The website maintenance checklist: daily, weekly, monthly, quarterly and yearly

Why use a maintenance checklist at all

A website that is not looked after does not stay the same. It slowly gets worse. Plugins and themes fall behind, certificates run out, backups stop without a warning, a form quietly stops sending, and a page that was fast a year ago now takes six seconds. None of that is dramatic on any single day, which is exactly why it gets missed.

A checklist turns "keep an eye on the site" into a short list of jobs with a rhythm. You do not need to be technical to use it. You need to be able to look at your site, open your admin area, and ask the people who look after it whether each line is a yes.

What daily, weekly, monthly, quarterly and yearly mean here

Daily jobs are the ones a person should never have to remember: is the site up, did the backup run, did anything look odd overnight. On a well-run site these are automatic and you only hear about them when something is wrong.

Weekly jobs are the routine of keeping software current and scanning for problems. This is where most hacked sites are lost, because an out-of-date plugin is the easiest way in.

Monthly jobs are the ones that prove the routine worked: a restore test of the backup, a look at speed, a check of every form, a review of who has access. If you do only one thing from this list, make it the restore test.

Quarterly and yearly jobs are the bigger look: whether the plugins you pay for are still needed, whether the site still does what the business does, whether the domain, certificate and hosting renew without a surprise.

How long it takes if you do it yourself

For a small site, the weekly jobs are typically a short sitting, the monthly jobs an hour or two, and the quarterly and yearly reviews an afternoon each. Larger sites, stores and sites with many plugins take longer. If you are doing this around running a business, the honest question is not whether you can, it is whether it will still be done in month eight.

What you cannot check from the outside

Some lines on the list need access to the server or the admin area, such as the state of your backups, the version of every plugin and who has an administrator login. If you cannot tick these yourself, ask whoever hosts and maintains the site to confirm them in writing. "I think so" is a no.

When to hand it off

If you read the list and find that most lines are a no, or that you would not know how to check them, that is useful information and not a failure. You can fix the gaps yourself, give the list to your developer, or ask a maintenance team to take it on. If you want a quick view of where you stand first, the two-minute coverage check on this site covers the basics.

The checklist is below. Print it, keep it next to your desk, and put the monthly review in your calendar.

A website is never finished. This list shows the routine that keeps one healthy, in the order the jobs come round. Tick them off yourself, hand the list to your developer, or ask a maintenance team to run it for you.

Every day (most of this should be automatic)

• The site is up, and you are alerted if it goes down.
• The last backup finished without errors.
• Security scans ran and nothing was flagged.
• Contact and booking forms still deliver, or you are alerted if they stop.
• Any error alerts or warnings have been looked at.

Every week

• Apply updates to plugins, themes and the platform, after a backup.
• Look at the security log and the firewall activity for anything unusual.
• Check for broken links and pages that return errors.
• Test your main contact or enquiry form with a real message.
• Spot-check how fast the home page and one key page load on a phone.
• Clear spam comments and spam form entries.

Every month

• Restore a backup to a test copy and check that the site works.
• Place a test order, booking or sign-up from start to finish.
• Review user and admin accounts. Remove anyone who should no longer have access.
• Look at your analytics and Search Console for drops, errors and warnings.
• Check the expiry date of your SSL certificate.
• Remove plugins and themes you no longer use.
• Review the slowest pages and fix what is making them slow.
• Write down what was done, so there is a record.

Every quarter

• Review performance: loading speed and the Core Web Vitals report.
• Read your key pages for out-of-date prices, hours, names and offers.
• Check how long backups are kept and how much storage they use.
• Check the PHP version and hosting plan are still supported and big enough.
• Run an accessibility spot-check: text size, contrast, form labels and keyboard use.
• Review third-party scripts, such as chat widgets and trackers, and remove what you no longer use.

Every year

• Renew or confirm your domain name, SSL certificate and hosting, and diarise the next dates.
• Review the whole site structure and content, and retire pages nobody needs.
• Change important passwords, turn on two-factor sign-in, and review who holds the logins.
• Review your privacy and cookie notices with your adviser.
• Review the cost and the plan you are on, and write a short improvement list for the next twelve months.

Want it taken off your hands?

Every WebXSentry plan runs the daily, weekly and monthly parts of this list for you and reports on them each month, with hands-on hours for the changes you ask for. See the plans, or find out what website maintenance includes.