Most websites don’t fail dramatically. They drift. A plugin falls behind, a backup job quietly stops, the contact form breaks after an update, and nobody notices until a customer asks why their enquiry went unanswered. A website maintenance checklist exists to catch that drift while it’s still small.
This one sorts the recurring work by frequency, and says whether a tool or a person should do each job. The examples use WordPress, the platform we build on, but nearly every task applies to any CMS. Use it to run your own site, or as a yardstick for your provider.
The short answer
- Weekly: apply core, theme and plugin updates (on a staging copy first when they’re risky), confirm backups ran, review uptime and security alerts, and send a test enquiry through every form.
- Monthly: restore a backup to prove it works, fix broken links, check speed and Core Web Vitals, read Google Search Console, and compare tracked enquiries with real ones.
- Quarterly: review every plugin and user account, update content that dates, and spot-check accessibility.
- Yearly: confirm domain, SSL and licence renewals, review hosting and PHP, check you own every account, and decide whether the site still fits the business.
Tools can run the backups, updates and monitoring. A person still has to check they worked.
Before you start: four things any website maintenance checklist needs
Most of these should be set up at go-live, as the website launch checklist explains.
- A staging site: a private copy of the live site where risky updates are tried first. Our plain-English guide to website development explains how staging and live fit together.
- Off-site backups: automatic daily backups stored away from your hosting account, so one failure or stolen login can’t take out both.
- Alerts that reach a person: someone who reads them and knows what to do.
- A maintenance log: the date, what was done, versions before and after, so you know what changed last when something breaks.
Weekly: updates, backups, alerts and forms
Apply updates on staging, then live
Out-of-date plugins with publicly known flaws are among the most common ways WordPress sites get compromised, which is why updates come first in our WordPress security guide. But not every update deserves the same care:
- Small fixes and security patches (say, 2.4.1 to 2.4.2) are usually low risk. Back up, update, then check the key pages.
- Major versions, page builders, form plugins and anything handling payments, bookings or translations go to staging first. Read the changelog and update one at a time, so you know which caused a problem.
- A flaw that’s being actively exploited doesn’t wait for the weekly slot. Update the same day.
WordPress installs minor core releases automatically by default, and you can switch on automatic updates plugin by plugin and theme by theme. That suits small, well-maintained plugins, not anything that shapes layout, forms or checkout. After any live update, check the homepage, a key service page, a form and the menu on a phone, in each language the site uses.
Confirm the backups ran
A green tick isn’t proof. Check the latest backup’s date, that it includes both files and database, and that its size looks normal: a sudden shrink can mean a failed job. Keep several weeks of history: a hack can go unnoticed for a while, and you need a clean copy from before it began.
Review uptime and security alerts
Uptime monitoring checks the site from outside every few minutes and alerts you when it stops responding. Repeated short outages usually point to struggling hosting. If your monitor can, have it look for a specific word on the page, because a site can respond while showing a database error or a blank page. Then scan security alerts (failed-login spikes, unexpected file changes, malware scan results) and act on anything new.
Send a test enquiry through every form
Forms break silently: an update changes a field, a hosting change affects email, or messages start landing in spam. Send a test through every form, in every language, and confirm it arrives intact. If the site sends email through the server’s built-in mail function, move to an authenticated sending service with SPF, DKIM and DMARC set up (the DNS records that prove your emails really come from you). Our guide to web form design covers what else to test.
Monthly: prove the backups work and check the site’s health
Restore a backup somewhere safe
Restore a recent backup to staging or a temporary copy, then click through pages, images, forms and logins. Note how long it took: that’s roughly how long you’d be offline after a real disaster. A backup nobody has restored is a hope, not a plan. Test restores are how you find missing uploads, or a process only one person knows.
Find broken links and missing pages
Run a crawler over the site. Screaming Frog’s SEO Spider has a free version that suits smaller sites, and many SEO tools run scheduled crawls. Then check the Page indexing report in Search Console for pages listed as “Not found (404)”. Fix internal links at the source, and permanently redirect (301) genuinely moved pages to their closest replacement, not the homepage.
Check speed and Core Web Vitals
Run your key pages through PageSpeed Insights, mobile first, and compare with last month. Then open the Core Web Vitals report in Search Console, which uses real visitors’ data from the previous 28 days.
Google rates a page as good when Largest Contentful Paint is 2.5 seconds or less, Interaction to Next Paint is 200 milliseconds or less and Cumulative Layout Shift is 0.1 or less, measured at the 75th percentile of visits. Core Web Vitals explained covers each one. When scores slip, look first at what was added recently: a large image, a new plugin, a chat widget or another marketing tag.
Read Search Console
- Page indexing: a sudden rise in errors, or important pages dropping out.
- Security issues and Manual actions: both should report no issues.
