Websites rarely fail all at once. A plugin falls a few versions behind, a backup quietly stops running, a contact form stops sending, a certificate renewal is missed. Each one is small, but together they’re how sites get hacked, slow down or lose leads without anyone noticing. A website maintenance checklist turns that upkeep into a routine you can actually follow.
This guide is for US business owners and marketing managers responsible for a company website or online store. It sets out what to check monthly, quarterly and once a year, which recent changes affect maintenance, what to do after every site change, and how to decide what to handle in-house and what to hand to a specialist.
Quick Answer: What Should a Website Maintenance Checklist Include?
A website maintenance checklist should cover monthly updates, backups, security checks, form and checkout tests and uptime review; quarterly checks of speed, SEO health, user access and restore tests; and an annual review of hosting, domains, certificates, accessibility, legal pages and content. Critical security updates shouldn’t wait for the schedule.
Key takeaways
- Backups only count if you’ve tested a restore.
- Test forms and checkout every month, because a broken form costs leads silently.
- Certificate lifetimes are getting shorter, so renewals need to be automated and monitored.
- Remove old user accounts and require multi-factor authentication for admin logins.
What Is Website Maintenance?
Website maintenance is the ongoing work of keeping a site secure, working and up to date: applying software updates, running and testing backups, monitoring uptime and security, checking forms and speed, and refreshing content. It covers everything that keeps the site doing its job between redesigns.
The right schedule depends on the platform. A hosted platform such as Shopify handles server updates for you, while a self-hosted WordPress or WooCommerce site leaves the core software, plugins, themes and server to you or your provider.
Monthly Website Maintenance Tasks
Every month, apply software updates, confirm backups ran and are stored off the server, review security alerts, test every form and the checkout, and check uptime and broken links. These tasks keep the site secure and catch problems while they’re still small. Set aside a fixed day each month.
Updates and security
- Apply updates to the core platform, plugins, themes and extensions, after testing major updates on a staging copy.
- Remove plugins and themes you no longer use, rather than just deactivating them.
- Review security scans, firewall alerts and failed login attempts.
- Check the Security issues report in Google Search Console for hacked content or malware warnings.
Backups
- Confirm automatic backups ran and include both files and the database.
- Keep at least one copy stored away from your web server.
Forms, checkout and key journeys
- Submit every contact, quote and booking form, and confirm the email or CRM entry arrives.
- Place a test order on online stores and check confirmation emails.
- Click through the main navigation and top landing pages on mobile.
Monitoring
- Review uptime reports and any outages.
- Check for broken links and 404 errors on important pages.
Quarterly Website Maintenance Tasks
Quarterly tasks look beyond “is it working” to “is it still working well.”
- Restore test: restore a recent backup to a staging site to prove it works. A backup you’ve never restored is an assumption.
- User access review: remove accounts for former staff, agencies and freelancers, downgrade anyone with more access than they need, and require multi-factor authentication for admin accounts, as CISA recommends.
- Speed and Core Web Vitals: test your main templates on mobile and look for new slowdowns from apps, scripts or large images.
- SEO health: review Search Console for indexing errors, crawl issues and pages that lost clicks. Fixing these is where technical SEO support often starts.
- Third-party scripts: list tracking pixels, chat widgets and tags, and remove any you no longer use.
- Payment page scripts (online stores): under PCI DSS v4.0.1, merchants validating with SAQ A must confirm their site isn’t susceptible to script attacks that could affect their ecommerce systems. Check what scripts run on pages that lead to checkout, and confirm your obligations with your payment provider.
Annual Website Maintenance Tasks
Once a year, review everything that expires, ages or drifts out of date: domain renewals, SSL/TLS certificate automation, hosting and server software support, accessibility, legal pages and site content. Missing one of these can take a site offline or leave outdated information in front of customers.
- Domain renewal: confirm the domain is on auto-renew, the registrar account is in your company’s name and the payment card is current.
- SSL/TLS certificates: confirm renewals are automated and monitored. Maximum certificate lifetimes dropped to 200 days on March 15, 2026, fall to 100 days on March 15, 2027, and reach 47 days in 2029, so manual yearly renewals no longer work.
- Hosting and platform: check your server software and PHP version are still supported, and that your hosting plan still fits your traffic. If it doesn’t, compare website hosting plans before the next busy season.
- Accessibility: review key pages and forms against WCAG guidelines, especially after design changes. For questions about legal obligations, speak with an attorney.
- Legal pages: update the privacy policy, cookie notice and terms to reflect the tools and data you actually use now.
- Content audit: update or remove outdated pages, old offers, staff bios and service information.
- Design and structure: note recurring problems that patches can’t fix. If the list keeps growing, it may be time to plan a website redesign.
| Frequency | Core tasks | Why it matters |
| Monthly | Updates, backup checks, security scans, form and checkout tests, uptime review | Closes known vulnerabilities and catches broken lead paths quickly |
| Quarterly | Restore test, user access review, speed, SEO health, script review | Confirms recovery works and stops slow problems from building up |
| Annually | Domains, certificates, hosting, accessibility, legal pages, content audit | Prevents expiries and keeps the site accurate and compliant |
What Should You Check After Every Site Change?
After every update, plugin install, redesign or hosting change, check that forms still send, checkout still completes, tracking still records conversions and key pages load correctly on mobile. Changes cause many site problems, so a 15-minute check after each one catches issues before customers or search engines find them.
- Submit your main forms and confirm delivery.
- Place a test order if you sell online.
- Confirm analytics and conversion tracking still fire.
- Spot-check page speed and layout on mobile.
- Keep a simple change log: what changed, when and who changed it.
What Can You Handle In-House, and What Needs a Specialist?
Many routine checks need no technical skills. Others carry more risk if they go wrong. Split the work based on the cost of a mistake, not just the time it takes.
| Task | Usually fine in-house | Usually worth a specialist |
| Form and checkout tests | Submitting forms and placing test orders | Fixing email delivery or payment integration errors |
| Updates | Minor updates on hosted platforms | Major updates on self-hosted sites, with staging and rollback |
| Backups | Confirming backups ran | Setting up off-site backups and running restore tests |
| Security | Reviewing user accounts and turning on MFA | Malware removal, firewall rules and incident response |
| Performance | Running a speed test | Diagnosing slow templates, scripts and server issues |
A Common Pattern in Website Maintenance
A common pattern shows up when a business notices fewer inquiries but can’t find a reason. Traffic looks steady and the site loads fine. Weeks later, someone tests the contact form and finds it stopped sending after a plugin update or a change to the email setup. Every lead in that time went nowhere.
Nothing was hacked and nothing looked broken. The fix took minutes. The loss came from nobody testing the form. A monthly submission test, with the result logged, is one of the cheapest checks on the list.
How Savit Interactive Handles Website Maintenance
Savit Interactive provides website maintenance services for businesses that want this checklist handled on a schedule, with updates, backups, security monitoring and performance checks managed for them. If you’d rather keep some tasks in-house, the team can take on the higher-risk ones and leave the routine checks with you.
Put Your Website Maintenance Checklist on a Schedule
A website maintenance checklist protects your site only when each task has an owner and a date. To have updates, backups, security and performance handled for you, talk to the Savit Interactive team about maintaining your site.
