Charity Website Checklist: Legal Must-Haves and Fundraising Essentials

A charity website checklist should cover five areas: legal identity (charity name and registered number, plus company details if you're incorporated), a simple and secure donation journey, correct Gift Aid declaration wording, UK GDPR and electronic marketing consent, and accessibility. Add email security to stop impersonation, and keep the content current so supporters trust it.

A charity's website does a lot of jobs at once. It's where people check you're genuine before giving, where they donate and sign up, where beneficiaries look for help and where journalists and funders check your facts. It's also governed by charity law, tax rules, data protection and fundraising standards. This checklist pulls those strands together for UK charities, with the legal points verified against official sources.

The checklist at a glance

1. Show your charity name and number

England and Wales

Section 39 of the Charities Act 2011 applies to registered charities whose gross income in their last financial year exceeded £10,000. Those charities must state that they're a registered charity, in legible characters, on notices, advertisements and other documents soliciting money or property for the charity, and on bills, invoices, receipts and similar financial documents.

The Act doesn't mention websites by name, but a donation page is plainly a document asking for money, and so are appeal emails. The simplest way to comply everywhere is to put a line like this in the site footer:

Example Trust is a registered charity in England and Wales (1234567).

Many charities show it whatever their income, because supporters look for it and can check it on the Charity Commission's register.

Scotland

The rules are stricter. The Scottish Charity Regulator's guidance on publicising that you are a charity says trustees must make sure the charity's details, including its Scottish Charity Number (SC0xxxxx), appear on formal communications such as letters, emails, invoices and websites. The details are the charity's name as registered, any other name it's known by, the SC number and, if the name doesn't make it clear, the fact that it's a charity. OSCR also suggests saying that you're regulated by OSCR.

Northern Ireland and cross-border charities

If you're registered in more than one jurisdiction, show every registration, for example "Registered charity in England and Wales (1234567) and Scotland (SC012345)". Northern Ireland charities should follow the Charity Commission for Northern Ireland's requirements.

Charitable companies

If your charity is also a company limited by guarantee, company law requires your registered name, company number, place of registration and registered office address on your website. Many charities combine everything in one footer line.

2. Make donating quick and secure

Every extra field or slow page loses donors. Test your donation journey on a phone and check:

• A visible "Donate" button in the header of every page.
• One-off and monthly options, with suggested amounts that explain what they pay for, only where those descriptions are accurate.
• Few form fields. Ask only for what you need for the payment, the receipt and Gift Aid.
• Trusted payment options, such as card, PayPal, Apple Pay or Google Pay, through a reputable provider.
• HTTPS everywhere with a valid, auto-renewing certificate.
• A thank-you page and confirmation email that arrive promptly and explain what happens next.
• Clear information about fees if you use a third-party platform. The Fundraising Regulator's new Code of Fundraising Practice, in effect from 1 November 2025, includes requirements for fundraising platforms on how fees are added and how donors can change or remove voluntary tips.

For printed appeals, collection tins and event posters, a static QR code pointing at your donate page saves typing. Our free QR code generator makes codes that don't expire or track scans.

3. Get the Gift Aid wording right

Gift Aid can add a quarter to eligible donations, so the declaration on your donation form matters. HMRC's guidance on Gift Aid declarations says there's no set design, but a declaration must include:

1. The name of your charity.
2. The donor's full name.
3. The donor's home address.
4. Whether it covers past, present and future donations or just a single donation.
5. A statement that the donor wants Gift Aid to apply (a tick box is fine online).
6. An explanation that the donor must pay enough UK Income Tax and/or Capital Gains Tax to cover what charities claim in that tax year, and is responsible for any difference.

Online declarations must include the same information as written ones. HMRC publishes model declarations that you can adapt. Keep records of every declaration and any cancellations. HMRC's guidance says declaration records should generally be kept for six years from the end of the accounting period they relate to, with enduring declarations for regular giving kept for longer.

Practical tips:

• Don't pre-tick the Gift Aid box.
• Ask for the home address with postcode lookup to cut typing.
• Explain Gift Aid in one plain sentence next to the box.
• Make it easy for donors to tell you if their tax status changes.

4. Handle supporter data and marketing consent properly

Privacy notice and cookies

Your privacy notice should explain what you collect, why, your lawful basis, who you share data with (payment providers, CRM, mailing platforms) and how long you keep it. The ICO's guidance is the reference, and our privacy policy generator can help you write a first draft to check against it. Non-essential cookies, such as analytics and advertising pixels, need consent unless an exemption applies. The Data (Use and Access) Act 2025 created some new cookie exemptions, explained in our guide to cookie consent under the Data (Use and Access) Act.

The charitable purposes soft opt-in

Email and text marketing is covered by PECR as well as UK GDPR. Until recently, charities generally needed consent to send fundraising emails. The Data (Use and Access) Act 2025 changed that: a charitable purposes soft opt-in came into force on 5 February 2026, and the ICO published final guidance in April 2026.

