A monthly website maintenance checklist

Quick answer: what website maintenance includes

A website is not a brochure that you print once. It is software running on a server, connected to a domain, an email system and a handful of third-party services. Each of those parts changes over time: updates are released, certificates expire, content becomes outdated and visitors use new devices. Maintenance is the routine that keeps all of this working so that the site stays secure, fast, accurate and able to bring in inquiries.

This guide gives you a complete routine: what to check weekly, monthly, quarterly and yearly, how to do each task safely and what to do when something goes wrong. You can do much of it yourself in about an hour a month, hand it to a developer or combine both. The printable checklist near the end summarizes everything.

Why maintenance matters

Neglected sites rarely fail dramatically on the first day. They decay quietly until one day a form stops delivering, a page shows a security warning, the site is slow on phones or a plugin vulnerability is exploited. The cost of fixing a problem after it has been noticed by customers is almost always higher than the cost of routine checks.

Maintenance is also what keeps a site's return on investment positive. A new website is an asset, and an asset needs care to keep its value.

The rhythm: what to do and when

Not all tasks need the same frequency. Splitting them into four rhythms keeps the routine light: short checks often, deeper reviews rarely.

The times are estimates for a small site. A store, a membership site or a site with many plugins takes longer.

Before you start: set up the basics once

Some groundwork makes every later check faster. Do it once and keep it updated.

Make an inventory of everything the site depends on

Set up monitoring that does the watching for you

• An uptime monitor that checks the home page and the contact page every few minutes and alerts by email or text
• A reminder for domain and certificate expiry, even if auto-renew is on
• Search Console email alerts turned on
• Hosting notifications for resource limits and security events

Make a staging copy

A staging site is a private copy of the website where you can apply updates and test changes before they reach visitors. Many hosts offer one-click staging. If yours does not, ask your developer to set one up, or at least make a full backup before every update.

Keep a maintenance log

A short log of what was done, when and by whom makes problems easier to diagnose and lets you hand maintenance to someone else without losing context. A spreadsheet works.

Weekly checks (about 10 minutes)

These checks confirm that the site is available and that the most important business function, receiving inquiries, still works.

Submit the contact form

Fill in your own contact form with a test message and confirm that the email arrives in the right inbox, not in spam. Do the same for booking or quote forms. Forms can fail without any visible error when a mail setting changes, a plugin updates or a spam filter starts rejecting messages.

Check uptime and alerts

Look at the uptime monitor's report. Short outages happen, but repeated ones or slow responses deserve attention. Check hosting notices as well.

Clear spam

Remove spam comments, entries and fake sign-ups. If spam volume rises, strengthen the spam protection with a modern challenge, a honeypot field or rate limits.

Read recent inquiries

Skim the messages that came in. A sudden change in the number or type of inquiries can reveal a problem earlier than analytics.

Monthly checklist (about an hour)

The monthly routine is the heart of maintenance. Work through it in order, and note anything you cannot fix yourself for your developer.

1. Make a fresh backup, then apply updates

Updates fix bugs and security holes, so skipping them is risky. They can also break things, so the workflow matters.

1. Confirm that a recent full backup exists (files and database)
2. Review what updates are available: core platform, themes, plugins and any libraries
3. Read the change notes for major updates and for plugins that handle forms, payments or security
4. Apply updates on the staging copy first when you have one
5. Test the key paths: home page, a service page, the contact form, search, checkout if you sell
6. Apply the updates to the live site, one group at a time
7. Clear caches and test again
8. Note what changed in the maintenance log

Update order is usually: platform core, then plugins, then themes. If an update breaks something, restore from the backup or roll back that update, then investigate.

2. Check that backups actually run

Look at the backup log and confirm the latest backup exists, is complete and is stored away from the web server. A backup on the same server that fails is lost with it. Once a quarter, perform a real restore on staging.

3. Review security

• Review the list of users and remove people who no longer need access
• Check that administrators use strong, unique passwords and two-factor authentication
• Look at the security plugin or firewall report for blocked attacks and unusual logins
• Run a malware scan if your platform or host provides one
• Confirm that HTTPS works on every page and that the certificate is valid
• Check that no sensitive files, such as backups or configuration, are publicly accessible

4. Test forms, email and integrations

Beyond the weekly test, check every form, such as quote requests, newsletter signups and booking, and any integration that sends data to a CRM or a calendar. Confirm that confirmation messages reach the sender and that notifications reach you.

5. Check key pages on a phone and in two browsers

Open the home page, main services, contact page and, if you sell, the checkout on a real phone. Look for layout problems, broken buttons and tiny text. Repeat on a second browser. Updates and content changes can break layouts in ways that automated tests miss.

