationally? Who approves major changes? Who manages suppliers? Who reports issues or risks upward when something needs attention?
Then review access.
Look at who has administrator access to WordPress, hosting, domain management, DNS, analytics, forms, payment systems, email marketing tools, CRM integrations and any other connected platforms. Remove access that is no longer needed. Reduce overly broad permissions where possible. Make sure access belongs to current people with clear roles, not forgotten accounts created years ago.
Next, map the systems the website depends on.
This does not need to be a complex technical diagram. A simple list is enough to begin with. Include hosting, domain name, WordPress theme, key plugins, forms, CRM, payment gateway, email marketing platform, analytics, donation tools, event systems, learning platforms, membership tools and any custom code.
Once the systems are visible, look at the key journeys.
What are the most important things people do on the website? They might enquire, donate, register, apply, log in, download resources, access member information, complete a course or find critical service details. These journeys should be tested, reviewed and owned because they are the parts of the website most closely connected to organisational outcomes.
Data collection also needs attention.
List the forms and other places where the website collects information. For each one, ask what data is collected, where it goes, who can access it, how long it is retained, and whether the organisation still needs to collect it in that way.
Then review content ownership.
Identify the pages that carry the most organisational risk or importance. Service pages, grant information, donation pages, programme details, membership information, policy documents, board or governance information, contact details and eligibility criteria should not be left to drift. Each important area should have an owner and a review rhythm.
Technical resilience should also be checked.
- Are backups running?
- Where are they stored?
- Has anyone tested a restore?
- Is there a staging site for safe changes?
- Who monitors uptime or security issues?
- What happens if a plugin update breaks a critical feature?
- Who responds if the website goes offline?
These steps are not about creating bureaucracy for its own sake.
They are about reducing avoidable uncertainty.
The goal is not to solve everything in one meeting. The goal is to replace vague concern with a clearer picture.
Some issues may need immediate attention, such as former staff admin access, missing backups or unknown data flows. Other issues may become part of a longer-term roadmap, such as content governance, accessibility review, documentation or supplier handover.
Start with visibility. You cannot govern what nobody has clearly mapped, documented or owned.
This is especially useful before a redesign, a major redevelopment, or a platform change. A governance review can help separate visual problems from structural problems, content problems from ownership problems, and technical problems from decision-making problems.
If your organisation relies on WordPress but nobody has a clear picture of its condition, risks, responsibilities or next steps, this is exactly what a WordPress Platform Audit is designed to uncover.
👉 Download the free Website Governance Starter Kit
Final thoughts: governance gives the website a future
A website can look fine from the outside while being poorly governed underneath.
It can still load. It can still publish news. It can still accept enquiries. It can still process registrations, collect donations, host resources, display reports and present the organisation professionally.
But if ownership is unclear, access is unmanaged, content is stale, backups are untested, data flows are undocumented, suppliers hold critical knowledge, and no one is reviewing whether the website still properly supports the organisation, risk is quietly accumulating.
That is why website governance matters.
It gives the organisation a way to move from assumption to visibility.
Instead of hoping the right person knows what to do, governance makes responsibility clear. Instead of relying on undocumented supplier knowledge, it creates a shared understanding of how the website works. Instead of treating website issues as isolated technical problems, it connects them to risk, continuity, reputation, privacy, accessibility and service delivery.
Website governance is not about controlling every small decision on a website. It is about ensuring the platform your organisation relies on is owned, understood, reviewed, and ready for what comes next.
For boards and leadership teams, that is the real value.
A well-governed website does not remove every risk. No governance model can do that. But it does make the organisation better prepared, better informed and less dependent on informal knowledge, individual heroics or hope.
If your organisation relies on WordPress but does not have a clear view of its condition, ownership, risks or next steps, this is a good place to start.
A WordPress Platform Audit can help identify technical, operational and governance risks before small issues become larger problems. It gives leadership a clearer understanding of the platform the organisation already depends on, and what should happen next.
Book a WordPress Platform Audit
Zero Point Development will review your WordPress platform, identify key risks, and help you understand what needs attention before small problems become operational issues.
https://zeropointdevelopment.com/services/wordpress-platform-audit/
