Website Maintenance Checklist: Monthly and Yearly Tasks
A website is not a brochure you print once. It is software that runs every day, depends on renewals and updates, and quietly breaks when nobody checks it. This checklist turns website maintenance into a short, repeatable routine you can do yourself or hand to a freelancer, split into monthly, quarterly and yearly tasks.
Key takeaways
- Most website problems come from skipped basics: missed updates, broken backups, expired renewals and forms nobody tested.
- Do a monthly check of about an hour, a deeper quarterly review and a yearly audit of renewals, content and access.
- Always take and test a backup before updating anything.
- Write down who owns each login, renewal and task, so the website does not depend on one person's memory.
Many small business owners launch a website, celebrate, and then do not touch it for a year. Nothing seems wrong until a customer mentions the contact form stopped working months ago, the browser shows a security warning, or the domain name quietly expires. By then the fix is urgent and usually more expensive than routine care would have been.
The good news is that maintenance is mostly predictable. The same tasks come up every month and every year, whether you use a hosted builder such as Wix or Squarespace, or self-hosted WordPress. Hosted builders handle more of the technical work for you, so some items below will not apply. Self-hosted sites need everything. Platforms and tools change often, so check your provider's current documentation for exact settings.
Before you start: build a website logbook
Maintenance is far easier when everything about your site lives in one place. Create a simple document or spreadsheet, which we will call your website logbook, and fill in these details once:
- Domain registrar: where the domain name is registered, the renewal date and whether auto-renew is on.
- Hosting: the provider, plan type, renewal date and support contact.
- Platform and add-ons: your content management system (CMS), meaning the software you use to edit the site, plus its theme and plugins or apps.
- Logins: which accounts exist and who has access. Store the passwords themselves in a password manager, not in the logbook.
- Connected services: email, analytics, Google Search Console, payment tools, booking systems and form tools.
- Backups: where they are stored, how often they run and when you last tested a restore.
Add a short "maintenance history" section where you note the date and what you did each time. When something breaks, that history often points straight to the cause, such as a plugin update the day before.
Common mistake
Letting the web designer register the domain or hosting in their own name. If you part ways or they become unreachable, you can lose control of your own website. Make sure the domain and hosting accounts are in the business's name, with your business email as the main contact, and give helpers their own access instead.
Monthly maintenance tasks
Block one hour on the same day each month. These tasks catch most problems while they are still small.
- Confirm a recent backup exists. Check that automatic backups ran and that a copy is stored somewhere other than your web server, such as cloud storage. A backup that lives only on the same server can disappear with it.
- Apply updates. On self-hosted sites, update the core software, theme and plugins. Update one thing at a time if you can, and check the site after each. Hosted builders update themselves, but you should still review any app or integration notices.
- Test every form and checkout. Submit your contact form, booking form and newsletter sign-up, and if you sell online, run a test order. Confirm the notification actually arrives in the right inbox.
- Click through key pages on a phone. Open the home page, main service or product pages and contact page on your own phone. Look for broken layouts, missing images and buttons that do not work.
- Check Google Search Console. Look for new warnings in the Page indexing, Security issues and Manual actions reports, and glance at the Performance report for sudden changes in clicks.
- Review uptime alerts. If you use an uptime monitor, a service that checks your site every few minutes and alerts you if it goes down, look at any incidents from the past month.
- Remove spam and unused accounts. Clear spam comments or form entries and delete user accounts that are no longer needed.
Pro tip
If your host offers a staging site, which is a private copy of your website for testing, use it for larger updates such as a new theme version or a major plugin upgrade. Test there first, then apply the change to the live site. It turns risky updates into routine ones.
Quarterly maintenance tasks
Every three months, go a little deeper. These tasks take an afternoon and focus on performance, security and accuracy.
Performance and user experience
- Run a speed test. Use PageSpeed Insights on your home page and one or two important inner pages. Compare results with last quarter in your logbook.
- Review Core Web Vitals. Search Console's Core Web Vitals report shows how real visitors experience your pages, separately for mobile and desktop.
- Check image sizes. New blog posts and product photos are a common cause of slowdowns. Make sure recent images were compressed and resized before upload.
- Find broken links. Use a link checker or a crawler tool to find links that lead to missing pages, then fix or redirect them.
Security and access
- Review admin users. Remove anyone who no longer needs access, and make sure each person has their own login with the lowest role that lets them do their job.
- Confirm two-factor authentication. Turn on two-factor authentication (2FA) for your CMS, hosting, domain registrar and any connected tools that support it.
- Remove unused plugins and themes. Deactivated add-ons can still contain vulnerabilities. If you do not use it, delete it.
- Test a backup restore. Restore a recent backup to a staging site or ask your host to help. You only know a backup works once you have restored it.
Content accuracy
- Check opening hours, prices on your own pages, staff names, phone numbers and addresses.
