Most website disasters start small: a skipped update, a backup that silently stopped running, a form that broke weeks ago and nobody noticed. This checklist is what we run on the sites we maintain, grouped by how often each task should happen. Use it yourself, or hand it to whoever looks after your site.
Every week
- Update core, themes and plugins. Most security fixes ship as ordinary updates. The longer you wait, the more you're exposed.
- Check the site after updating. Load the homepage, a key landing page, and anything that takes payment or leads.
- Confirm backups ran. A backup job that failed quietly is worse than none, because you think you're covered.
- Review uptime alerts. Short outages that fix themselves are often early warnings of a bigger problem.
Every month
- Test your forms and checkout. Submit a real test: contact forms, quote forms, and a test order if you run a store.
- Scan for malware. Look for unexpected files, admin users you don't recognize and redirects you didn't add.
- Check page speed. Run your main pages through PageSpeed Insights and watch Core Web Vitals (LCP, INP, CLS) for regressions.
- Remove what you don't use. Deactivated plugins and themes still carry security risk. Delete them.
- Look for broken links and 404s. Google Search Console lists pages it couldn't reach.
Every quarter
- Test a restore. Restore a backup to a staging copy. It's the only way to know your backups actually work.
- Audit user accounts. Remove old staff, contractors and agencies who no longer need access.
- Review plugins. Replace abandoned plugins that haven't been updated in a long time.
- Check SEO basics. Page titles, meta descriptions, sitemap and indexing status in Search Console.
Every year
- Renew your domain and licenses. Turn on auto-renew, and make sure the billing card and email are current.
- Review hosting. Has traffic outgrown your plan? Is support still responsive? Is it time to switch?
- Update legal pages. Privacy policy, terms and cookie notices should match what the site actually does.
- Refresh key content. Outdated pricing, team pages and service pages hurt both trust and rankings.
When something goes wrong
- Don't panic-update everything at once. Change one thing at a time.
- Restore from the last known-good backup if the site is down and you can't find the cause fast.
- Change passwords and review admin users if you suspect a hack.
- Write down what happened, so it doesn't happen twice.
Or hand the checklist off
That's a lot of recurring work to remember. Our website maintenance plans cover the weekly and monthly items for you: updates, daily backups, uptime and security monitoring, speed checks and fixes, with hosting included. See pricing.
Frequently asked questions
How often should a website be updated?
Check for core, theme and plugin updates every week. Security fixes usually ship as normal updates, so waiting a month leaves known holes open.
How often should I back up my website?
Daily for most business sites, and more often for busy stores. Keep backups off the server and hold at least a few weeks of history.
How do I know my backups work?
Restore one. Every quarter, restore a backup to a staging copy of your site and check it loads correctly.
What's the most commonly skipped maintenance task?
Testing forms and checkout. They can break quietly after an update, and you only find out when leads or orders stop coming in.