6. Measure speed

Run PageSpeed Insights on the home page and one important inner page. Compare with last month and with your baseline. A gradual decline usually points to new scripts, larger images or plugin bloat. See our guide on why small business websites load slowly for the usual causes.

7. Look for broken links and errors

Use Search Console's Pages report to see new errors, and a link checker to find broken internal and external links. Fix broken links on important pages, and set redirects for pages that moved.

8. Review analytics and conversions

Check that analytics still records traffic and that conversion events, such as form submissions and calls, still fire. A sudden zero is often a tracking break. Compare leads with last month and last year.

9. Update content that changes

Hours, holiday schedules, prices, staff, offers, locations and service lists should match reality. Check the pages where these details appear and your profile listings as well.

10. Review plugins and tools

List the plugins and third-party scripts in use. Remove what nobody uses, replace what is abandoned and check that licenses and subscriptions are active.

11. Check email authentication

If your site sends email, for example form notifications, confirm that SPF, DKIM and DMARC are set up for the sending domain. This improves deliverability and reduces the chance that messages land in spam.

12. Write the monthly note

Summarize what you did, what you found and what needs attention. It takes two minutes and saves hours later.

Quarterly checks (two to three hours)

Every three months, step back from the routine and review whether the site is still doing its job.

Restore drill

Restore the latest backup to a staging site and confirm that pages, images, forms and the admin area work. This is the only way to know that your backups are usable. Fix any gaps you find, such as missing media or an unreadable database dump.

SEO review

• Review Search Console: indexing, performance trends, manual actions and security issues
• Check the sitemap for errors and make sure it only lists live, indexable pages
• Review redirects and 404 errors for pages that still receive visits
• Look at queries that bring impressions without clicks and consider improving the titles and descriptions of those pages
• Check Core Web Vitals in the field data report
• Review internal links to your most important pages

Content review

List your main pages and check each for accuracy, clarity and a clear next step. Retire or update outdated articles. Add new questions from customers to the FAQ. If you publish regularly, review which articles bring visitors and which bring inquiries.

Permissions and accounts

Review who has access to the site, hosting, domain, analytics and other accounts. Remove former employees and contractors. Confirm that recovery emails and phone numbers are current and that more than one trusted person can regain access.

Conversion review

Look at the path from landing page to inquiry. Where do visitors leave? Are forms too long? Is the phone number visible on mobile? One small improvement per quarter adds up.

Yearly checks

Some tasks only come around once a year, which is exactly why they are forgotten. Put them in the calendar with several reminders.

Security in more depth

Most compromised small sites are not targeted individually. Automated tools scan the internet for known weaknesses and attack what they find. Basic hygiene stops most of this.

The basics that stop most attacks

• Keep the platform, themes and plugins updated
• Remove software you do not use, because it can still be exploited
• Use unique passwords stored in a password manager
• Turn on two-factor authentication for administrators and for the hosting and domain accounts
• Give each person the lowest level of access they need
• Limit login attempts and protect the login page
• Use HTTPS everywhere
• Back up regularly and keep copies off the server
• Choose hosting that provides isolation and security monitoring

If the site is hacked

1. Stay calm and do not delete everything. Take screenshots and note symptoms.
2. Contact your host and developer. Many hosts can isolate the site and provide logs.
3. Change passwords for the site, hosting, database and email, from a clean device.
4. Restore from a clean backup made before the compromise, if available, or clean the site with a professional.
5. Update everything and remove the vulnerability that let the attacker in.
6. Check Search Console for security warnings and request a review if flagged.
7. Review user accounts and remove any you do not recognize.
8. Write down what happened and add a check to prevent a repeat.

Backups in more depth

A backup strategy answers four questions: what is saved, how often, where it is stored and how you know it works.

A widely used rule is the 3-2-1 approach: keep three copies of your data, on two different types of storage, with one copy off-site. For a small website that can mean the live site, a backup at the host and a copy in separate cloud storage.

How to run a restore test

1. Create a clean staging environment
2. Restore the latest backup into it
3. Open the site and check pages, images, menus and forms
4. Log in to the admin area and open a few records
5. Note how long the restore took and what was missing
6. Document the steps so someone else can repeat them under pressure

Email deliverability for forms and notifications

Website forms that send email to you often fail because the message looks suspicious to mail providers. Three technical records tell receiving servers that your messages are legitimate.

