What Is Website Maintenance? A Monthly Checklist for Business Sites

What is website maintenance and what does it cover?

Website maintenance is the set of regular checks and tasks that keep a live website secure, fast, and working: backups, software updates, security scans, SSL certificate and domain expiry tracking, form and email tests, speed monitoring, and content review. It is ongoing upkeep, not a redesign or new feature work.

Treat website maintenance as a routine, not a one-time job. In practice, you run it monthly, or more often for busy sites. The goal is simple: you find the problem before a customer does. As a result, the site stays trustworthy for visitors and steady for search engines.

Maintenance protects four things: security, availability, performance, and accuracy. For example, security means closing known holes and spotting attacks early. Availability means the site opens every time, because the certificate and domain stay valid. Performance covers speed and ease of use. Finally, accuracy means prices, phone numbers, addresses, and legal pages match reality.

Website maintenance does not include building new features, redesigning the site, running ads, or writing content. Those are separate jobs. However, a steady maintenance routine gives them a solid base to build on.

Why do you still need website maintenance after launch?

Many businesses assume the work ends on launch day. In fact, a website is a living system, unlike a printed brochure. Because software versions, browsers, and security holes change constantly, the environment around your site shifts even when you touch nothing.

A shop comparison helps. The sign, the door, and the lock can stay in place, yet the lights must work, the register must run, and the shelves must look current. In other words, launch opens the shop. Maintenance is the opening check you do every morning.

The real problem is quiet decay. For example, an expired certificate or a broken form does not announce itself. Visitors leave and you never learn why. That is why maintenance is mostly about catching decay early.

Example scenario: a furniture workshop launches its contact form and never tests it again. Months later the email password changes, and form messages silently vanish. As a result, the workshop assumes fewer people are calling and raises its ad budget. Meanwhile, the real problem sits in the form.

How is website maintenance different from hosting, development, and SEO?

People often confuse these jobs, so it pays to know what you are buying. A hosting provider runs the server and the network, and we are not a hosting provider. Instead, we set up, migrate, and manage your website and business email on Google Workspace, Microsoft 365, or the hosting provider you choose.

The line matters most for backups. For example, a hosting provider may keep server backups. However, proving that the backup restores your site completely is a maintenance task.

Business email is a separate service too. Website maintenance does not cover the mailboxes themselves. It covers their connection to your site, such as how form messages leave and which DNS (domain name system) records tie your domain to your site and email. So even with Google Workspace or Microsoft 365, a change on the site side can disturb your email. Also, development and SEO need their own budget and calendar, while maintenance keeps the ground under them solid.

Where should you start with a neglected website?

Our priority order follows risk. First, we look at access and your ability to roll back. Then we check expiry dates that could take the site down, and last we look at speed and looks. The reason is simple: with no backup, every change is risky, and with an expired domain, nothing else matters.

1. Collect access. Who holds the domain registrar login, the hosting panel, and the site admin account, and which email address do they use? Because nobody can fix what they cannot open, this step comes first.
2. Verify the backup. When did the last one run, and is there a copy off the server? Also, have you ever tried a restore?
3. Check expiry dates. The domain, the SSL certificate, and the hosting plan can each take the site offline, so look at all three.
4. Review updates and security. Are core, theme, plugins, and PHP (the server-side programming language) current? Also, do you still have plugins you no longer use?
5. Test the form and email. Does a message from your contact form really reach your inbox? In practice, this check exposes silent losses.
6. Scan speed and broken links. Start with the homepage, then move to the pages that get the most traffic.
7. Review content and legal pages. Do prices, phone numbers, and privacy notices still match reality?

This order will not fit every site. Still, the first three steps carry the highest risk for almost every business. Moreover, neglected sites rarely have just one problem, because access, backup, and expiry issues tend to show up together. If you struggle with access, read our guide on taking your website and domain back from an agency.

Which website maintenance tasks run weekly, monthly, and yearly?

You do not need to run every task at the same pace. Instead, some checks run on automatic alarms, some run monthly, and some belong to a yearly review. The table groups the work by frequency.

The monthly row is the real website maintenance checklist, and we explain each item below. Weekly tasks are small and quick, so you can automate most of them. Yearly tasks are strategic, because contract, renewal, and architecture decisions happen at that point.

Why is a backup not enough, and how do you test a restore?

A backup only counts if you can restore it. Many businesses take backups for years, then discover in the first emergency that the file is incomplete or corrupt. For that reason, testing the restore is the most important website maintenance step.

