Maintenance · checklist

Website maintenance checklist

What to check on a small-business website every week, month, quarter and year, with the primary source for each and a link to the fix when something's wrong.

Published October 22, 2026Updated October 22, 2026By Remidiy

Short answer: every week, confirm the backup ran, apply updates and test your contact form. Every month, run a health check, look for broken pages, check analytics, speed and your hours. Every quarter, test a restore, confirm your PHP version is supported and spot-check accessibility. Every year, renew the domain and review the legal pages and copyright line.

Most of it takes minutes. The jobs that hurt when skipped are backups you've never restored, updates left for months, and a domain or certificate that quietly expires.

This checklist is for a small-business site on WordPress or similar software on ordinary hosting. If you're on Wix, Squarespace or Shopify, the platform handles software updates, servers and certificates for you (see what hosted platforms cover); everything about content, forms, the domain, analytics and accessibility still applies.

Every week

Check the backup ran. A full backup is two parts, the database and the files; WordPress.org suggests weekly backups for smaller sites, daily for busy ones, and always before an upgrade (WordPress: Backups). Keep copies in more than one place, not only on the same server: WordPress.org suggests at least three, in different places.
Apply updates. WordPress applies minor and security releases on its own on most hosts, but major releases need you to click Update Now in Dashboard › Updates (Updating WordPress). Plugins and themes can be set to update automatically, one by one, from the Plugins and Themes screens (plugin and theme auto-updates). Delete plugins you don't use. Out-of-date software is covered in the outdated software guide.
Confirm the site is up. An uptime monitor checks the site every few minutes and emails or texts you when it stops answering. Glance at its alerts; a site that goes down for an hour every night usually has a hosting problem.
Test the contact form. Send yourself a message and check it arrives, including in spam. Forms often break silently after an update or a change of email provider. If notifications land in spam, check your SPF and DMARC records.

Every month

Run the website checker. It reads security, speed, SEO, AI search, email and domain, and contact details in one go, and links each problem to a fix. A new finding is often the first sign that an update changed something.
Look for broken pages. Click through the main menu on a phone. In Google Search Console, the Page indexing report lists pages Google found returning “not found” (404); fix the ones you link to and redirect pages that moved. The indexing guide covers robots.txt and sitemaps.
Check analytics is collecting. Open your analytics and confirm last week has visits. Universal Analytics stopped processing data on 1 July 2023 (Google Analytics Help), so a site still running it has no numbers; see replacing old analytics.
Check speed on mobile. Run your homepage through PageSpeed Insights; a score of 90 or above is good. New photos are the usual cause of a slowdown (image optimisation, website speed).
Check the certificate. Make sure it renews automatically and isn't close to expiring; the checker flags one within 30 days. Let's Encrypt certificates last 90 days and Let's Encrypt recommends renewing every 60 (Let's Encrypt FAQ). It stopped sending expiry reminder emails on 4 June 2025, so nobody will warn you unless you set up monitoring (Let's Encrypt). See the certificate guide.
Check hours, prices and offers. Update holiday hours before each holiday, remove expired offers, and make sure the site matches your Google Business Profile.

Every quarter

Test a restore. A backup you've never restored is a guess. Restore the latest one to a staging copy (most hosts offer one) and click around. WordPress.org's advice is to restore the files first, then import the database.
Confirm your PHP version is supported. As of October 2026, the supported branches are 8.2 (security fixes until 31 December 2026), 8.3 (until 31 December 2027), 8.4 (2028) and 8.5 (2029) (php.net: supported versions). WordPress recommends PHP 8.3 or newer (WordPress requirements). Sites on 8.2 should plan the move this quarter. The PHP vulnerability checker shows what your server reports, and there are step-by-step guides for WordPress, cPanel and GoDaddy.
Re-check security headers. Host migrations and new caching layers can drop them. See security headers and hiding the server version.
Spot-check accessibility. W3C's Easy Checks walk through page titles, image alt text, headings, colour contrast, text resizing, keyboard access, and form labels and errors. W3C notes these catch only some issues. Pay most attention to pages you changed (alt text, heading order).
Review who has access. Remove logins for former staff and contractors from the site, hosting, domain registrar and Google accounts. WordPress.org's hardening guide also advises against guessable usernames such as admin (Hardening WordPress).
Check email authentication. If DMARC is still at p=none and the reports look clean, move towards p=quarantine (how).

Every year

Renew the domain, or confirm auto-renew. Check the card on file and the contact email at your registrar. ICANN policy requires registrars to send renewal reminders about one month and one week before expiry, and asks registrants to keep contact details current so they arrive (ICANN FAQ). The checker flags a domain expiring within 60 days; see the domain expiration guide.
Plan for shorter certificates. The CA/Browser Forum voted in 2025 to cut the maximum life of public certificates in steps from 398 days to 47 by 2029 (Ballot SC-081v3), and Let's Encrypt is moving its default to 64 days in February 2027 and 45 days in February 2028 (Let's Encrypt). If anything on your site is renewed by hand, automate it.
Update the copyright line and legal pages. An old year in the footer reads as neglect (fix). Re-read your privacy policy against what the site now collects, such as new forms, booking tools or analytics (privacy policy link).
Review content top to bottom. Services you no longer offer, departed staff, old photos, outdated prices. Make sure your structured data still has the right address, phone and hours, and that titles and descriptions still describe each page (titles and descriptions).
Review the software itself. Look for plugins that haven't been updated by their authors in a long time, a theme that bundles old jQuery, or a platform reaching end of life. These are the jobs that turn into emergencies if left.
Confirm you own the accounts. The domain, hosting, DNS, analytics and Google Business Profile should be in the business's name, with a login you control, not only a past developer's.

Sources

Common questions

How often should a small-business website be backed up?

At least weekly, and daily if content or orders change every day. WordPress.org also advises a backup before every upgrade and keeping copies in more than one place, and you should restore one to a test copy every few months to prove it works.

How often should I update WordPress plugins?

Check weekly and apply updates promptly, after a backup. WordPress can update plugins and themes automatically if you switch it on for each one in the Plugins and Themes screens; it installs minor core security releases on its own.

Which PHP versions are still supported?

As of October 2026, PHP 8.2, 8.3, 8.4 and 8.5. PHP 8.2 gets security fixes only until 31 December 2026, so plan a move to 8.3 or newer. The PHP vulnerability checker shows what your server reports.

What happens if my domain name expires?

Your website and email stop working, and after the registrar's grace and redemption periods someone else can register the name. Turn on auto-renew and keep the registrar's contact email current; the domain expiration guide has the details.

Do I need to maintain a Wix or Squarespace site?

Less. The platform keeps its own software, servers and certificates up to date. You still need to keep content, hours and prices current, test forms, renew a domain registered elsewhere, and check analytics and accessibility.

Start with this month's check. The website checker covers a good part of this list in one pass, and the PHP vulnerability checker answers the PHP question. If you'd rather not keep the list yourself, ongoing website maintenance and security is what we do.