Most business websites do not break overnight. They decay quietly: an outdated plugin here, a contact form that silently stopped sending emails there, a backup that has not actually been tested in eleven months. By the time someone notices, you are paying for an emergency fix instead of a bit of routine care.
This website maintenance checklist is built for the person who owns the business, not the person who writes the code. Every task below includes what it is, how to do it, and roughly how long it takes so you can block the time in your calendar or hand the list to your web agency and know exactly what you are paying for. victorious.com published something useful on the subject.
Total time for the full monthly routine: about 2 to 3 hours for a typical small business site (10 to 40 pages, WordPress or a similar CMS).
How to use this checklist
- Pick one fixed day each month, for example the first Tuesday. Consistency beats perfection.
- Work top to bottom. The order matters: backup first, updates second, testing third.
- Keep a simple log (a spreadsheet is fine) with the date, what you updated and anything odd you noticed. That log is gold when something breaks later.
- If a task takes you more than double the estimated time, that is a signal to outsource it. More on that at the end.
Quick time budget at a glance
| Block | Tasks | Time |
|---|---|---|
| Protect | Backup, restore test, security scan, uptime, SSL | 45 min |
| Update | CMS core, plugins, themes, post-update check | 40 min |
| Test | Forms, links, mobile, speed | 45 min |
| Review | Search Console, analytics, content refresh, housekeeping | 40 min |
The 14-task monthly website maintenance checklist
1. Take a full backup before you touch anything (10 minutes)
A backup taken after an update is useless if the update is what broke the site. Always start here.
- Run a manual full backup (files + database) from your backup plugin or hosting panel.
- Confirm the backup is stored off the server: cloud storage, not just the same hosting account.
- Check that you have at least 30 days of restore points available.
Red flag: your host says “we do daily backups” but nobody can tell you how far back they go or how long a restore takes. Originally covered on https://pixelcarve.com.
2. Verify a backup actually restores (20 minutes, once per quarter)
This is the task almost everyone skips, and it is the one that saves businesses. A backup you have never restored is a hope, not a plan.
- Restore the most recent backup to a staging site or a local environment.
- Load the homepage, one interior page and the checkout or contact form.
- Write the date of the successful test in your maintenance log.
Do this every three months at minimum. In the other months, simply confirm the backup files exist and are not zero bytes in size.
3. Update your CMS core, plugins and themes (20 minutes)
Outdated software is the single most common way small business sites get hacked. Attackers scan for known vulnerabilities in old plugin versions, they do not target you personally.
- Update on a staging copy first if you have one, especially for ecommerce or booking sites.
- Update plugins one batch at a time, not all at once, so you can identify the culprit if something breaks.
- Update the CMS core (WordPress, Drupal, Joomla, Shopify apps) after plugins are stable.
- Note any plugin that has not received an update from its developer in over 12 months. Abandoned plugins are a liability and should be replaced.
Also worth doing: check your PHP version. Sites running an unsupported PHP release are slower and no longer receive security patches. Your host can usually bump this in one click, but test afterwards.
4. Run a post-update visual and functional check (10 minutes)
Updates break layouts more often than they break the whole site, and a broken layout can sit there for weeks unnoticed.
- Load your homepage, top 3 service pages, a blog post, the contact page and the cart or booking page.
- Look for shifted images, missing icons, overlapping text and disappearing buttons.
- Hard refresh (Ctrl+F5 or Cmd+Shift+R) and clear the site cache first so you are not looking at an old version.
5. Test every form on the site (15 minutes)
Silent form failure is the most expensive maintenance problem there is, because you never see the leads you did not receive. Email deliverability rules keep tightening, and forms that worked last year can quietly stop landing in inboxes.
- Submit each form with a real email address you can check.
- Confirm the notification arrives, and check the spam folder too.
- Verify the auto-reply to the customer goes out and reads correctly.
- Check that submissions are also stored in the database or CRM as a backup.
- Test the thank-you page and any conversion tracking attached to it.
6. Scan for broken links and 404 errors (15 minutes)
Broken links frustrate visitors and waste the crawl budget search engines allocate to your site.
- Run a free crawler or link checker across the whole site.
- Fix internal broken links directly, they are usually a typo or a page you renamed.
- For external links to pages that no longer exist, either update the destination or remove the link.
- Set up 301 redirects for any deleted pages that still get traffic.
7. Check security: scans, logins and file integrity (15 minutes)
- Run a malware scan with your security plugin or your host’s scanner.
- Review the user list. Remove ex-employees, ex-contractors and any account you do not recognise.
