A website can look fine on the surface while important parts quietly deteriorate. A form stops delivering notifications. A plugin becomes vulnerable. An employee leaves with the only login to a service. A domain renewal goes to an old credit card. A backup runs every night but has never been tested. The site still loads, so nobody realizes how much risk has accumulated.
Website maintenance is the ongoing work that keeps a business website secure, accurate, fast, measurable, and recoverable. It is different from launching a new site and different from simply paying for hosting.
Big Splash Web Design & Marketing provides managed hosting and website maintenance for businesses that need dependable support after launch. This checklist explains what should be reviewed, how often it should be reviewed, and what owners should expect from an internal team or website partner.
Key takeaways
- Treat hosting, maintenance, security, and content ownership as connected but separate responsibilities.
- Back up the database and files, then test whether recovery actually works.
- Review updates for compatibility instead of installing them blindly.
- Test forms and sales actions from the customer’s perspective.
- Monitor speed, uptime, security, analytics, and account access.
- Keep domain, DNS, hosting, and website ownership documented.
- Maintain a recovery plan before an outage or compromise occurs.
Inventory the website and its dependencies
Begin with a simple record of what keeps the website operating. Include the domain registrar, DNS provider, hosting platform, content management system, theme, plugins, forms, analytics, tag manager, call tracking, email delivery, payment services, CRM connections, booking tools, and other integrations.
Record the responsible owner, renewal method, administrator access, and purpose of each service. Do not store passwords in an unprotected spreadsheet; use an appropriate password manager and access controls.
This inventory makes routine maintenance faster and emergencies less chaotic. It also reveals abandoned tools, duplicate subscriptions, expired licenses, and integrations nobody realizes are business-critical.
Review the inventory quarterly and whenever the website, vendor, or staff changes.
Verify domain, DNS, and certificate renewals
A domain expiration can take the entire website and business email offline. Confirm that the business—not an unreachable former vendor—controls the domain account. Verify contact information, renewal dates, payment methods, and multi-factor authentication.
DNS controls where the domain sends web and email traffic. Document the provider and important records. Changes should be planned and recorded because an incorrect DNS edit can interrupt several services at once.
The website should use a valid TLS certificate so visitors connect through HTTPS. Many hosts renew certificates automatically, but monitoring should still alert someone before expiration. After certificate changes, check for mixed content and redirect issues.
Review ownership and renewals at least quarterly, with automated expiration alerts.
Build and test a backup strategy
A complete website backup normally includes database content and website files. Depending on the system, it may also require configuration, media, server settings, or external data.
Keep more than one recovery point. A backup taken after malware or data corruption may contain the same problem. Retention should match how often content changes and how quickly issues are discovered.
Store at least one copy separately from the live hosting environment. If the server and every backup share the same account or infrastructure, one failure can affect all of them.
Most importantly, test restoration. A successful backup notification proves that a job ran; it does not prove the files are complete or the business can recover. Conduct controlled restoration tests and document the steps, expected recovery time, and responsible person.
Manage WordPress, theme, and plugin updates carefully
Updates can close security vulnerabilities, improve compatibility, and correct bugs. They can also conflict with customized code or other software.
Before significant updates, confirm a current backup and review release information. Use a staging environment when the site has ecommerce, memberships, custom development, critical forms, or complex integrations. After updates, test representative pages and customer actions rather than checking only the homepage.
Remove unused plugins and themes instead of leaving inactive software indefinitely. Fewer components reduce the attack surface and maintenance burden. Confirm that active licenses and developer support remain available for business-critical tools.
Security patches may require prompt action. The objective is a controlled, timely process—not indefinite delay and not blind one-click updating.
Monitor website security and access
Security maintenance includes more than installing a security plugin. Use strong unique passwords, multi-factor authentication where available, limited administrator accounts, current software, appropriate file permissions, secure hosting, and regular monitoring.
Review users quarterly. Remove former employees, contractors, and vendors who no longer need access. Give people the lowest role that allows them to do their job. A content editor rarely needs full administrator privileges.
Monitor for unexpected file changes, suspicious logins, malware, spam pages, unusual administrator accounts, and traffic patterns. Protect forms against abuse without creating unnecessary friction for real customers.
Create an incident-response plan. It should explain who investigates, how the site can be isolated, where clean backups are stored, who communicates with customers, and how service is restored.
Track uptime and availability
A website can be unavailable when nobody on the team happens to look at it. Independent uptime monitoring checks the site regularly and alerts the responsible person when it cannot be reached.
Configure monitoring for the website and any critical service endpoints. A homepage check may not detect that checkout, booking, or a custom application has failed. For high-value functions, use transaction monitoring that tests a complete action.
Set useful alert thresholds. A single slow request may not justify an emergency, while repeated failures require attention. Document escalation so alerts do not sit in one person’s inbox overnight.
Review uptime trends monthly and investigate recurring interruptions, even when each individual outage was short.
Test forms, calls, bookings, and payments
Lead-generation and transaction functions deserve routine end-to-end testing. Complete the form like a customer. Confirm the success message, email delivery, CRM record, internal notification, automation, and analytics event.
Test click-to-call links on mobile devices. Verify booking availability, time zones, confirmation messages, and cancellation flows. For ecommerce or payments, use approved testing methods and confirm receipts, taxes, shipping, inventory, and order notifications where relevant.
