Websites do not fail suddenly. They decay. A plugin goes un-updated, a backup job quietly stops, a certificate approaches expiry, a contact form breaks after a change and nobody notices for six weeks.
Each of those is small. Together they are how a working site becomes an emergency. This website maintenance checklist is built around the things that actually cause problems, not a list designed to look thorough.
Weekly — about fifteen minutes
Apply minor updates
Patch and minor releases for plugins, themes and core. These rarely break anything. Save major version jumps for the monthly slot where you can test properly.
If a changelog mentions a security fix, do not wait for the weekly slot. Apply it now.
Confirm backups ran
Not that backups are configured — that last night's actually completed. Backup jobs stop silently after plugin changes, host migrations and storage quota issues.
Check the site loads properly
Homepage, one key service or product page, and the contact form. Do it in a private browsing window so you are not seeing a cached or logged-in version.
Submit a test enquiry
Once a week, fill in your own contact form and confirm the email arrives. Broken forms are the most expensive silent failure there is — the site looks perfect while every enquiry disappears.
We have seen businesses lose months of leads to a form that stopped delivering after a routine plugin update. Nothing on the site looked wrong.
Monthly — about an hour
Apply major updates on staging
Copy the site to staging, apply major version updates, and test the pages that matter — including checkout if you sell online. Then push live outside peak hours.
Run a security scan
A server-side scan of files and database, not just a check of the public homepage. Compare against last month for unexplained file changes.
Review users
Check the administrator list. Remove accounts for people who have left, developers who finished a project, and agencies no longer engaged. Look for accounts you do not recognise at all.
Check speed
Run the site through a speed tool and compare with last month. Gradual slowdown usually means accumulating images and plugins. Sudden slowdown deserves investigation — sometimes it indicates a compromise.
Look for broken links
Internal links break when pages are renamed. External links rot as other sites reorganise. Both cost you a little credibility.
Check search performance
Open Google Search Console and look at three things: the Security Issues report, crawl errors, and whether impressions have dropped unexpectedly. An unexplained traffic drop is often the first visible sign of a problem.
Quarterly — about two hours
Test a restore
The single most skipped task, and the one that matters most on a bad day. Restore a backup to staging and confirm it actually works. An untested backup is a hope, not a plan.
Audit plugins
For each plugin: are we using it, when was it last updated by its author, and is there a lighter alternative? Delete anything unused — deactivated plugins still sit on the server and can still be exploited.
Clean the database
Old post revisions, spam comments, expired transients, and leftovers from plugins removed long ago. Back up first.
Check certificate expiry
Confirm the certificate is valid and auto-renewal is working. Automatic renewal fails more often than people expect after server changes.
Review content accuracy
Prices, opening hours, phone numbers, staff names, service descriptions. Outdated details on a live site cost trust and occasionally cause real disputes.
Confirm analytics still work
Tracking codes get removed by theme updates and migrations. Confirm data is still arriving before you rely on a report.
Annually
- Renew the domain, and check it is not close to expiry
- Review hosting against what the site now needs
- Update privacy policy, terms and cookie notice
- Confirm the PHP version is still supported
- Review the design and content honestly against competitors
Domain expiry deserves a specific mention. Losing a domain because a renewal email went to a former employee's inbox is more common than it should be, and recovery is expensive and sometimes impossible.
What happens if you skip it
Not theoretical. In roughly this order: outdated plugins get exploited, backups turn out to be broken when you need them, forms fail silently and cost you leads, the site slows and conversions drop, a certificate expires and visitors see a warning, and search rankings drift down without any obvious cause.
Every one of those is cheaper to prevent than to fix.
Being realistic about it
The honest problem with maintenance checklists is that almost nobody follows them. Not from carelessness — running a business means the website is the least urgent thing on the list until it is the most urgent.
So decide deliberately. Either put the weekly slot in the calendar as a recurring appointment and treat it as real work, or hand it to someone whose job it is. Both are fine. Assuming you will get round to it is the option that fails.
If you would rather hand it over
Our managed website plans cover this entire checklist — tested updates, off-server backups with verified restores, uptime and performance monitoring, security scanning, and small content changes when you need them.
If your main concern is security rather than general upkeep, our security monitoring service focuses there specifically.
Get in touch and tell us what state things are in. We will tell you honestly what needs attention first.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