The official WordPress backup page says a site needs both its files and its database. Files hold themes, plugins, and uploads, while the database holds posts and settings. Also, the page advises a backup before any upgrade or move, and copies in different locations. Read the details in the WordPress backup documentation.

1. First, restore the latest backup to a test area that is separate from the live site.
2. Then open the homepage, an inner page, and the images.
3. Next, log in to the admin panel and save a test entry.
4. Finally, note how long the restore took, so you know how long a real emergency would take.

Without a test area, at least inspect the backup contents: is the database file there, and do the images look complete? Still, a real restore is the strongest proof. Also, if the backup sits on the same server as the site, one server problem takes both. So keep at least one copy off the server. For the full strategy, see our website backup strategy guide.

How do you update core, plugins, and themes safely?

Updating is the most frequent website maintenance task and the one that breaks things most often. Core (the main software of a system such as WordPress), themes, and plugins all release new versions regularly. Delaying a security patch leaves known holes open. However, updating everything blindly can break the site. Therefore, the answer is small steps.

1. First, take a backup and confirm that it finished.
2. Then read the release notes. Test big version jumps and critical functions, such as payments, on a test copy first.
3. Next, update one item at a time or in small groups. That way you find the culprit fast if something breaks.
4. After each step, also check the homepage, an inner page, the form, and the checkout if you have one.
5. If something breaks, roll that update back and, if needed, restore the backup. Then write down the cause.
6. Finally, delete plugins and themes you do not use. The official WordPress hardening page also advises deleting unused plugins.

Server software needs updates too. For example, a PHP version that has lost support no longer receives security patches. So before you move to a supported version in the hosting panel, test your theme and plugins on a copy. If your provider no longer offers a current version, see our hosting migration checklist.

An update window is the planned time slot for updates. Apply security patches without delay, and schedule feature updates when few visitors are online. In ecommerce, also avoid peak order hours.

Automatic updates make life easier, but they do not replace checking. So even with automation on, test the main flows by hand once a month. If a critical error screen appears after an update, read our WordPress critical error fix.

What does a security scan actually check?

A security scan looks for malicious code, unexpected file changes, and components with known holes. A scan is not protection by itself. However, it helps you notice problems early.

• Traces of malicious code and unusual files
• Files that changed recently, which deserve a question if neither you nor your developer touched them
• Plugins with known holes, or plugins whose developer stopped releasing updates long ago
• Unexpected admin accounts, plus accounts of former staff and former agencies
• Many failed login attempts in a short time, because that often signals an automated attack

The official WordPress hardening page lists core habits. Keep core and plugins updated, use strong passwords with two-step verification, and avoid guessable usernames. Also restrict file permissions and monitor logs and file changes. None of these habits is enough alone. However, together they shrink the attack surface. Read more in the Hardening WordPress documentation.

Google also tries to email verified owners in Search Console (Google’s monitoring panel for site owners) when it suspects a hack. The Security Issues report is where those findings appear. If you find something, stay calm. First, follow the order in our WordPress hack cleanup guide.

How do you track SSL and domain expiry?

An SSL certificate encrypts the connection between the browser and your site. When it expires, visitors see a security warning before they reach the page. Most hosting providers renew the certificate automatically. However, automatic renewal can fail quietly. For example, it can fail after you change DNS records or move the site to a new server.

So verify the expiry date yourself once a month. Our SSL checker shows the days left, the expiry date, the issuer, and the certificate chain in one report. Also, set a reminder before the date instead of waiting for a browser warning.

A domain is a separate registration, so renewing the hosting plan does not renew the domain. Moreover, when the domain lapses, the site stops, and so does every email address on that domain. Our WHOIS lookup shows the registrar and the expiry date.

• Turn on auto-renew and keep a valid payment method at the registrar, because an expired card can stop the renewal.
• Also make sure the registrant email address belongs to a mailbox someone actually reads.
• Put the renewal date in a shared calendar with three reminders, for example one month, two weeks, and one week before.
• Finally, confirm that your business name appears as the registrant.

Getting back an expired domain is sometimes possible, but no one can promise it. For details, read our expired domain guide.

How do you test forms and email delivery?

The contact form is the most valuable page on many sites, because leads come through it. Moreover, a broken form rarely shows an error. The visitor assumes the message went out, while you never receive it.

1. First, fill in the form with your own address and send it.
2. Then confirm that the message reaches the target inbox and does not land in spam.
3. Next, if you set up several recipients, check each one separately.
4. Also test the autoresponder from a different address.
5. Finally, run the same test on campaign pages and quote forms.

