Websites fail slowly, then suddenly. The form that stopped sending in March gets noticed in June; the plugin unpatched since winter becomes the hack in spring. Maintenance is the boring work that prevents expensive weeks. This website maintenance checklist covers all of it, organized by frequency. Use this as your own routine or as the measuring stick for whoever you’re paying.
Nobody notices website maintenance until it stops happening.
Weekly: the five-minute pulse check
Verify backups actually ran. Not "backups are configured": open the backup location and confirm this week’s files exist. Backup systems fail silently, and discovering that during a crisis is the worst possible time.
Submit your own contact form. Send a test through every form that matters and confirm it arrives. WordPress email breaks quietly (a hosting change, an SMTP token expiring) and every silent day is lost leads. If your website is your main source of enquiries, my home services lead generation guide shows how much depends on that one form working.
Scan the homepage and key pages. Thirty seconds of looking: layout intact, images loading, nothing injected that shouldn’t be there.
Monthly: the real work
Updates, with a safety net
Update WordPress core, themes, and plugins, but never blind: back up first, update, then check the site. On sites where downtime costs money, test updates on a staging copy first. Delete deactivated plugins entirely: inactive code is still attackable code, a point WordPress’s own hardening guide makes explicitly.
Update in a quiet hour, not at your busiest time of day. Read the changelog for anything marked as a major version, because those are the updates most likely to change how a plugin behaves.
Security review
Run a malware scan, review the user list for accounts that shouldn’t exist, and confirm admin accounts use strong passwords and, ideally, two-factor. Most hacked WordPress sites are breached by bots exploiting an unpatched plugin, not by anyone targeting you specifically. Boring diligence is the entire defense.
Performance spot-check
Run PageSpeed Insights on your homepage and best-selling page. Speed decays as content and plugins accumulate; catching a slide early is a small fix instead of a full rescue.
Write the scores down each month so you can see the trend. If the numbers are unfamiliar, Core Web Vitals explained covers what each one measures. When a slide does appear, my guide on how to speed up a WordPress site walks through the fixes in order.
Quarterly: step back and look
Restore a backup, for real. Once a quarter, actually restore a backup to a staging environment. A backup you’ve never restored is a hope, not a plan.
Content audit. Prices, team members, service claims, the copyright year in the footer, outdated details quietly tell visitors nobody’s home.
Search Console review. Check Coverage (now the Page indexing report) for crawl errors and the Performance report for pages that slipped. Ten minutes here catches SEO problems while they’re still small.
Broken link crawl. Links rot, pages you linked to move or die. A quarterly crawl keeps both visitors and Google from hitting dead ends.
Yearly: the strategic pass
Renew the domain (set it to auto-renew and check the payment card anyway, expired domains kill businesses for days), confirm SSL renewal is automated, review hosting fit, and honestly assess whether the site still represents the business. Most sites need a proper refresh every 3 to 4 years; the yearly review is where you see it coming instead of being surprised.
The yearly pass is also the time to ask your host which PHP version the site runs on. Old versions stop receiving security fixes, and moving to a supported one is best done deliberately, with a backup and a test, rather than forced on you.
The website maintenance checklist on one page
| How often | What to do |
|---|---|
| Weekly | Confirm backups exist, test every important form, glance at key pages |
| Monthly | Back up and update, delete unused plugins, security review, speed spot-check |
| Quarterly | Test a backup restore, audit content, review Search Console, crawl for broken links |
| Yearly | Domain and SSL renewal, hosting and PHP review, decide whether a refresh is due |
Keep a simple log
Note the date and what you did each time: which plugins were updated, what the speed scores were, anything that broke. When something goes wrong later, the log tells you what changed and when, which is usually most of the diagnosis.
Common maintenance mistakes
- Backups on the same server as the site. If the server fails or the site is hacked, those backups go with it. Keep a copy somewhere else.
- Auto-updates with nobody checking. Automatic updates are useful, but someone still needs to look at the site afterwards.
- One shared admin login. Give each person their own account, so access can be removed cleanly when someone leaves.
- Skipping the boring weeks. Most problems start in a month when nothing seemed worth checking.
Do it yourself or hand it off?
Everything above is doable by a careful owner with 2 to 3 hours a month and the discipline to never skip it. The discipline is the hard part, maintenance is the first thing busy months delete. If it keeps not happening, that’s the honest signal to hand it off: my maintenance service runs this exact checklist from $99/month, with small fixes included and a real developer answering instead of a ticket queue.