- Confirm every admin account uses two-factor authentication.
- Look at failed login attempts. A sudden spike means it is time for login rate limiting or an IP block.
- Make sure nobody is using “admin” as a username or a password you have used elsewhere.
8. Confirm uptime, SSL and domain status (5 minutes)
- Check your uptime monitor report for the past month. Anything under 99.9% deserves a conversation with your host.
- Verify the SSL certificate is valid and auto-renewing. An expired certificate throws a browser warning that kills traffic instantly.
- Check the domain expiry date and that auto-renew is on with a valid card. Losing a domain is far worse than losing a site.
9. Run a speed and Core Web Vitals audit (15 minutes)
Speed affects both conversions and rankings, and it drifts downwards over time as you add images, tracking scripts and plugins. This is exactly the kind of detail an experienced web design team gets right on every build.
- Test your homepage plus your two highest-value pages on mobile, not just desktop.
- Compare the numbers to last month’s log. The trend matters more than the score.
- Quick wins: compress oversized images, switch to modern image formats, remove tracking scripts you no longer use, enable caching.
| Metric | Target | Common cause when it fails |
|---|---|---|
| Largest Contentful Paint | Under 2.5s | Huge hero image, slow hosting |
| Interaction to Next Paint | Under 200ms | Too many scripts, heavy page builders |
| Cumulative Layout Shift | Under 0.1 | Images without dimensions, late-loading banners |
10. Review Google Search Console (10 minutes)
- Check the Pages report for newly excluded or non-indexed URLs.
- Look at manual actions and security issues. These should always be empty.
- Skim the Performance report for pages that lost impressions or clicks month over month.
- Review Core Web Vitals and mobile usability warnings for real-world field data.
11. Review analytics for anything unusual (10 minutes)
You are not doing deep analysis here, you are looking for anomalies.
- Did traffic drop off a cliff on a specific date? Cross-reference with your update log.
- Did a top landing page suddenly lose all its conversions? Test that page’s form.
- Is tracking still firing at all? A site migration or consent banner change can break it silently.
12. Refresh outdated content (20 minutes)
Stale content erodes trust faster than a slightly dated design. Each month, pick two or three pages and bring them current.
- Prices, packages and service descriptions.
- Team photos, bios and roles after staff changes.
- Opening hours, holiday closures and seasonal notices.
- Copyright year in the footer.
- Blog posts with year references or statistics that are no longer accurate.
- Testimonials, case studies and portfolio pieces, add the newest ones.
13. Do a mobile and cross-browser spot check (10 minutes)
Most of your visitors are on a phone. Test like one.
- Open the site on a real phone, not just a desktop browser resized.
- Tap the phone number, the map link and the main call to action button.
- Check the mobile menu opens and closes properly.
- Try one alternative browser, for example Safari if you normally use Chrome.
14. Housekeeping: database, media and admin clutter (10 minutes)
- Delete spam comments and pending junk registrations.
- Clear old post revisions and transients if your site has thousands of them.
- Remove deactivated plugins and unused themes entirely. Deactivated does not mean safe, the code is still on the server.
- Delete orphaned media files that are not attached to any page.
Weekly quick checks (5 minutes each week)
| Check | Why it matters |
|---|---|
| Homepage loads correctly | Catches hosting and cache problems within days, not weeks |
| Send one test enquiry | Protects your lead flow |
| Critical security updates | Some patches cannot wait until your monthly slot |
| Uptime alert inbox | Confirms monitoring is still active |
Quarterly and annual tasks
| Frequency | Task | Time |
|---|---|---|
| Quarterly | Full backup restore test on staging | 30 min |
| Quarterly | Review user roles and third-party integrations | 20 min |
| Quarterly | Accessibility spot check (contrast, alt text, keyboard navigation) | 45 min |
| Annually | Domain, hosting and licence renewals audit | 30 min |
| Annually | Privacy policy, cookie banner and terms review | 1 hour |
| Annually | Full content and design audit against business goals | 3 to 4 hours |
| Annually | Review hosting plan against current traffic | 30 min |
Printable summary: the 14 monthly tasks
| # | Task | Time | DIY difficulty |
|---|---|---|---|
| 1 | Full backup before changes | 10 min | Easy |
| 2 | Backup restore verification | 20 min | Hard |
| 3 | CMS, plugin and theme updates | 20 min | Medium |
| 4 | Post-update visual check | 10 min | Easy |
| 5 | Test all forms end to end | 15 min | Easy |
| 6 | Broken link and 404 scan | 15 min | Easy |
| 7 | Security scan and user review | 15 min | Medium |
| 8 | Uptime, SSL and domain status | 5 min | Easy |
| 9 | Speed and Core Web Vitals audit | 15 min | Medium |
| 10 | Search Console review | 10 min | Medium |
| 11 | Analytics anomaly check | 10 min | Easy |
| 12 | Content refresh | 20 min | Easy |
| 13 | Mobile and browser spot check | 10 min | Easy |
| 14 | Database and media housekeeping | 10 min | Medium |
7 clear signs it is time to outsource website maintenance
Running this checklist yourself is completely realistic for a simple brochure site. It stops being realistic at a certain point. Here is how to know you have crossed that line:
- You have skipped it two months in a row. The checklist that does not get done has zero value, no matter how good it is.