In outline, it lets a charity send electronic marketing to people whose details it collected when they expressed an interest in or offered support to the charity, where the marketing's sole purpose is furthering the charity's charitable purposes, and where the person was given a simple way to opt out when their details were collected and in every message. Read the ICO guidance before relying on it, and note these website implications:

• Your sign-up and donation forms need a clear opt-out at the point of collection.
• Your privacy notice should explain the soft opt-in.
• Your CRM needs to record how and when each contact was collected, so you know who it applies to.
• Every email needs a working unsubscribe link.

Consent remains the right route for some contacts, and for sharing data with other organisations.

5. Follow fundraising standards

The Fundraising Regulator's Code of Fundraising Practice sets the standards for fundraising in the UK, including online. On your website, that means:

• Fundraising claims that are accurate and not misleading.
• A clear complaints procedure, linked from the footer.
• Respect for supporters who ask not to be contacted.
• If you're registered with the Fundraising Regulator, the Fundraising Badge, which signals that you've committed to the Code.

Trustees remain responsible for fundraising, including through agencies and platforms, so check how any third-party fundraising pages present your charity.

6. Make the site accessible

Accessibility isn't optional for a charity. Beneficiaries, supporters and volunteers include disabled people, and some charities exist specifically to serve them.

The public sector accessibility regulations exempt most charities, but not those mostly financed by public funding or providing services essential to the public or aimed at disabled people. Whether or not they apply to you, the Equality Act 2010 requires service providers to make reasonable adjustments, so WCAG 2.2 AA is a sensible target for everyone.

Common issues on charity sites:

• Text over busy photos with poor contrast.
• Annual reports and leaflets published only as PDFs. Publish key content as web pages too.
• Donation forms that don't work with a keyboard or screen reader.
• Videos without captions.
• Vague links like "click here".

Our UK website accessibility checklist walks through the checks.

7. Protect your name from impersonation

Criminals impersonate charities, especially after high-profile appeals. Two technical steps help:

• DMARC. Publish SPF, DKIM and a DMARC policy at quarantine or reject so nobody can send email from your exact domain. Check your setup with the free DMARC checker, and see our guide to stopping email spoofing.
• Secure admin logins. Turn on multi-factor authentication for the website, donation platform, CRM and social media accounts.

Tell supporters on your website how you'll contact them, that you'll only ask for donations through your official site, and that suspicious emails can be forwarded to the NCSC's reporting service at report@phishing.gov.uk.

8. Keep it current and fast

• Trustees and staff: keep the "about" pages current.
• Accounts: link to your entry on the regulator's register, where your latest accounts and annual return appear.
• Events and appeals: remove past events, or move them to an archive.
• Images: compress photos before upload with the free image compressor. Volunteer and event photos straight from a phone are often several megabytes each.
• Consent for photos: make sure you have consent to use images of beneficiaries, especially children and vulnerable people.

A charity website routine

1. Monthly: test a donation on a phone, check the thank-you email arrives and remove past events.
2. Quarterly: check registration numbers and company details in the footer, review the privacy notice and test forms for accessibility.
3. Annually: review Gift Aid wording against HMRC's guidance, check fundraising pages against the Code and confirm DMARC is still enforced.

Our page of free tools for charities and nonprofits brings these checks together. If your small team is stretched by data entry, thank-you letters and Gift Aid admin, Make It Flow can map the workflow and suggest automations, with your staff and trustees staying in charge of supporter relationships and decisions. Talk to us if that would help.

FAQ

Does a charity have to show its registered number on its website?

In England and Wales, registered charities with income over £10,000 must state they're a registered charity on documents that ask for money, which in practice includes donation pages and appeal emails, so most show it in the site footer. In Scotland, OSCR guidance says the charity's details, including its SC number, must appear on its website.

What wording does a Gift Aid declaration need?

HMRC requires the charity's name, the donor's full name and home address, whether the declaration covers a single donation or past and future ones, a statement that the donor wants Gift Aid to apply, and an explanation that they must pay enough UK Income Tax or Capital Gains Tax to cover the claim. HMRC publishes model declarations you can adapt.

Can charities email supporters without consent?

Since 5 February 2026, the charitable purposes soft opt-in lets charities send electronic marketing to people whose details were collected when they showed interest in or support for the charity, if the marketing furthers its charitable purposes and an opt-out was offered at collection and in every message. Otherwise, consent is still needed. Check the ICO guidance first.

Do charity websites have to be accessible?

Most charities are exempt from the public sector accessibility regulations unless they're mostly publicly funded or provide essential services or services aimed at disabled people. All service providers still have duties under the Equality Act 2010 to make reasonable adjustments, so aiming for WCAG 2.2 AA is the sensible standard for any charity website.

Should a charity use a third-party donation platform?

It can make sense for small charities, as platforms handle payments, receipts and often Gift Aid. Check the fees and how they're shown to donors, how optional tips work, whether you get supporter data and consent records, and whether the donation flow matches your brand. The Code of Fundraising Practice includes requirements on platform fees and tips.

What should a charity website footer include?

Include the charity's name, registered number and regulator, company number and registered office if it's a charitable company, a contact address, and links to the privacy notice, cookie settings, complaints procedure and accessibility statement. If you're registered with the Fundraising Regulator, add the Fundraising Badge.