Should a nonprofit or charity publish an llms.txt file?

Yes, for a narrow and specific job: making the mission, the programs and the official impact numbers the easiest thing for an assistant to quote. The failure mode on a charity domain is not silence — it is a fluent answer built from a third-party summary, a fundraising aggregator or an old press release, including numbers you have since restated. In our October 13, 2026 check of 67 nonprofit, charity, foundation and NGO domains, only two organizations served a real file: wri.org and conservation.org. The second job the file does is disambiguation, which matters more here than on a commercial site: WRI's own file states in writing that it is a research institution, not an advocacy organization, and names its sub-brands so a model stops treating Global Forest Watch or GHG Protocol as unrelated sites.

What should never appear in a nonprofit's llms.txt file?

Anything that identifies a person or sits behind a login. Keep out donor names, gift amounts and giving-history pages, member and volunteer records, event attendee or participant lists, grant application portals and reviewer dashboards, beneficiary stories that carry identifying detail, internal safeguarding and eligibility policies, board minutes, and unpublished financials. The test is the same one you would apply to an annual report cover: if a stranger cannot read the page, it cannot be listed in a public index. This is the disclosure half of the job, and the general exclusion checklist plus the two grep scans are worth running before you ship.

Does llms.txt replace robots.txt or the annual report?

No — the three do different jobs. The annual report is your audited statement; llms.txt is a curated index that points at it and at the pages you want quoted. Permissions are a separate layer that llms.txt does not touch: in the same check we parsed twelve nonprofit robots.txt files and only one, eff.org, named any AI crawler token at all (it names anthropic-ai, CCBot, ClaudeBot, Google-Extended and GPTBot). Eleven named none. If your board has a position on AI crawling, that position belongs in robots.txt and in your training-data terms, not in the index file — the index only decides what a reader is pointed toward.

Nonprofit · October 2026

llms.txt for Nonprofits and Charities

A charity domain is the one place where the number an assistant quotes back — meals served, acres protected, grants awarded — is the same number your board signs off on. Here is what 67 nonprofit organizations serve today, and the structure worth publishing instead.

What 67 Nonprofit Domains Serve Today

We fetched /llms.txt from this server on October 13, 2026 with a generic user agent, following redirects, across 67 domains: international relief charities, environmental and conservation groups, foundations and grantmakers, health and animal organizations, civic and youth groups, think tanks, and open-source or technology nonprofits. Two served a real file. That is 3% of the sample — lower than our government check, and low even for a vertical where most domains answer a request with a marketing page.

Response	Count	Examples
`200` with a real Markdown file	2	wri.org (10.3 KB), conservation.org (2.6 KB)
`403` (edge block)	12	redcross.org, savethechildren.org, oxfam.org, nrdc.org, sierraclub.org, candid.org, kiva.org, nami.org, plannedparenthood.org, goodwill.org, rand.org, prosperglobal.org (where mercycorps.org now redirects)
`404`	45	unicef.org, habitat.org, feedingamerica.org, gatesfoundation.org, macfound.org, mellon.org, eff.org, apache.org, python.org, drupal.org, worldwildlife.org, givewell.org and 33 more
`200`, but no file behind it	5	khanacademy.org, humanesociety.org and doctorswithoutborders.org each return a byte-identical 3,038-byte “Client Challenge” HTML page; techsoup.org returns a 212-byte `noindex` stub; volunteermatch.org redirects to idealist.org/volunteermatch
`500`	1	amnesty.org
TLS handshake failed from our client	2	girlscouts.org, globalgiving.org — the certificate could not be verified by our client, so these two are unclassified rather than missing

Read the 403 rows before the 404 rows, because they describe opposite problems. A 404 means nobody has written the file. A 403 means something answered the path and then refused a generic client — redcross.org returns a 403 “Access Denied” body, nrdc.org returns a Cloudflare “Just a moment” challenge page, and kiva.org and plannedparenthood.org return a 118-byte forbidden stub. Those domains have bot rules in front of every path, which is a legitimate choice; the cost is that an admitted crawler and a refused one get different answers, so a validator run from a laptop proves nothing about what GPTBot can fetch.

The Only Two Files in the Set

Both files that exist belong to conservation organizations, and they sit at opposite ends of the size range — which makes them a useful pair rather than a curiosity.

	wri.org	conservation.org
Content-Type	`text/markdown; charset=utf-8`	`text/plain; charset=utf-8`
Size	10,336 bytes / 106 lines	2,619 bytes / 20 lines
H2 sections	9 (About, Focus Areas, Research, Data and Tools, Initiatives, more)	3 (Priorities, About and Operations, Optional)
Linked URLs	54	11
What it does well	Names sub-brands with their own domains (Global Forest Watch, GHG Protocol) so they stop reading as separate sites, and states outright that WRI is a research institution, not an advocacy organization	Every description is written as a task for the reader — “Focuses on natural climate solutions”, “Directory of active and completed global conservation projects”, “Portal for support and giving programs”

The 2.6 KB version is the one most organizations should copy. Conservation International's file lists eleven links in twenty lines, and each description names the job the page does rather than echoing its title. The description-writing guide covers that slot in detail; the short version is that the text after each colon is the part an engine is most likely to lift verbatim, so it should answer a question, not restate a heading.

WRI's file earns its extra size with one move worth stealing: the disambiguation block. A large nonprofit is usually several entities in a search engine's mind — a research arm, a certification programme, a data platform on its own domain. Stating the relationship in the index is cheaper than hoping a model infers it from your About page.