- Your site generates revenue directly. Ecommerce, bookings and lead generation sites lose money by the hour when they go down. The cost of maintenance is smaller than the cost of one bad afternoon.
- You are scared to click “update”. If updates are queued up because last time something broke, you are accumulating security risk to avoid a task that takes 20 minutes with a staging environment.
- You have never tested a restore. Backup restoration is the one task on this list where amateur hour has permanent consequences.
- Something already broke and you could not fix it. One white screen of death is a lesson. Two is a decision you keep postponing.
- You run custom code or complex integrations. Custom themes, payment gateways, CRM syncs and membership systems need someone who can read the error logs.
- Your time is worth more elsewhere. Three hours a month at your effective hourly rate is often more than a maintenance retainer costs.
DIY versus a maintenance plan
| Do it yourself | Agency maintenance plan | |
|---|---|---|
| Monthly time cost | 2 to 3 hours of your time | 15 minutes reading the report |
| Staging environment | Usually not used | Standard practice |
| Response when it breaks | Search forums, hope for the best | Defined response time, rollback ready |
| Best suited to | Simple brochure sites, low risk | Revenue-generating and complex sites |
What to demand from any maintenance provider
- A written list of exactly which tasks are included and how often.
- A monthly report you can actually read, not a raw plugin log.
- Off-site backups with a stated retention period and a documented restore test.
- Updates applied on staging before production for anything business critical.
- A clear answer to “who do I call at 9pm on a Saturday if the site is down?”
- Full ownership of your domain, hosting and site files. You should never be locked out of your own property.
Frequently asked questions
What maintenance does a website need?
At minimum: software updates for the CMS, plugins and themes, verified off-site backups, security scanning, broken link fixes, form testing, speed monitoring and periodic content refreshes. Hosting, domain and SSL renewals sit alongside these as recurring administrative tasks. This reference is the one worth keeping handy.
How often should website maintenance be done?
Security patches: as soon as they are released. Quick health checks: weekly. The full checklist above: monthly. Deeper work such as restore tests and accessibility audits: quarterly. Strategic reviews of design, content and hosting: annually.
How long does monthly website maintenance take?
Roughly 2 to 3 hours for a small business site with fewer than 40 pages. Ecommerce sites, membership platforms and sites with heavy integrations typically need 4 to 8 hours per month because every update requires testing on staging first.
How much does website maintenance cost per month?
It varies widely by site complexity and the level of support included. The useful way to evaluate a quote is not the headline price but the task list behind it: does it include off-site backups, staging updates, security monitoring, uptime alerts, content edits and a response guarantee? A cheap plan that only clicks the update button is not maintenance.
Can I do website maintenance myself without technical skills?
Yes for most of this list. Backups, form testing, link scans, content refreshes and mobile checks need no coding at all. The parts that genuinely benefit from experience are restore testing, staging updates, resolving plugin conflicts and diagnosing speed problems.
What happens if I never maintain my website?
In order: forms stop delivering leads, speed degrades, broken links accumulate, rankings slip, an outdated plugin gets exploited, and eventually you pay for an emergency rebuild or a malware cleanup. Every one of those outcomes costs more than the routine work would have.
Start with the next 30 minutes
You do not need to run all 14 tasks today. Do three: take a backup, submit a test enquiry through your contact form, and check that your domain auto-renew is switched on. Those three take half an hour and cover the failures that hurt the most.
Then put the full website maintenance checklist in your calendar as a recurring monthly appointment. If after two months it is still sitting there untouched, that is your answer about whether to hand it over.
Want this handled for you? At Zach’s Web Designs we run this exact checklist on client sites every month, with off-site backups, staging updates and a plain-English report so you always know what was done. Get in touch for a free review of your current site health.