What is website governance
Website governance is the process of setting standards for your websites, checking whether those standards are followed and giving teams a clear way to fix what is not. It covers who owns each site, which rules apply, how often sites are checked and how findings reach the people who can act on them.
A working governance process has five parts:
- An inventory. A current list of every website, its owner, its platform and its purpose.
- Standards. Written requirements for security, accessibility, privacy, brand and technical choices.
- Checks. A repeatable way to test every site against those standards.
- Routing. Findings reach the responsible team, with enough context to act.
- Evidence. A record of what was checked, what was found and what changed.
Governance matters most when an organization runs many websites across different teams, platforms or vendors, and no single person can keep all of them in view.
Why website governance gets harder as a portfolio grows
Every new website adds another owner, another platform and another set of decisions, so standards drift unless someone checks them deliberately. Portfolios rarely grow from one plan. A campaign microsite, a department site, a vendor-built portal and an acquired brand each arrive with their own team and their own habits.
Common signs that a portfolio has outgrown informal governance:
- Websites whose owner has left or was never recorded
- Different CMS versions, hosting arrangements and update practices from site to site
- Strong security and accessibility work on flagship sites, and little elsewhere
- Tracking tags, plugins and integrations added once and never reviewed
- Audit reports that describe the portfolio as it was months ago
None of these points to a failing team. They are what happens when many websites share no common process.
What website governance covers
Website governance usually covers four areas: security, accessibility, organizational standards, and ownership and operations. Each organization sets its own requirements within these areas, based on its risk, its sector and the rules that apply to it.
Areas of website governance and what each covers
| Area | What it covers | Questions it answers |
|---|---|---|
| Security | Certificates, availability, software updates, exposed components, incident response | Is every site current and reachable, and who acts when something changes |
| Accessibility | Conformance with WCAG and applicable law, accessible content and components | Which sites have open accessibility issues, and who is resolving them |
| Organizational standards | Brand, privacy and consent, analytics and tags, approved technologies, content rules | Does each site follow the requirements the organization has agreed |
| Ownership and operations | Site owner, platform, hosting, vendor, review history | Who is responsible for each site, and when it was last reviewed |
The Web Content Accessibility Guidelines (WCAG), published by the W3C, are the technical standard behind most accessibility requirements. Laws such as the European Accessibility Act and the ADA Title II web rule in the United States rely on WCAG, directly or through harmonized standards. Legal and accessibility specialists decide which requirements apply to each site.
How continuous governance differs from a website audit
An audit shows how a website looked at one point in time. Continuous governance checks websites regularly, so teams see new issues and changes between formal reviews.
Both have a place. An audit gives depth: a specialist examines a site thoroughly, often before a launch, a redesign or a compliance deadline. Continuous governance gives coverage: every site stays in view between audits.
Website audit compared with continuous governance
| Website audit | Continuous governance | |
|---|---|---|
| When it happens | At a point in time, often yearly or before a launch | On a regular, repeatable rhythm |
| What it produces | A report | A current view of findings, owners and progress |
| Coverage | Usually one site or a sample | Every site in the portfolio |
| Who acts | Whoever receives the report | The team assigned to each finding |
| Best for | Deep review, certification, major changes | Catching drift and new issues between reviews |
Most organizations need both: continuous checks to keep the whole portfolio in view, and periodic audits for depth.
How to set up website governance across a portfolio
Start with an inventory and clear ownership, agree a short set of standards, check against them on a regular rhythm and keep a record.
Six steps to website governance
- Build the inventory. List every website, including microsites, vendor-run sites and older applications. Record the owner, platform, hosting and purpose of each.
- Name an owner for every site. One accountable person or team per site. Sites without an owner are where risk collects.
- Agree the standards. Write down what every site must meet for security, accessibility and your own requirements. Start with a short list you can check consistently.
- Set a review rhythm. Decide what is checked continuously, what is reviewed formally and how often.
- Route findings to the right team. Group findings by area and by responsible team, with enough context to act.
- Keep the evidence. Record checks, findings and progress, so questions from leadership, auditors or clients do not start a new project.