Why Zero Files Is Sometimes Deliberate

Not every missing file is neglect. Several organizations in this sample run an active fundraising funnel, and a page that lists donation routes in plain Markdown is also a page that hands a scraper the exact structure of that funnel. Others are in the middle of a rebrand — mercycorps.org now redirects to prosperglobal.org, and pewtrusts.org to pew.org — which is precisely when someone decides to shelve a documentation task until the dust settles. The honest position is that a file is worth writing when you have pages you would rather an assistant quote than paraphrase, and your organization has at least one of those: the programme pages.

The Seven Buckets a Nonprofit File Needs

Mission and scope. One sentence on what the organization does, one on where it operates, one on when it was founded. This is the block most likely to be quoted.
Programmes. One link per programme area, described by the problem it addresses. This is the section that replaces guessing.
Impact and reporting. Links to the annual report, audited financials, impact dashboards and evaluation methodology — never the numbers themselves, which change.
Ways to give. Donate, monthly giving, legacy and planned gifts, corporate partnerships, matching gifts, in-kind. Link the pages; do not transcribe amounts or thresholds.
Get involved. Volunteering, local chapters, events and campaigns, each linked rather than listed by date.
Press and knowledge. Newsroom, media contacts, research library, policy positions — the pages a journalist or an assistant should cite.
Accountability. Governance, leadership, financial transparency and complaints process. Nonprofits are trusted more when this is easy to find, and an AI answer built from it is a better answer.

What Must Never Appear

A charity domain holds data about people who never expected to be indexed: donors, members, volunteers, beneficiaries. Keep out donor names and giving history, member and volunteer records, participant or attendee lists, grant application portals and reviewer dashboards, beneficiary stories carrying identifying detail, internal safeguarding and eligibility policies, and unpublished financials. The exclusion checklist covers the general categories plus the two grep scans that catch a leaked staging host or signed URL before you ship.

Two rules are specific to nonprofits. First, do not put totals in the file — “12 million meals in 2025” becomes a wrong answer the moment the fiscal year rolls over; link the page that carries the current number instead. Second, do not use the file to argue. An index that reads like campaign copy is less quotable than one that reads like a directory, and WRI's explicit note that it is not an advocacy organization is the clearest example in the sample of a file drawing that line for itself.

robots.txt Is Still the Permission Layer

We also parsed the robots.txt of twelve organizations in the sample. Exactly one — eff.org — names any AI crawler token at all, listing anthropic-ai, CCBot, ClaudeBot, Google-Extended and GPTBot; the other eleven name none. Many grant broad access by default. If your board has taken a position on AI training or on AI answers, that position lives in robots.txt, in Content-Signal headers and in your terms — llms.txt carries no permissions and blocks nothing. The two files answer different questions, and a nonprofit is the site type where that distinction is most often written into policy.

A Copyable Skeleton

# Riverside Food Bank

> Riverside Food Bank is a regional hunger-relief nonprofit founded in 1994. It works
> through 120 partner pantries across six counties and publishes its audited impact
> reporting each year. Questions about eligibility or distribution hours should be
> answered from the programme pages linked below, not from third-party directories.

## Programmes
- [Find food](https://example.org/find-food): Postcode search for the nearest partner pantry, with hours and the documents to bring.
- [Partner pantries](https://example.org/partners): How a pantry joins the network, what it receives and what it must report.
- [Nutrition programmes](https://example.org/nutrition): Children's summer meals and senior grocery delivery, and where each runs.

## Impact and reporting
- [Annual report](https://example.org/about/annual-report): Audited financials and programme outcomes, by fiscal year.
- [Impact dashboard](https://example.org/impact): Current distribution figures, refreshed monthly.

## Ways to give
- [Donate](https://example.org/donate): One-time and recurring gifts, with the current cost-per-meal figure.
- [Corporate partnerships](https://example.org/partners/corporate): Workplace giving, food drives and in-kind donations.

## Get involved
- [Volunteer](https://example.org/volunteer): Warehouse shifts, sorting sessions and driver routes.
- [Events](https://example.org/events): Fundraising and food-drive calendar.

## Press and knowledge
- [Newsroom](https://example.org/news): Press releases, spokespeople and media contacts.
- [Research](https://example.org/research): Food-insecurity research and methodology notes.

## Optional
- [Governance](https://example.org/about/governance): Board, leadership, transparency and complaints process.

Verify Delivery, Not Just Format

Nonprofit sites usually run on a CMS behind a CDN, so the failure that bites is delivery: a catch-all route answering text/html, a redirect chain to a locale prefix, or a WAF that treats every non-browser client the same. Three commands settle it, and the second one is the only test that tells you what an admitted crawler actually gets.

# 1. Is it a file, or is the CMS answering with HTML?
curl -sI https://example.org/llms.txt | grep -iE "^(HTTP|content-type|location)"
curl -s https://example.org/llms.txt | head -1    # should be: # Riverside Food Bank

# 2. Does a named AI crawler get the same answer you do? (403 to you may be 200 for them)
curl -s -o /dev/null -w "%{http_code} %{content_type} %{size_download}\n" \
  -A "OAI-SearchBot" https://example.org/llms.txt

# 3. Every listed URL should answer 200 without a redirect chain
curl -s https://example.org/llms.txt | grep -oE "https://[^)]+" | while read u; do
  printf "%s %s\n" "$(curl -s -o /dev/null -w '%{http_code}' -L "$u")" "$u"
done | grep -v "^200"

Then run the draft through the llms.txt checker for structure and the summary slot, and build the first version from your sitemap with the generator. As with every vertical, the crawler gets you a link list; deciding which programme pages an assistant is allowed to answer from is the actual work.

Status codes, content types, byte sizes, file contents and robots.txt tokens referenced were captured from this server on October 13, 2026 using a generic user agent with redirect following. Edge bot rules and published files change without notice, so re-check your own paths rather than treating this table as current configuration for any organization named. A 403, a 404 or a 200 tells you nothing about the body until you read it.