- Performance: clicks and impressions for the searches that matter, against last month and the same month last year.
- Messages: Google uses them to tell you about problems it finds.
Compare tracked enquiries with real ones
The key events in Google Analytics (what GA4 used to call conversions) should roughly match the enquiries your team received. If they don’t, tracking has probably broken, often after a form update or a cookie banner change. Tracking website enquiries in GA4 shows how to set it up.
Quarterly: prune, tidy and spot-check
Review every plugin and the theme
Ask of each plugin: is it still used, still maintained, duplicating another plugin, and properly licensed? The WordPress.org plugin directory shows when a plugin was last updated and warns when it hasn’t been tested with recent major WordPress releases. Delete what you don’t need rather than deactivating it: deactivated plugins still sit on the server. Fewer plugins means fewer updates, conflicts and ways in.
Review who has access
Remove former staff, contractors and past providers from WordPress, downgrade administrators who only edit content, and require two-factor authentication for anyone who can publish. Repeat for hosting, the domain registrar, DNS, analytics and Search Console.
Update content that dates
Prices, people, opening hours, offers, a news page last touched two years ago. Check every language version too: translations tend to fall behind the main one.
Spot-check accessibility
New content is where accessibility slips. Tab through one key journey using only the keyboard; you should always see where you are. Check new images have useful alt text and new banners meet WCAG 2.2 AA contrast: 4.5:1 for normal text, 3:1 for large text. Zoom the browser to 200% and check nothing breaks. Automated checkers catch some problems, not all; our guide to accessibility audits and checkers explains the difference.
Yearly: renewals, ownership and the bigger questions
Domain, SSL and licence renewals
Domain. Check it’s registered in your company’s name, auto-renew is on, the payment card is valid and the contact email is one someone still reads, because expiry notices go there.
SSL certificate. It should renew automatically; the certificate details behind the icon beside the web address show when it expires. The CA/Browser Forum, which sets the rules for publicly trusted certificates, voted in 2025 to shorten maximum lifetimes in stages: 200 days from March 2026, 47 days by 2029. Manual renewal is on its way out.
Licences. Premium plugins, themes and page builders are often licensed by the year. When a licence lapses, updates stop, and so do the security fixes.
Hosting, PHP and ownership
PHP is the programming language WordPress runs on. Check your version still receives security updates: php.net lists supported versions, and WordPress’s Site Health screen flags an outdated one. If the hosting no longer fits your traffic or backup needs, moving to a new host is a planned job, not an emergency. Confirm you hold your own administrator logins for everything, and update the handover notes on where things live and how to restore the site.
Ask whether maintenance is still the answer
If every quarter’s list grows longer (abandoned plugins, an unsupported theme, speed you can’t fix, pages editors avoid), maintenance may be propping up a site that needs rebuilding. The signs your website needs a redesign help you decide. If the site is healthy, remember that upkeep only holds it steady; a continuous-improvement plan makes it better.
Which website maintenance tasks to automate, and which need a person
| Task | Can a tool do it? | What a person still does |
|---|---|---|
| Core, plugin and theme updates | Partly | Reads changelogs, tests major versions on staging |
| Backups | Yes | Checks they ran, restores one monthly |
| Uptime and security monitoring | Yes | Responds to alerts, investigates, cleans up |
| SSL and domain renewal | Yes, if set up | Keeps payment and contact details current |
| Form tests | Not reliably | Sends a real enquiry and checks it arrives |
| Broken links | Yes, with scheduled crawls | Decides fixes and redirects |
| Speed and Core Web Vitals | Yes, monitoring | Diagnoses what caused a drop |
| Content and accessibility reviews | Barely | Almost everything |
Jobs triggered by events, not dates
Some maintenance can’t wait for its slot in the calendar:
- Someone leaves: remove their access everywhere that day.
- Hosting, DNS or email changes: retest every form straight afterwards.
- Before a campaign: check the landing page’s speed, form and tracking.
- A security advisory names a plugin you use: update now.
What to do next
A confident owner or marketing manager can run this checklist. It takes consistency more than skill: one named person, dates in the calendar and the access to act. Hand it over when nobody has the time, downtime would cost enquiries, or updates keep breaking things; website maintenance costs explains what you’d be paying for.
Start this week: find the date of your last backup, check who receives your uptime alerts, and send yourself an enquiry through your own contact form. If any answer is “I don’t know”, that’s where your routine begins.
If you’d rather someone else ran the checklist, our website maintenance care plans cover updates, regular backups, and security and uptime monitoring; higher plans add small content changes, a monthly plain-language report and speed work. Plans are monthly with no lock-in; see care plan pricing. Not sure how far behind your site already is? A free website audit checks its speed, security and how easily visitors can get in touch, and tells you what to fix first.