How should I build and maintain a small research organisation website on a limited budget?

A conventional CMS is probably enough; I would not begin with a custom cloud stack, separate database or bespoke backend. A managed WordPress installation with a well-supported custom-fields/content-type extension can cover institutional pages, publications, metadata, categories, search and downloadable files. Forms can be handled by a reputable form service or established extension with approval workflows.

The important part is restraint: use as few extensions as possible, choose actively maintained ones, keep everything updated, enable automated backups and use managed hosting rather than the cheapest shared plan. A modest managed plan is usually a better investment than spending weeks designing infrastructure you’ll later have to secure and troubleshoot.

Make the project maintainable by someone other than you. A widely used CMS has a major advantage because future volunteers, contractors or staff are more likely to understand it. Start with a proof of concept that you can operate yourself, then an MVP that another person could manage without reading custom code.

A sensible sequence would be: define the content types and user journeys, build a small publications catalogue, test adding and searching several dozen records, then add articles and opportunities. Add applications and file uploads only after you’ve confirmed the security and review process. Avoid headless or custom architecture unless a specific requirement genuinely cannot be met with the CMS.

Start with the publication data model rather than the platform. Write down the fields one publication needs—title, authors, abstract, keywords, topic, publication date, file, and possibly a DOI. Then compare platforms based on whether you can create a dedicated publication content type with those fields and add new topics yourself without coding.

That requirement is more useful than asking which CMS is best overall. Many systems can support it, though some need an extension. Forms involving uploads and a review queue are more replaceable, so I’d consider keeping those on a separate specialist service rather than making them a core part of the website.

This is bigger than a simple website, especially once you include uploaded documents, internal review, privacy obligations, certificates and identity-related workflows. A CMS can handle the public content, but submissions need careful attention to access control, data retention, backups, malware scanning and applicable privacy laws.

For a solo operator, I would either pay for a small amount of professional setup and security advice or reduce the first version to public information and structured publications. Build the more sensitive workflows only after you have tested the basic site and understand how you’ll maintain it.