• Send form notifications through a reliable mail service or SMTP account rather than the server's default mail function
• Use a sender address on your own domain and set the visitor's address as reply-to
• Test with several mailbox providers, including a free webmail address
• Keep a backup of submissions in the website database or a CRM, so an email failure does not lose leads

SEO maintenance

Search visibility needs steady upkeep. Search engines change, competitors publish and your own site evolves.

If you are not sure what to look at first, a technical SEO audit can provide a prioritized list of issues based on how search engines see your site.

Content maintenance

Outdated information costs trust. Visitors who find wrong hours, discontinued services or old prices assume the business is not paying attention.

Accessibility and legal spot checks

Accessibility and privacy are not one-off tasks. New content, plugins and tools can introduce problems. A short monthly spot check and a yearly review keep them under control.

• Tab through the home page and the main form with the keyboard only, and confirm that focus is visible and the order makes sense
• Check that new images have meaningful alternative text
• Check color contrast on any new buttons or banners
• Make sure new videos have captions or transcripts where appropriate
• Confirm that cookie and consent tools match the scripts that actually run
• Review whether new forms collect personal information that the privacy policy does not mention

This is general guidance and not legal advice. Ask a qualified professional about your obligations.

Extra care for stores, bookings and other complex sites

Sites that take money, bookings or personal accounts need a longer routine because a failure costs more and the data is more sensitive.

Payment and checkout safety

• Use a reputable payment provider that handles card data on its own secure pages
• Keep payment plugins updated and review their security notices
• Never store full card details on your own server
• Check refund and failed-payment flows, not only the successful path
• Keep a record of changes to checkout settings

Performance during busy periods

Before seasonal peaks such as holidays, sales or local events, run a speed test, check hosting limits and confirm that caching and backups are working. Peak traffic exposes weaknesses that quiet months hide.

A sample monthly maintenance report

A short report keeps everyone informed and creates a history you can refer to. The example below is fictional and only shows the format.

Reports like this make maintenance visible. They also make it easy to onboard a new person and to decide where to invest next.

What maintenance costs and how to budget time

Maintenance has two kinds of cost: recurring fees for services and the time of whoever does the work. Both are small compared with the cost of recovering from a failure.

A practical approach is to set an annual maintenance budget when the site launches, and to review it when the site changes substantially. Compare it with the value of the leads the site produces. A site that brings in even a handful of jobs a month justifies regular care.

Tools that make the routine easier

Doing it yourself or hiring help

Many owners can handle the weekly and parts of the monthly routine. Others prefer to delegate everything. The right split depends on your comfort with the admin area and your time.

What a maintenance plan should include

• A clear list of tasks done each month
• A defined time allowance for small changes
• A short report of what was done
• How and when to reach the person, and what counts as an emergency
• What is quoted separately, such as redesigns or new features
• Clear terms for starting and ending the arrangement

My website maintenance plan is built around that list: updates, checks, small content edits and fixes within an agreed monthly allowance, with a short note on what was done. Unused time does not carry over, larger work is quoted separately and terms are agreed in writing at the start. If you are not sure what your site needs, you can send a brief with its address.

The printable monthly checklist

Copy this into a document or your project tool and tick it off each month.

Before you begin

1. Open the maintenance log and read last month's note
2. Confirm a recent full backup exists

Updates and security

1. Apply platform, plugin and theme updates (staging first when possible)
2. Test the main pages and forms after updating
3. Review user accounts and remove anyone who no longer needs access
4. Confirm two-factor authentication on administrator accounts
5. Check security and malware reports
6. Confirm HTTPS and the certificate

Function and performance

1. Submit every form and confirm delivery
2. Open key pages on a phone and in two browsers
3. Run PageSpeed Insights on two key pages and record the results
4. Review broken links and Search Console errors
5. Check that analytics and conversion events work

Content and tools

1. Check hours, prices, contacts and offers
2. Review plugins and third-party scripts; remove unused ones
3. Check email authentication for the sending domain
4. Review upcoming renewals for domain, hosting and subscriptions

Wrap up

1. Write the monthly note in the maintenance log
2. Schedule anything you could not fix
3. Set the reminder for next month

Common maintenance mistakes

• Skipping updates for months because "everything works"
• Updating on the live site without a backup
• Never testing a restore
• Keeping unused plugins and old themes installed
• Sharing one administrator password between several people
• Leaving former employees and contractors with access
• Relying on form emails with no copy of submissions stored anywhere
• Forgetting domain and certificate renewals
• Letting the content age until it contradicts reality
• Making changes with no record of what was done
• Assuming the host handles everything
• Trying to fix a hacked site by only deleting visible spam