- Make sure your details match your Google Business Profile and social media profiles.
- Update or remove outdated promotions, events and seasonal banners.
Yearly maintenance tasks
Once a year, step back and look at the whole website as a business asset. Pick a fixed month, ideally a quieter one for your business.
| Area | Yearly task | Why it matters |
|---|---|---|
| Domain name | Confirm the renewal date, auto-renew and the payment card on file | An expired domain takes your website and email offline |
| Hosting plan | Review performance, support quality and whether the plan still fits | Traffic and needs change; the cheapest plan may no longer be enough |
| SSL certificate | Check that HTTPS certificates renew automatically | Browsers flag sites without HTTPS as "Not secure" |
| Legal pages | Review the privacy policy, cookie notice and terms | New tools or tracking may change what you must disclose |
| Content | Audit old pages and blog posts: update, merge or remove | Outdated pages confuse visitors and can weaken trust |
| Design and accessibility | Check readability, color contrast, image alt text and keyboard navigation | A site more people can use is a site more people can buy from |
| Tools and subscriptions | List every paid plugin, app and service, and cancel what you no longer use | Forgotten subscriptions add up and widen your security exposure |
Certificate renewal deserves special attention. The CA/Browser Forum, the industry body that sets rules for public certificates, approved shortening the maximum lifetime of public TLS certificates in stages: to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. In practice, manual renewal once a year will no longer work, so confirm with your host that renewal is fully automatic. Free certificates from Let's Encrypt, which many hosts include, are designed for automatic renewal.
Hypothetical example
Imagine a small bakery whose site was built by a freelancer three years ago. During its first yearly audit, the owner discovers that the domain was registered on the freelancer's personal account, two plugins had not been updated in over a year, and the catering request form sent messages to an old employee's inbox. None of these had caused a visible problem yet. Fixing them took one afternoon and a short call with the freelancer, instead of an emergency on a busy Saturday.
Who should do the maintenance?
You have three realistic options, and many businesses mix them.
Doing it yourself works when
- You use a hosted builder that handles updates and security
- Your site is small, with few plugins or integrations
- You can reliably block an hour each month
Getting help makes sense when
- You run self-hosted WordPress with many plugins or an online store
- Downtime would directly cost you sales or bookings
- Nobody on the team is comfortable restoring a backup
If you hire help, choose either a freelancer or agency on a monthly maintenance plan, or a managed hosting provider that includes updates, backups and security monitoring. Whichever you pick, ask exactly what is included, how quickly they respond when the site is down, and how they report what they did each month. Keep your own access to every account so you are never locked out.
Common mistake
Turning on automatic updates for everything and never checking the site afterward. Automatic updates are good for security, but an update can occasionally conflict with a theme or another plugin. Pair automatic updates with a quick visual check of your key pages and a backup you can restore.
Your printable maintenance checklist
Copy this list into your logbook or calendar. Treat it as a starting point and add items specific to your site, such as checking a booking calendar sync or a product feed.
Website maintenance checklist
- Monthly: confirm an off-server backup ran
- Monthly: update core software, theme and plugins, one at a time
- Monthly: test every form and checkout, and confirm emails arrive
- Monthly: check key pages on a phone
- Monthly: review Search Console warnings and uptime alerts
- Quarterly: run PageSpeed Insights and review Core Web Vitals
- Quarterly: fix broken links and oversized images
- Quarterly: review admin users, 2FA and unused plugins
- Quarterly: test a backup restore
- Quarterly: check hours, contact details and offers for accuracy
- Yearly: confirm domain and hosting renewals and auto-renew
- Yearly: confirm SSL certificates renew automatically
- Yearly: review legal pages, content, accessibility and subscriptions
Frequently asked questions
How much time does website maintenance take?
As a rule of thumb, a small brochure site needs about an hour a month plus an afternoon each quarter. A self-hosted online store with many plugins needs more, often a few hours a month, which is why many store owners pay for a maintenance plan or managed hosting.
Do hosted builders like Wix or Squarespace need maintenance?
Yes, though less. The platform handles software updates, hosting and security certificates. You still need to test forms, keep content accurate, review who has access, watch Search Console and keep your domain renewed.
Is my host's backup enough?
It is a good start, but check how long backups are kept, whether you can restore them yourself and whether they are stored separately from your server. Many businesses keep a second backup copy in their own cloud storage for extra safety.
What should I do if an update breaks my site?
Stay calm and restore the backup you took before the update, or roll back the specific plugin or theme if your platform allows it. Then check the developer's support pages for known issues before trying the update again, ideally on a staging site.
Related reading
The bottom line
Website maintenance is not glamorous, but it protects something you have already paid for. A one-hour monthly routine, a quarterly review and a yearly audit catch most problems before customers notice them. Start by building your logbook this week, then put the three recurring reminders in your calendar. Your future self, and your customers, will thank you.