If the message never arrives, email authentication is the first suspect. When your site sends email in your domain name, the SPF, DKIM, and DMARC records must recognize that sender. In other words, these records prove to the receiving server that the sender is genuine. Our SPF, DKIM, and DMARC checker shows their status. For the setup steps, see our SPF, DKIM, and DMARC guide.

Any maintenance job that touches DNS can affect email as well. Therefore, copy the existing records before you move a site or transfer DNS management. That way you do not lose your mail records. Also, a DNS lookup tool lists them in one query.

How do you track broken links and 404 errors?

A 404 is the error code for a page the server cannot find. For example, deleted pages, changed addresses, and mistyped links all produce it. A few are normal. However, broken links that point to your important pages frustrate visitors and search engines alike.

1. First, scan your important pages one by one with our broken link checker. It lists the dead links, redirects, and images that fail to load on a page.
2. Next, look at the indexing reports in Search Console for addresses that return 404.
3. Then, for old pages that still have value, set up a permanent redirect (301) to the closest relevant page.
4. Leave addresses with no equivalent as 404 instead.
5. Finally, fix links in the menu, the footer, and the body text.

Why not redirect every old address to the homepage? Because an unrelated redirect confuses visitors, and search engines often do not accept it as a real answer. For more, see our soft 404 guide.

How do you monitor speed, Core Web Vitals, and uptime?

Google summarizes page experience with Core Web Vitals. There are three metrics. First, LCP shows how fast the main content loads. Second, INP shows how quickly the page responds to interaction. Third, CLS shows how stable the layout stays while it loads. Thresholds can change, so check the current limits on the web.dev Web Vitals page.

That page also recommends real-user field data. Lab tests help during development, but they do not replace field measurement. In practice, keep your monthly routine short. First, measure the homepage and your two busiest pages in PageSpeed Insights. Then open the Core Web Vitals report in Search Console. Finally, check whether any plugin or large image you added last month slowed things down.

If speed dropped, narrow down the cause. First, look at image sizes, then at plugin count, and last at server response time. That way you see sooner whether the problem sits in the site or on the server.

Uptime is the share of time your site stays reachable. Set up an outside monitoring service, so that at least two people get an email or text when the site stops responding. Also watch critical pages such as the contact page, not just the homepage. For a quick one-off check, use our is-it-down tool. It tests DNS, connection, SSL, status code, and response time one by one.

How often should you review content, prices, and contact details?

A wrong phone number, outdated opening hours, or an expired campaign banner damages trust as much as a technical fault. Because visitors believe what the site says, a wrong detail means they will not call you. On the other hand, aging content can also lose traffic over time.

• Phone, address, email, and opening hours; also confirm they match your Google business profile
• Price, package, and campaign pages, especially expired campaign banners
• Team, reference, and service pages; remove people who left and services you dropped
• Older blog posts with facts that age, especially technical or legal topics
• The copyright and company name line in the footer

The goal here is to avoid giving visitors wrong information and to protect trust. However, fresh content for search visibility is a separate strategy.

Why check privacy notices and cookie settings during maintenance?

Privacy notices, cookie banners, and form consent texts must describe how your site really handles data. However, sites change. You add a form, install an ad tag, or switch on a live chat plugin. If the texts stay old, a gap opens between the site and its documents.

• First, make sure every form, analytics tool, and ad tool you added since launch appears in your notices.
• Next, test that the cookie banner really blocks the tags that should not run before consent.
• Also check that the consent and privacy links under forms point to the right pages.
• Finally, confirm that the contact details and the data controller name on the privacy page are current.

To see which tracking codes run, use our website technology checker. It lists GA4, Google Tag Manager, Google Ads, Meta Pixel, and cookie consent codes in one scan. Then compare the result with your notices.

Which law applies depends on your visitors and your business, for example the GDPR in Europe or Turkey’s data protection law, KVKK. This section is not legal advice, so ask a privacy lawyer about the wording. For the technical setup, read our GDPR compliant website guide.

What happens when you skip website maintenance?

A neglected site does not crash right away. Instead, risk builds quietly and shows up through one event. The table shows the likely results of skipped tasks. However, none of them happens on every site. Still, each one becomes more likely without maintenance.

Example scenario: a cleaning company leaves a plugin without updates for months. One day, unrelated pages show up under its name in search results. As a result, the cleanup costs more time and stress than regular maintenance would have. Meanwhile, the quote form may stop working too.

In a case like that, stay calm and follow the order in the security section above. On the other hand, if the cause sits on the hosting side, our guide to hosting warning signs helps you decide.

What are the most common website maintenance mistakes?

We see the same mistakes again and again. However, most of them are habit and ownership mistakes, not technical ones.

