AI Impact HubAI Impact HubFor small teams without an IT person, and for the board members and funders who back them.
Create an account & download →Create a free account to download this and every other template on the Hub.
We reviewed 3,425 nonprofit websites. Most of what we found came down to basics: a domain that wasn't set to renew, software nobody updated, a form someone set up years ago and forgot about. This free self-check covers the ten basics every small nonprofit should have, and what to fix first.
Score the ten basics first. Then take the three prompts to the people and tools that can fix what you find, and keep the free help list close.
Ten minutes, on your own or with whoever looks after your website. Your result tells you what to fix first.
Ten statements. For each one, be honest about where you are today, not where you plan to be. If you're not sure, score it "Not true". Not knowing is the finding.
Auto-renew is on, the card on file is current, and renewal notices go to a shared inbox, not one person's email.
Email, website admin, payments, the domain registrar, social accounts and your CRM all ask for a second step, ideally a passkey or an app rather than a text message.
Not a shared spreadsheet, a document or a notebook in the office. When someone leaves, we change what they had access to.
Donations and payments go through our payment provider's own form or page, so card details go straight to them and never to our server or inbox.
It's written down who updates the website, its plugins and the server it runs on, even if it's someone we pay to do it. Laptops and phones update themselves. When a critical security fix is released, it's installed within 48 hours, even if the usual person is on leave.
Our website, email, files and donor records are backed up automatically. One copy is kept where someone who gets into our accounts can't delete it. In the last year, we've actually tried restoring something, and it worked.
No page shows members', donors' or volunteers' details to anyone who isn't logged in. Old forms, unused plugins and forgotten pages get removed.
Our domain has the email settings (SPF, DKIM and DMARC) that stop someone else sending emails that look like they're from us. Our web or email provider can confirm this.
Nobody gives out card details, passwords or personal information because of a phone call or email alone. We call back on a number we already have, never one given in the call or message.
One named person is responsible, security is a regular item in board reports, and we have a one-page plan for who to call if something goes wrong.
Nothing scored yet. Start at the top.
Three prompts. Paste each into the AI tool you already use. Only run the first one on a website your organisation owns.
Start with the website check, then send the questions to whoever looks after your site.
You are helping a small nonprofit check its own website, looking only at what any visitor can see. Our website is: [your web address]. We own this website. Rules, which you must follow: - Only open pages that an ordinary visitor can reach by following links from the home page. - Do not log in, fill in or submit any form, guess web addresses, change anything in a web address, or try to get past any login or block. - If something would need any of those to check, say so and stop. Look for these, and tell me what you find for each: 1. What the site is built on (for example WordPress, Wix or Squarespace), and any signs it hasn't been updated in a long time. 2. Whether every page loads securely (https). 3. How donations and payments work. Does the card number get typed into our own page, or into a payment provider's form or page? 4. Any page that shows people's names, email addresses, phone numbers or member lists to someone who isn't logged in. 5. Any forms, pages or features that look old or forgotten. 6. Whether there's a clear way for someone to report a security problem to us. Then give me: - A short list of what to look at first, in plain English, most important first. - For each one, who should fix it (us, our web provider or our host), and what to ask them. - Anything you weren't sure about, marked "confirm with your web provider". - For each finding, whether you saw it directly on a page or are inferring it. Don't use jargon without explaining it. Don't overstate risk. If something looks fine, say so.
Needs an AI tool that can browse the web. It reads only what any visitor can see, and it can be wrong, so confirm anything serious with whoever looks after your site.
Free help in Australia. Put the first number somewhere everyone can find it before you need it.
Every one of these is free for a small nonprofit.
Most website problems in small nonprofits don't need a skilled attacker. They come from basics nobody got round to.
Score yourself, copy the prompts, download the file. It all runs right here, and every other template on the Hub comes with it.