A form can appear to submit successfully while notifications are filtered, an integration fails, or the CRM creates incomplete records. Test the full path, not only the visible button.
Perform these checks monthly and after software, DNS, email, CRM, or form changes.
Review website speed and performance
Performance affects customer experience, conversion, and search visibility. Measure representative pages on mobile and desktop, including the homepage, major service pages, landing pages, and content with large images or interactive features.
Watch for oversized images, excessive scripts, slow third-party tools, weak caching, database buildup, and hosting limitations. Performance changes over time as content and marketing tags are added.
Do not chase a perfect laboratory score at the expense of useful functionality. Focus on real bottlenecks, stability, and how quickly visitors can understand and use the page.
Review performance monthly, establish a baseline, and investigate meaningful declines.
Keep content accurate and trustworthy
Outdated content creates customer frustration even when the technology works perfectly. Review phone numbers, addresses, hours, staff profiles, prices, service areas, policies, promotions, certifications, and calls to action.
Check navigation and internal links. Repair broken links and remove references to discontinued services. Review downloadable files, especially price sheets, forms, menus, and brochures that may remain indexed long after replacement.
For regulated or fast-changing industries, assign subject-matter owners and review dates to important pages. Content accuracy should be a documented responsibility rather than an occasional redesign project.
Conduct high-priority checks monthly and a broader content audit quarterly.
Review analytics, tracking, and consent tools
Analytics can fail silently after a theme update, consent-banner change, domain change, or tag modification. Confirm that the appropriate properties receive data and that important events still fire.
Test form, phone, booking, purchase, and other key actions. Review campaign tags and referral exclusions. Make sure internal staff traffic, spam, or payment-provider referrals are not distorting reports unnecessarily.
Consent and privacy requirements evolve, and implementations vary by location and business. Review the privacy policy, cookie tools, form language, data retention, and connected vendors with appropriate professional guidance.
Document tracking changes so sudden reporting shifts can be explained later.
Maintain accessibility and cross-device usability
Accessibility is an ongoing practice. New pages, plugins, colors, forms, and media can introduce barriers after a site launches. Review keyboard navigation, focus visibility, form labels, headings, alternative text, contrast, captions, and error messages.
Test current phones, tablets, and browsers used by the audience. Pay particular attention to menus, sticky elements, popups, embedded tools, and checkout or booking steps.
Automated scanners can identify some issues, but they do not replace manual review or feedback from real users. Address recurring patterns in templates and publishing procedures so the same problem is not added repeatedly.
Include accessibility checks in content creation and quarterly maintenance reviews.
Document ownership and vendor responsibilities
A maintenance agreement should clarify who handles hosting, updates, backups, security monitoring, content edits, licenses, uptime, emergency response, and third-party services.
The business should understand what is included, expected response times, and which work requires a separate project. It should retain documented access to domains, DNS, website administration, analytics, and important accounts.
Ask how offboarding works. A dependable vendor relationship includes a clear path for transferring access and assets if the arrangement ends.
Documentation protects both the client and provider by replacing assumptions with specific responsibilities.
Use a practical maintenance schedule
Weekly tasks may include backup review, security alerts, uptime issues, and urgent software patches. Monthly work can include controlled updates, form testing, performance checks, analytics validation, user review, and content spot checks.
Quarterly reviews should cover access, licenses, renewals, broader content accuracy, accessibility, integration health, and restoration testing. Annual planning can evaluate hosting capacity, technology debt, privacy practices, disaster recovery, and whether the website still supports business goals.
Adjust the schedule to risk. A simple brochure site and a busy ecommerce or portal website should not have identical maintenance plans.
Frequently asked questions about website maintenance
How often should a small-business website be maintained?
Basic monitoring should run continuously, while updates, backups, forms, security, and performance should be reviewed on regular weekly, monthly, and quarterly schedules based on the website’s complexity and risk.
What should be included in a website maintenance plan?
A maintenance plan should address software updates, backups, security monitoring, uptime, performance, forms, analytics, domain and certificate renewals, content accuracy, access control, and documented recovery procedures.
Is website hosting the same as website maintenance?
No. Hosting provides the infrastructure that serves the website. Maintenance manages the software, content, security, testing, monitoring, and recovery work required to keep the site dependable.
Should WordPress updates be installed immediately?
Security updates may require prompt action, but updates should be backed up, reviewed for compatibility, and tested appropriately. Applying every change blindly on a live website can create avoidable problems.
How can a business tell whether website backups work?
The business should verify backup completion, retention, storage location, and restoration procedures. A backup should be tested through a controlled restore process rather than assumed to work because a dashboard shows success.
Who should own the website’s domains and accounts?
The business should retain ownership or clearly documented access to its domain, hosting, website administration, analytics, DNS, email services, and important third-party accounts, even when a vendor manages them.
Maintenance protects the investment already made
A website is not finished when it launches. Customers, browsers, devices, software, threats, staff, and business information continue to change. Maintenance keeps the site aligned with that changing environment.
Use this checklist to identify ownership gaps and immediate risks. Then establish a schedule, assign responsibilities, and document recovery. The result is not merely a healthier website. It is a more dependable business asset.