• Updating without a backup, because a broken update then has no way back
• Updating all plugins at once, which hides the cause of any failure
• Keeping backups only on the same server
• Leaving the domain or admin account in an agency’s or an employee’s name
• Testing the form only at launch and never again
• Sending alerts to one person’s inbox, so alerts reach nobody when that person leaves
• Saying “it works, do not touch it” and postponing updates for months

These mistakes share one root: nobody clearly owns the task. Therefore, give every website maintenance item an owner and a date.

Should you handle website maintenance yourself or hire an agency?

It depends on how complex your site is and how much time you can spare. The table below compares three options. Still, the third one, a managed service that some hosting providers offer, varies widely in scope.

For a simple one-page brochure site, building your own routine is often enough. In contrast, a WordPress site with many plugins, forms, ecommerce, or several languages usually repays expert help. You can also combine both: you manage daily content, and a team handles technical upkeep.

Whichever route you pick, also name one internal owner for maintenance. That way alerts never sit unclaimed.

What should a website maintenance quote include?

A website maintenance quote puts uncertainty in writing. Before you compare prices, compare these items, because two quotes can look alike while their scope differs a lot.

1. Scope: which site, which environment, and which tasks are in or out
2. Response time: a first response target and a resolution target, written separately, plus a clear definition of an emergency
3. Backup policy: how often, how long they keep copies, where, and when the restore test happens
4. Update window: which day and hours the team updates, and whether it backs up before and checks after
5. Security monitoring: which scans and alerts exist, and who receives the notice
6. Report: what the monthly report contains and when it arrives
7. Access and ownership: the domain, hosting, and admin accounts stay in your name, so you can take the site back when you leave
8. Term and exit: contract length, termination terms, and how access moves back to you

Also ask how the team prices out-of-scope work, because new pages and features do not fall under maintenance. For a general way to read proposals, see our guide to evaluating a web design proposal. This section is not legal advice, so have a lawyer read the contract before you sign.

What belongs in a monthly website maintenance report?

A good report is short and asks for decisions. In other words, pages of raw technical output are not a report. It should tell you what the team did this month, what looks risky, and what it needs from you.

• Updates applied: what moved from which version to which
• Backup status: date of the last good backup and the result of the restore test
• Security scan: findings fixed and findings still open
• Availability summary: when any outage started and how long it lasted
• Speed and Core Web Vitals summary
• Form and email test result
• Broken links and fixes
• Open risks and the decisions the team needs from you

Be careful if a report only brings good news. A healthy report now and then says, for example, “we recommend replacing this plugin.” So treat the report as input for a decision meeting.

How much maintenance does each type of site need?

Website maintenance intensity depends on the site’s structure and its effect on revenue. Therefore, treat the table as a field-based starting frame, not a guarantee.

To adapt the table to your case, ask one question: what do you lose if the site is down for an hour? Then match your check frequency to the answer. The bigger it is, the more often you should check.

What belongs on a monthly website maintenance checklist?

Copy this list each month. Each item maps to a section above. In fact, it is a short version of our pre-launch testing checklist.

• Backup: confirm the last backup finished, keep a copy off the server, and run a restore test
• Updates: update core, theme, plugins, and PHP, and delete plugins you do not use
• Security: read the scan result and review the admin list and login attempts
• SSL: verify the certificate expiry date and the automatic renewal
• Domain: check the expiry date, auto-renew, and the registrant
• Form and email: confirm that a test message reaches the inbox and that the SPF, DKIM, and DMARC records are in place
• Links: review the broken link and 404 list and set up needed redirects
• Speed: compare Core Web Vitals and homepage speed with last month
• Uptime: review outage logs and confirm the alerts still work
• Content: update prices, phone numbers, addresses, and campaign details
• Privacy: compare privacy, cookie, and form consent texts with what the site really does
• Report: write a short summary and list open items

How do you request a quote for website maintenance?

After reading this list you have two paths: build the routine yourself, or work with a team that knows the job. If you choose the second path, first gather the access details, the last backup date, and the expiry dates. That way the team scopes the work from facts instead of guesses.

• Your site address and the software behind it: WordPress, a site builder, or custom code
• Your hosting provider and your domain registrar
• The date and location of your last backup
• Where forms and email addresses send their messages
• Whether you run ecommerce, memberships, or several languages

We are not a hosting or email provider. Instead, we set up, migrate, and manage your website and business email on Google Workspace, Microsoft 365, or the hosting provider you choose. Also, we define the maintenance scope together with you, based on how you built your site. Request a quote for your website and business email.