Website Maintenance Checklist: Weekly, Monthly and Yearly Tasks

Published October 15, 2026 · Last updated October 16, 2026 · By the WebSolutions LLC team

A website is not a finished product. The software it runs on gets security fixes, certificates expire, plugins change, links break and content goes out of date. A short, repeatable maintenance routine catches these problems before your visitors do. This checklist breaks the work into weekly, monthly, quarterly and yearly tasks so that a small business owner, an in-house marketer or a developer can work through it without guessing what to check next.

The list is written for typical business sites: a CMS such as WordPress, a custom PHP site, or a small online store. Adjust the frequency to how often your site changes and how much it matters to your revenue. If you would rather hand the routine to someone else, our maintenance and support services cover the same ground.

Before you start: set up the basics

Maintenance is much easier when a few things are already in place:

• A list of logins and owners. Hosting control panel, domain registrar, DNS provider, CMS admin, analytics and Google Search Console. Store them in a password manager, not a shared document.
• A backup you can restore. Know where backups are stored, how long they are kept, and how to restore one. A backup that has never been restored is a hope, not a plan.
• A staging copy, if possible. A private copy of the site lets you test updates before they reach visitors.
• Search Console access. Google Search Console is free and reports crawl errors, indexing problems and security issues that you would otherwise miss.

Weekly website maintenance tasks

• Confirm backups ran. Check that the latest backup completed and has a sensible file size. A sudden drop in size often means part of the site or database was skipped.
• Apply security updates. Update the CMS core, plugins, themes and any libraries. WordPress applies minor and security releases automatically on most hosts, but major releases, plugins and themes still need attention; the official WordPress update guide recommends taking a backup first.
• Test your forms. Submit the contact form, quote form or checkout yourself and confirm the message arrives. Forms fail silently more often than any other part of a small business site.
• Scan for unexpected content. A quick site:yourdomain.com search in Google can reveal spam pages that you did not create, which is one of the early signs of a hacked site that Google suggests checking for.
• Review uptime alerts. If you use an uptime monitor, look at any outages and note whether they line up with hosting maintenance or traffic spikes.

Monthly website maintenance checklist

• Check page speed and Core Web Vitals. Run your main pages through PageSpeed Insights. Google's Core Web Vitals use three metrics with published "good" thresholds: Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of visits (web.dev). Large images and unused scripts are the usual culprits; our website speed optimization guide explains how to fix them.
• Fix broken links. Crawl the site with a link checker and fix or redirect anything returning a 404. Pay special attention to links in navigation, footers and service pages.
• Read the Search Console reports. Look at the Pages (indexing) report, any manual actions and the Security issues report. New errors usually point to a template change, a plugin conflict or a server problem.
• Remove unused plugins and accounts. Deactivated plugins and old admin users still increase risk. Delete what you no longer need and make sure every remaining admin account uses multi-factor authentication.
• Review analytics. Compare traffic and conversions with the previous month. A sharp drop on one page can reveal a broken form, a redirect loop or an indexing problem.
• Check the database and storage. Clear out spam comments, old revisions and orphaned uploads if your CMS stores them, and confirm you are not close to your hosting disk limit.

Quarterly tasks

• Test a full restore. Restore a recent backup to a staging location and confirm the site works. CISA's ransomware guidance recommends keeping offline, encrypted backups and regularly testing their availability and integrity (CISA #StopRansomware Guide).
• Review content accuracy. Read your key pages as a customer would. Update service descriptions, opening details, team information, policies and anything that has changed in the business.
• Check mobile layouts. Open every template on a real phone. Look for text that overflows, buttons that are hard to tap and pop-ups that cover content.
• Audit user access. Remove access for former staff, agencies and contractors from the CMS, hosting panel, DNS and analytics.

Yearly website maintenance tasks

• Domain renewal and contact details. Confirm the domain is set to auto-renew, the registrar account email is one you still read, and registrar lock is enabled.
• SSL/TLS certificate renewals. Certificate lifetimes are getting shorter. Under the CA/Browser Forum schedule, the maximum lifetime for public TLS certificates dropped to 200 days from March 15, 2026, and will fall to 100 days in March 2027 and 47 days in March 2029 (DigiCert summary). Let's Encrypt certificates are valid for 90 days by default (Let's Encrypt FAQ). Automated renewal is now the only practical option, so confirm it is working rather than relying on a calendar reminder.
• Hosting review. Check the PHP or runtime version your host is running, whether it is still supported, and whether your plan still fits your traffic and storage. If it is time to move, follow a proper website migration checklist so you do not lose pages or rankings.
• Security review. Walk through the basics in our small business website security guide: access control, updates, backups, HTTPS and monitoring.
• Design and accessibility check. Review whether the site still reflects your brand and services, and test it with keyboard-only navigation and a screen reader for obvious accessibility barriers. Our website accessibility checklist lists what to look for.

Who should own website maintenance?

For a very small site, the business owner can handle the weekly and monthly items in under an hour with the right logins. Updates, restores, server configuration and security reviews are where most owners prefer to bring in a developer, because a failed update or a bad restore can take the site offline. Whoever owns it, write the routine down, keep a simple log of what was done and when, and make sure at least two people can get into the hosting and domain accounts.

If you are not sure where your site stands today, start with the weekly list, then read our FAQs or contact our team to talk through ongoing support.