Website Maintenance Checklist: What to Do Weekly, Monthly, and Yearly

Weekly website maintenance tasks

Weekly work is short and boring, which is exactly why it gets skipped. Thirty minutes on a Monday morning covers it. Once an uptime monitor and a backup tool are emailing you, most of this is reading notifications.

The form test is the one people laugh at until it bites them. Contact forms fail silently. A plugin update changes the mail settings, or the notification goes to an inbox nobody checks. The site looks fine. The leads just stop. We have seen forms sit dead for months while the owner assumed business was slow.

• Confirm the site is up (5 minutes). A free monitor such as UptimeRobot pings the site every few minutes and alerts you. Check the log for downtime in the past week and ask the host why if there was any.
• Submit every form and confirm the email arrives (5 to 10 minutes). Contact, quote request, newsletter signup, booking. Check the spam folder too.
• Verify the last backup exists (5 minutes). Open the backup plugin or host panel and confirm a backup from this week is listed with a sensible file size. A job that failed quietly a month ago looks identical to one that works, right up until you need it.
• Run a security scan (5 to 10 minutes). Wordfence, Sucuri, or your host's scanner. Look for changed core files, admin users you do not recognize, and plugins flagged with a known vulnerability.
• Clear comment spam and the moderation queue (5 minutes). If comments are off, check for junk form submissions instead. A sudden flood usually means a bot found a hole.

Monthly website maintenance tasks

Monthly is where the real maintenance happens: updating the software that runs the site. On WordPress that means core, plugins, and the theme. On Shopify, Wix, or Squarespace the platform handles core updates for you, but apps, themes, and third-party scripts still need attention.

Update on a staging copy first. Most managed hosts (WP Engine, Kinsta, SiteGround, Flywheel) give you one-click staging. Run every update there, click through the home page, a service page, the contact form, and checkout if you have one, then push live. No staging? Take a fresh backup, update one plugin at a time, and check the site between each. Slower, but it beats explaining a white screen to customers.

The rest of the monthly list is about finding what broke quietly. None of it is urgent on its own. All of it compounds.

• Update core, plugins, and theme on staging, test, then push live (45 to 90 minutes). Read the changelog on anything major. Wait a week or two on big version jumps and let other people find the bugs.
• Run a broken link check (15 minutes). Screaming Frog (free up to 500 URLs) or the Broken Link Checker plugin. Fix or redirect every 404 that has links pointing at it.
• Check speed on your top three pages (15 minutes). Google PageSpeed Insights, mobile view. You are looking for a drop since last month, not a perfect score. A new plugin or an oversized hero image is usually the reason.
• Open Google Search Console (15 minutes). Pages for new indexing errors, Core Web Vitals for pages that turned red, and Security Issues, which should be empty. Never set it up? A free SEO checkup shows the biggest problems in the meantime.
• Check content and hours for accuracy (15 minutes). Hours, phone number, prices, staff names, holiday closures, the copyright year in the footer. Match them against your Google Business Profile.
• Review analytics (20 minutes). Traffic, top pages, form fills or sales, and any page that lost more than a third of its visitors. A sudden drop on one page usually means something broke or a competitor moved above you.

Quarterly website maintenance tasks

Every three months, step back and prune. Sites gain weight. Plugins someone installed to try once, a login for a designer who left in 2023, a hosting plan sized for the traffic you had two years ago. None of it shows up on the weekly scan, and all of it makes the site slower, riskier, and more expensive to fix when something does break.

This is also when we refresh the pages that make money. Home page, main service pages, about page. Not a rewrite. A pass with fresh eyes: is the offer still right, are the photos current, does the first sentence still describe what you do?

• Delete plugins and themes you do not use (30 minutes). Deactivated is not removed. An inactive plugin with a known vulnerability can still be a way in. Delete it.
• Audit user accounts (15 minutes). Remove old staff and contractors, downgrade anyone who does not need admin, and turn on two-factor authentication for the rest.
• Review the hosting plan (20 minutes). Disk usage, bandwidth, PHP version. Hosts drop old PHP versions, and a site stuck on one will eventually fail an update. Managed hosting with daily backups and free SSL takes two lines off this checklist by itself.
• Refresh your three most important pages (1 to 2 hours). Update the offer, swap tired photos, tighten the copy, and check that every button still goes somewhere sensible.
• Test on a current phone (20 minutes). Borrow the newest iPhone and Android you can find and go through the site as a customer would. New screen sizes break layouts that were fine last year.

Yearly website maintenance tasks

Yearly tasks are the expensive-to-forget ones. A lapsed domain can take your site and your email offline in an afternoon and, in the worst case, put the name up for resale. An out-of-date privacy policy is an invitation to a demand letter. So is an inaccessible site, and accessibility lawsuits against small businesses are common enough now that the pass belongs on the list.

Put the renewal dates on a shared calendar today, with a second reminder a month out, because the registrar's own email will land in spam or go to whoever set the domain up in 2016.

• Confirm domain and SSL renewals (15 minutes). Check the expiry date at the registrar, confirm auto-renew is on, and confirm the card on file has not expired. A free Let's Encrypt certificate renews every 90 days on its own; a failed renewal shows every visitor a browser warning, so confirm it actually has.
• Review the legal pages (1 hour). Privacy policy, terms, cookie notice, accessibility statement. State privacy laws keep changing, and a policy written in 2020 is wrong in a few places by now.
• Do an accessibility pass (1 to 2 hours). Run the free WAVE or axe browser extensions on your main pages. Fix missing alt text, low color contrast, and form fields without labels. It helps real visitors and removes the easy targets.
• Make the redesign or refresh call (1 hour of honest thought). If the site is more than four or five years old, drags on a phone, or embarrasses you when you send the link, decide now whether next year is a refresh or a rebuild. Deciding beats drifting.

The full website maintenance checklist with time estimates

Here is the whole thing in one place. The times assume a typical small-business WordPress site with a dozen plugins and no store. Add roughly half again for WooCommerce or a membership site, because every update needs a checkout or login test on top.

The website maintenance tasks owners skip most (and what skipping costs)

After enough years of taking over neglected sites, the pattern is obvious. Owners do the visible work, like swapping a photo or posting a blog, and skip the invisible work. The invisible work is the maintenance.

Here is what we find most often when a new client hands us a site, and what it tends to cost them. The longer version of the damage is in what happens if you do not maintain your website.

Do it yourself or hand it off?

The honest math. Call it six hours a month for a simple site, done properly, plus the occasional afternoon lost to an update that broke something. If your time is worth $50 an hour, that is $300 a month of attention spent on work you probably do not enjoy and will not do well by the third month. A maintenance plan for the same site runs from $99 a month with us and $35 to $150 across the market. Our Full-Service Care+ plan includes three hours of content updates a month, so the hours change that used to eat your evening becomes a quick email to the updates team, usually done in 48 to 72 hours.

That does not make DIY wrong. If the site is a brochure that changes twice a year, takes no payments, and you genuinely will do the weekly check, keep it. Print the table above and put it on the wall. The people who get burned are not the ones who chose DIY. They are the ones who chose DIY and then stopped around month four. The full tradeoff is in website maintenance vs doing it yourself.

Either way, start with a baseline. Run a free website checkup to see where health, speed, security, and SEO stand today, and look up when your site was last updated if you are not sure how long it has been. Those two numbers tell you how much catching up the first month will take.