Website maintenance checklist: what to check weekly, monthly and yearly
A simple routine to keep your business website fast, secure and accurate, split into weekly, monthly, quarterly and yearly jobs.
ToBrand team · 6 min read
A website is not a brochure you print once. It runs on software that needs updates, it depends on a domain and hosting that need renewing, and it carries prices, hours and phone numbers that go out of date. Most website problems small businesses face, from a hacked homepage to a contact form that silently stopped working months ago, come from nobody checking. This checklist turns maintenance into a short routine you or your team can follow.
Why maintenance matters more than people expect
Three things go wrong when a site is left alone:
- Security: content management systems such as WordPress, and their plugins and themes, release updates that close security holes. Old versions are a common way in for attackers, who scan the web automatically for them.
- Broken features: forms, booking widgets, payment buttons and maps rely on outside services that change. When one breaks, enquiries stop and you may not notice.
- Stale information: an old price, a closed branch or last year's festival offer makes customers doubt everything else on the page.
None of this needs to take long. The trick is doing small checks regularly instead of a big rescue once things fail.
Weekly (10 minutes)
- Open your site on your phone. Look at the homepage and your most important service page. Does everything load? Do images show? Most customers will see the mobile version, so this is the one to check.
- Send a test enquiry through your contact form and make sure it arrives in the inbox, not spam. Do the same for your WhatsApp or call button.
- Check that backups ran. Most hosts and backup plugins show the date of the last backup. If it's older than your schedule, find out why.
- Glance at your Google Business Profile and reply to any new reviews or questions.
Monthly (30 to 60 minutes)
- Apply updates. Update your CMS, plugins and theme. Take a backup first, update, then click through the main pages and test the form. If something breaks, restore the backup and investigate. On busy e-commerce sites, test updates on a staging copy first.
- Remove what you don't use. Deactivated plugins and old themes still contain code. Delete them rather than leaving them switched off.
- Review user accounts. Remove logins for former staff or freelancers. Make sure every admin account has a strong password and two-step verification where your platform supports it.
- Check Google Search Console. Look at the Pages report for new errors and the Performance report for sudden drops. Our beginner's guide to Search Console shows where to look.
- Look for broken links. A free link checker will find links to pages that no longer exist, both on your site and to other sites.
- Update offers and notices. Remove expired promotions. Add holiday hours for Diwali, Tết, Thanksgiving or whatever closures are coming up.
Quarterly (one to two hours)
- Test a restore. A backup you have never restored is a hope, not a plan. Ask your host or developer to restore a recent backup to a test location and confirm the site works.
- Check speed. Run your key pages through PageSpeed Insights and compare with last quarter. New large images, chat widgets and tracking scripts slowly add weight. Our guide to website speed and Core Web Vitals explains what the numbers mean.
- Read every important page. Services, prices, team, locations, FAQs. Is it all still true? Have you added a service that isn't on the site?
- Review your forms and data. Where do form submissions go? Are old submissions stored on the website that you no longer need? Delete personal data you don't need to keep.
- Check your SSL certificate. Most hosts renew it automatically, but confirm the padlock shows and the certificate isn't close to expiry.
Yearly
- Renewals: note the renewal dates for your domain, hosting, SSL (if paid), email, premium plugins and any themes. Put them in a calendar with a reminder a month ahead. An expired domain takes down your website and email together.
- Ownership check: confirm the domain and hosting accounts are in the business's name with an email the owner controls.
- Legal pages: review your privacy policy, terms and cookie notice, especially if you've added analytics, ads or new forms. If you collect data from customers in different countries, take advice on what applies.
- A fresh look: compare your site with two or three competitors. Is your message clearer? Is your site easier to use on a phone? If the honest answer is no, it may be time to plan a redesign rather than more patches.
Backups: the one thing not to skip
If you only do one item on this list, make it backups. A good backup routine has three features:
- Automatic: it runs on a schedule without anyone remembering. Daily is sensible for sites that change often, such as shops or blogs; weekly may be enough for a small brochure site.
- Stored elsewhere: at least one copy should sit outside your hosting account, for example in cloud storage. If the host has a problem, a backup on the same server goes with it.
- Kept for a while: keep several past versions, so that if a problem went unnoticed for two weeks you can go back further than yesterday.
Signs your site needs attention now
- Your browser shows a "Not secure" warning.
- Google shows "This site may be hacked" under your listing, or Search Console reports a security issue.
- Enquiries have dropped suddenly with no other explanation.
- Pages show odd links, pop-ups or text in a language you didn't add.
- Your admin login or hosting control panel shows warnings you don't understand.
If you see any of these, don't ignore them. Change your passwords, contact your host, and get someone experienced to look at it the same week.
Who should do the maintenance?
Many owners handle the weekly checks themselves and hand the technical updates to their developer or an agency. That split works well. What matters is that each task has a named person and a date. Write the list down, share it, and tick it off. A simple shared spreadsheet with the task, owner, frequency and last-done date is enough for most small businesses.
If your site was built on a simple, static setup without plugins, there is less to update, but forms, content, backups and renewals still need checking. To see how your site stands today, run our free website check. And if you would rather hand the routine over, ToBrand looks after websites for businesses in India, the USA and Vietnam; tell us about your site and we'll suggest a plan that fits.
Was this guide helpful?
