Website maintenance checklist: weekly, monthly and yearly

A website isn’t finished at launch. The software underneath it changes every few weeks, browsers change, Google changes, and so does your business. A site that nobody looks after doesn’t stay the same. It slowly gets slower, less secure and less accurate.

This checklist is the routine we’d give anyone looking after a business website, whether you do it yourself or hand it to someone else. It is written with WordPress in mind, because most of the sites in our portfolio run on it, but almost every item applies to any site.

What website maintenance includes

Every task on the list below falls under one of eight jobs:

• Backups: a recent copy of the site you can restore.
• Updates: the CMS, plugins, themes and server software kept current.
• Security: watching for attacks, removing old accounts, fixing weak spots.
• Speed: keeping pages quick to load, especially on phones.
• Content: making sure what the site says is still true.
• Search: checking that Google can find and index the pages that matter.
• Accessibility: keeping the site usable for people with disabilities.
• Renewals: the domain, the security certificate and the hosting.

Every week

• Check that backups ran. Automated backups fail quietly. Look at the date of the latest one rather than assuming it’s there.
• Run updates, after a backup. Update the CMS, plugins and theme. On a busy or complex site, try updates on a test copy first, then on the live site.
• Look at the site after updating. Open the home page, a key service or product page, and the contact page, on a phone and a desktop.
• Send a test enquiry. A contact form that stops sending is one of the costliest problems a site can have, and one of the least visible.
• Check uptime alerts. If the site went down, find out why.

Every month

• Test a restore. Restore a recent backup to a test copy of the site. Until you have restored a backup, you don’t know that it works.
• Review user accounts. Remove people who have left, and check that nobody has more access than they need.
• Run a security scan and read what it finds, rather than just clearing the warnings.
• Check speed. Run your key pages through PageSpeed Insights. Google’s Core Web Vitals targets are a main image or text block shown within 2.5 seconds, a response to taps and clicks within 200 milliseconds, and a layout that doesn’t jump around as the page loads.
• Check Search Console. The Page indexing report shows pages Google can’t index, and the Performance report shows whether search clicks are rising or falling.
• Fix broken links, inside the site and out to other sites.
• Remove plugins you don’t use. Every plugin is code someone has to keep updated. Our post on plugins for your WordPress site explains how to choose them.

Every quarter

• Read your main pages as a customer would. Are the team, services, locations, hours and contact details still right? Old staff photos and discontinued services cost trust.
• Check your calls to action. Do the buttons still lead to the right place, and does the offer still exist?
• Do an accessibility spot check. Move through a page with the keyboard alone, check that images have useful alt text, and check text contrast. WCAG 2.2 is the standard to measure against. Our guide to making your website accessible covers the basics.
• Review your legal pages. Privacy policy, cookie notice and terms should match the tools the site actually uses today.
• Check that analytics still tracks enquiries and sales correctly.

Every year

• Renew the domain, and check it is registered in your company’s name with a current email address. A lapsed domain can take the site and your email down with it.
• Check the security certificate renews automatically. An expired certificate puts a warning in front of every visitor.
• Review hosting. Is the server software, such as the PHP version on a WordPress site, still supported? Is the plan still right for your traffic?
• Change passwords for hosting, the CMS admin and the domain registrar, and turn on two-step sign-in where it is offered.
• Audit the whole site. Which pages bring visitors and enquiries, which are out of date, and which should go? Our guide to auditing your own website walks through it.
• Decide if the site still fits the business. If the list of fixes keeps growing, it may be time to plan a redesign. Our website redesign project plan shows where to start.

WordPress sites need a few extra checks

WordPress has a routine of its own on top of the list above.

• Minor updates may already be automatic. Since version 3.7, WordPress can apply minor and security releases in the background. Major releases still need someone to click “Update”, as the WordPress update guide explains.
• Back up before every update. WordPress’s own backup guide says to back up both the database and the files, weekly for smaller sites and daily for busy ones. It also suggests keeping several recent backups in different places.
• Watch plugin updates closely. Most WordPress problems start with a plugin that is out of date, abandoned by its developer, or clashes with another one.
• Keep the theme up to date too, including any child theme or custom theme your developer built.

Doing it yourself, or handing it off

A small, simple site can be maintained by someone on your team with this checklist and an hour or two set aside. It gets harder when the site has many plugins, custom features, an online store or a lot of traffic, because an update can break something that matters.

If you hand maintenance to a provider, ask:

• How often do you back up, where are the backups kept, and how quickly can you restore one?
• How often do you run updates, and do you test them before they go live?
• What do you monitor, and who gets told when something goes wrong?
• Are content edits included, or charged separately?
• Will I get a report of what was done each month?

The answers tell you more than the price does.

Questions we hear

What does website maintenance include?

Backups, updates, security checks, speed checks, content reviews, search checks, accessibility checks and renewals. The routine above lists each task and how often to do it.

How often should a website be updated?

Software updates should be checked weekly. Content should be reviewed at least every quarter, and the whole site once a year.

What affects the cost of website maintenance?

The number of plugins and custom features, whether the site is an online store, how much traffic it gets, how often updates are tested before going live, and whether content edits are included. A simple brochure site needs less than a busy store with dozens of plugins.

Why does a website need maintenance at all?

Because the software it runs on keeps changing, and out-of-date plugins are a common way sites break or get hacked. Our older post on the importance of website maintenance explains the reasons in more depth.

Want someone to maintain your site?

We back up, monitor and update websites for businesses in Chicago and across the US. See what our website maintenance covers, or configure your website and get a quote.