How to Choose an Open Source CMS for Charities
Say "open source" in a board meeting and half the room hears "free". It isn't free. It's a different invoice with different line items, and some of them don't show up until year two.
This is a guide for a charity that has broadly decided to look at open source and now has to pick one. What the term covers, the criteria that decide whether it works, and the cases where the honest answer is to stop and buy something simpler.
Key Takeaways
- Open source removes the licence fee. It doesn't remove hosting, patching, upgrades, or the cost of somebody's attention.
- The licence matters far less than the maintenance policy. Find out who ships security fixes for your version, and the date that stops. Some CMS systems are more supported than others.
- Partner pool depth is a risk control. If one agency in the country can work on your site, that isn't a supplier, it's a dependency.
- Test your exit before you sign: ask for the database, the templates and the deployment instructions.
- If comms is one person at 0.4 FTE with no maintenance budget, a hosted platform is usually the better call. There's nothing embarrassing about that.
What Open Source Actually Gives You
It gives you the source code and the legal right to run it, change it, and take it elsewhere. WordPress and Drupal are published under the GPL, Umbraco CMS under the MIT licence, though several Umbraco add-on products are commercially licensed. The obligations differ if you redistribute software, but for an organisation that just wants a website the effect is the same: nobody can bill you for permission to keep running it.
What it doesn't do is host your site, patch it, back it up, or answer the phone. Those jobs still exist. Open source shifts them from a vendor's subscription onto your budget, your staff, or your agency's retainer. That's the whole trade, and it's worth saying out loud before anyone writes the business case.
The licence is free. The software isn't.
The Criteria That Actually Decide It
Who maintains it, and until when
Governance varies. Some projects sit with a foundation and a volunteer community, others are led by a company that also sells services around the product. Neither is inherently safer. What you want is a published support window: which major version will you be on, and what's the stated end date for security fixes on it? Umbraco publishes support windows per major release, with a longer one for its long-term-support versions. Ask every candidate the same question, then put the date in your risk register.
When that date arrives, it really arrives. Drupal 7 reached end of life on 5 January 2025 and stopped receiving community security fixes, leaving owners to choose between a migration project and paying a vendor for extended support. Sites don't go dark on an end-of-life date. They just stop being defended. Drupal and Wordpress are common CMS systems, which is also a big risk. It means they are regularly targeted by hackers. Choosing a more secure .NET CMS (such as Umbraco) can be a much more logical solution when security and future-proofing is a concern.
How a patch actually reaches your site
Core updates are only part of the picture. Plugins, packages and themes are code too, often written by someone under no obligation to keep maintaining them. The question isn't "is it patched", it's "who applies the update, within what window, and how do we know it happened?" That answer needs a name in it. A policy with nobody's name on it is how sites end up two years behind.
Sites like Wordpress heavily rely on plugins. This is great to quickly spin up a landing page or brochure-site. Not so great when that plugin has a known security vulnerability and your site goes down, or worse gets hacked, during a big campaign or donation push.
Hosting becomes your decision
With open source you choose the infrastructure, which is freedom and also a chore. PHP projects run almost anywhere; Umbraco is built on .NET and usually lands on Microsoft infrastructure such as Azure. Some projects sell their own managed hosting, a paid product and a fair trade: less control, less operational load. Hosting belongs in the total cost either way.
Can you leave
Ask for four things at contract stage: the database, the source for templates and custom code, documented deployment steps, and a content export you can open. Hesitation on any of them is itself the answer. Be honest about the licence's limits, though: open source doesn't guarantee portability, and a heavily customised build is sticky whatever the licence says.
What your editors can do unaided
During evaluation, get the staff member who'll update the appeal page at 4:45pm on a Friday to publish a page in the demo. Not the vendor. If that takes fifteen minutes and a phone call, the cost repeats every week for five years.
When Open Source Is the Wrong Answer
If there's no recurring maintenance line in the budget, no named technical owner, no retained partner, and the site is a dozen pages plus a donate button, buy a hosted proprietary platform instead. You'd be paying a subscription to make hosting, patching and uptime someone else's problem, which for a small charity is often the most responsible use of donated money. Ideology is a luxury. Protecting the operating budget isn't.
Umbraco Cloud can also be a great mid-way solution where hosting and security patches are largely automated, but you still maintain complete control over the site itself. The cost is also very competitive.
Where Webcoda Fits
Webcoda is a Sydney agency and a certified B Corporation, delivering web solutions since 2005. We're an Umbraco Gold Partner and a Gold Contributing Partner for 2025, a Gold partner for Xperience by Kentico, and a HubSpot Solutions Partner. Our CMS work includes migrations from WordPress, Drupal and legacy platforms, systems integration, and support after launch. Not-for-profit clients include Tresillian and St Vincent de Paul. Partnerships across open source and proprietary platforms are the point: they keep "stay where you are" on the table as a real recommendation.
Open Source CMS for Charities: FAQs
The software licence is free. The website isn't. You'll still pay for hosting, implementation, security updates, major version upgrades and someone's time to run it. Open source moves those costs from a licence line to a labour line, which is a genuine saving for some organisations and a hidden liability for others.
There's no single winner. WordPress usually has the broadest partner pool and the simplest starting point. Drupal suits complex, structured content and organisations with technical capacity. Umbraco suits charities already standardised on Microsoft infrastructure or needing custom integration work. Match the platform to the skills you can actually hire and keep, rather than to a feature comparison.
"Not-for-profit" is the broad sector term. A charity is a legal subset: an organisation registered with the Australian Charities and Not-for-profits Commission. All charities are not-for-profits, but plenty of not-for-profits, such as sporting clubs and industry associations, are not charities. The distinction matters because some grant and vendor programs key their eligibility to ACNC registration, so read the wording before you assume you qualify.
Not necessarily, but you do need a named owner. That can be a staff member, a contractor, or an agency on a support arrangement. What doesn't work is assuming the person who built it will still be around, or that updates will happen because everyone agrees they're important.
Not inherently. Published code means vulnerabilities are visible to defenders and attackers alike, and mature projects have disclosure processes and regular security releases. The deciding variable is patch discipline at your end. A well-maintained open source site beats a neglected commercial one, and a neglected site of either kind is a problem waiting for a date.
Talk to Webcoda
Webcoda is a Sydney-based, B Corp certified digital agency that has been building websites and enterprise web applications since 2005, for organisations including Sony, BridgeClimb, the Australian Federal Government and NSW Health. We are an Umbraco Gold Partner, a Gold partner for Xperience by Kentico and a HubSpot Solutions Partner, so platform advice comes without a single-vendor agenda.
Get in touch to talk through your project, or browse our full range of services and platforms.
