Website Maintenance: A Monthly and Yearly Checklist

Before you start: access and a log

Maintenance is much easier when you can reach everything. Make one secure list of the accounts the site depends on: the domain registrar, the host, the content management system, Google Search Console and Analytics, the email provider and any payment or booking service. Each should be in the business's name, with multifactor authentication on. Our guide to domain names explains why the business, not a former developer, should be the domain's registrant.

Then keep a simple log: the date, what was checked or changed, and anything that looked wrong. When something breaks, the log shows what changed just before it.

After every change

Any update, new plugin, design change or hosting move is a chance for something to break. Each time:

• Back up first. The WordPress upgrade instructions start with a backup of the database and files, and say to verify that the backups are there and usable before going further. The same applies to any site.
• Check the key pages on a phone and a computer: the home page, main service or product pages, and the contact page.
• Submit every form and confirm the email arrives. Forms can fail silently, and you only find out when enquiries stop.
• Make a test purchase or booking if the site takes money or appointments.

Every month

• Install updates. Since WordPress 5.6, new installations update minor and major core releases automatically by default, but existing installations keep the older behaviour of auto-updating only minor releases unless an administrator turns major updates on. Plugins and themes need their own setting. Check the Updates screen anyway, and remove plugins and themes you no longer use. Custom sites need the same attention for their frameworks and libraries.
• Confirm backups are running. Check that recent backups exist and are stored away from the server. See our website backups guide for the 3-2-1 rule.
• Review users. Remove accounts for people who have left, and keep administrator access to those who need it.
• Look at Search Console. Google's guide to debugging traffic drops points to the Security Issues report, where Google lists malware or phishing it has detected, and the Manual Actions report. Check both, plus the Page indexing report for new errors.
• Check form spam. If junk submissions are rising, see stopping contact form spam.
• Check uptime alerts. If you use a monitoring service, confirm its alerts still reach someone who will act on them.

Every three months

• Test a restore. A backup you have never restored is not proven. Restore to a staging copy and check it works; our backups guide lists what to check afterwards.
• Check speed. Run key pages through PageSpeed Insights and compare with last time. Our Core Web Vitals guide explains the scores.
• Check for broken links. Fix links to pages that moved or no longer exist, and redirect any of your own pages you removed. See 404 errors and redirects.
• Run accessibility spot checks. The W3C's Easy Checks cover image alt text, page titles, headings, colour contrast, keyboard focus, zoom and form labels. W3C notes that they are quick and not exhaustive, so a page can pass them and still have barriers. Our accessibility basics guide goes further.

Every year

• Domain renewal. Under ICANN's Expired Registration Recovery Policy, registrars must send at least two reminders before a generic domain such as .com expires: about one month before and about one week before. Those reminders go to the registrant's contact details, so check that the email address on record still works, and turn on auto-renew.
• HTTPS certificate. Most sites renew certificates automatically, but automation can fail, and certificate lifetimes are getting shorter. Let's Encrypt has ended its expiry email service, so do not rely on a warning email from it. Check the expiry date yourself or use a monitoring service. Our SSL certificates guide explains renewal.
• Hosting and software renewals. List every paid licence the site depends on, such as premium plugins and themes, with its renewal date. An expired licence can mean no more security updates.
• Content review. Check opening hours, prices, team pages, addresses and service descriptions are still true. Update or redirect pages that are out of date. See our helpful content guide.
• Privacy and cookies. If you added tools such as analytics, chat or advertising tags, check the privacy policy and cookie banner still match. See privacy policy and cookie consent basics.
• Access audit. Go through the account list from the start of this guide and remove anyone who no longer needs access to the registrar, host or analytics.

Signs something needs attention now

• A browser or Google warning that the site is unsafe, or a new entry in the Security Issues report.
• Enquiries or orders stop suddenly.
• A large, sudden fall in search traffic. Google's traffic drop guide lists security issues, spam issues and site-wide technical problems among the causes to check.
• New administrator accounts, pages or redirects you did not create.

If you suspect the site has been hacked, see what to do in our website security basics guide.

Doing it yourself or handing it over

Most of this list needs no technical skill, just time and a calendar reminder. The parts that do need skill are updates on complex sites, restore tests and fixing whatever the checks find. Whoever does the work, the business should keep ownership of the accounts and the log, so a change of person or agency does not mean starting from nothing. For the checks that can run on their own around the clock, see uptime monitoring.

Frequently asked questions

How often should a website be maintained?

Check backups, updates, users, forms and Search Console every month, test a restore and check speed, links and accessibility every three months, and review renewals, content, privacy and access every year. Back up and test the key pages after every change.

Does WordPress update itself?

Partly. Since WordPress 5.6, new installations update both minor and major core releases automatically by default; older installations auto-update only minor releases unless an administrator enables major ones. Plugins and themes have their own auto-update settings.

Will I be warned before my domain expires?

For generic domains such as .com, ICANN's policy requires the registrar to send at least two reminders, about one month and about one week before expiry, to the registrant's contact details. Keep that email address current and turn on auto-renew.

Why test a restore if backups are running?

A backup is only useful if it can be restored. Testing on a staging copy shows that the files and database are complete and that you know the steps before you need them in a hurry.

Would you rather not run this list yourself? Our website maintenance service covers updates, backups, security and monitoring. See all our services, or email info@creahive.com.