For the first step in more depth, see Vardot's guide to starting governance with a site inventory.
Who is responsible for website governance
Website governance works when one person or team owns the process, every site has a named owner, and specialists decide on risk and remediation in their own areas.
Typical roles in website governance
- Governance lead. Owns the process, the standards and the reporting. Often sits in digital, web or IT leadership.
- Site owners. Accountable for individual websites and for acting on their findings.
- Specialists. Security, accessibility, privacy and legal experts who decide what a finding means and how to resolve it.
- Delivery teams and vendors. The developers, agencies and hosting providers who make the changes.
Tools can find and organize issues. Qualified people still make the decisions about risk, remediation and compliance.
How agencies apply website governance to client portfolios
For an agency, website governance means holding every client site to an agreed set of checks on the same rhythm, rather than reviewing whichever sites are busiest. Agencies running support and maintenance retainers often look after many client websites on different platforms, with different histories.
A governance approach helps agencies:
- Agree standards with each client at the start of a retainer
- Check every client site consistently, including the quiet ones
- Show clients what was checked, what was found and what changed
- Bring inherited sites into the same process from the first month
Vardot's view: start with ownership, then tooling
Vardot has built and supported enterprise websites for more than 15 years, across more than 200 platforms in more than 30 countries. Our view is that governance starts with ownership, not tooling.
A tool can check a site every day, but if no one owns the result, the finding waits. Before choosing tools, make sure every site has an owner and every standard has someone who decides what a failure means. Then use tooling to keep the whole portfolio in view.
How Auditray supports website governance
Auditray is a website governance platform, developed and powered by Vardot, that brings security, accessibility and organizational standards into one process for the teams responsible for many websites. It follows the same rhythm this guide describes:
- Connect the portfolio. Each website and its ownership context in one shared view.
- Run consistent checks. Security, accessibility and organizational checks on a repeatable rhythm.
- Organize findings. Grouped by governance area and responsible team, so teams understand what needs attention and why.
- Support follow-through. Responsible teams, progress and evidence connected to the portfolio.
Auditray starts with a strong understanding of Drupal and extends to CMS-based, managed and custom-built websites. It connects to tools many teams already use, including Google Tag Manager, Google Analytics, Microsoft Clarity, Cloudflare, Semrush, Monsido, GitHub, GitLab, Bitbucket and Sentry.
Auditray does not replace security or accessibility specialists. It helps them and the teams responsible for each site find, organize and review issues.
FAQ
Questions, answered.
Who should own website governance in an organization
One governance lead, usually in digital, web or IT leadership, should own the process, and every website should have its own named owner. Security, accessibility and legal specialists decide what findings mean in their areas. A shared process without a lead tends to leave decisions waiting.
How often should websites be checked
Light checks, such as availability, certificates and known accessibility issues, can run continuously. Deeper reviews, such as a full accessibility audit or a penetration test, are usually periodic and tied to risk, regulation or major changes. Specialists should set the frequency for their own area.
What is the difference between website governance and web content governance
Web content governance covers editorial rules: who can publish, tone of voice, review and the content lifecycle. Website governance is broader. It covers the security, accessibility, standards and ownership of the websites themselves, and usually includes content governance as one part.
Is website governance only for large organizations
No. Any organization running several websites across different teams, platforms or vendors benefits from a shared process. The need grows with the number of sites, owners and vendors involved, and with the regulation that applies to the organization.
What is a website inventory
A website inventory is a current list of every website an organization runs, with its owner, platform, hosting, purpose and review status. It is the first step in website governance, because sites that are not on the list are not checked.
Does website governance replace website audits
No. An audit gives depth at a point in time, while continuous governance keeps every site in view between audits. Most organizations use both, with audits reserved for launches, redesigns and compliance milestones.
What does agentic website governance mean
Agentic website governance means moving from occasional manual review toward continuous, organized website checks that help responsible teams see what needs attention. Qualified people still decide on risk, remediation and compliance.
How can an agency govern many client websites
Agree a standard set of checks with each client, apply them to every client site on the same rhythm, route findings to the team responsible and keep a record you can share in client reviews. Inherited sites should join the same process from the start of the engagement.