A website maintenance checklist keeps the small jobs from turning into big problems. Each week, check the site loads, the forms work and backups ran. Each month, update the software and test what matters. Each quarter, test a restore and review access, and each year, check your domain, SSL and hosting renewals. The printable checklist below works for any platform.
Key takeaways
- Most maintenance is routine checking: does the site load, do the forms work, did the backup run?
- Back up before every update, and test the important pages straight after.
- Security fixes can’t wait for the monthly round. Apply urgent ones within days.
- Once a quarter, prove a backup actually restores.
- Yearly renewals (domain, SSL, hosting) cause some of the most avoidable outages.
Why does a small business website need maintenance?
A website isn’t finished when it launches. The software underneath it changes constantly, and attackers move fast. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and the most heavily exploited were attacked at scale within a median of 5 hours (Patchstack). Other platforms have the same problem on a smaller scale.
Many businesses aren’t keeping up. The ABS found that 28% of Australian businesses had no cyber security preventive measures in place in 2024–25 (ABS). A regular routine is the simplest fix.
The printable website maintenance checklist
Print this page, or save the image below and keep it next to your desk. The sections that follow explain each task.
What should I check every week?
The weekly check is about catching problems before customers do. It takes a few minutes:
- Load the site on your phone. Open the home page, a key service or product page and the contact page. Look for layout breaks, warnings or slow loading.
- Send a test enquiry. Fill in your main form and confirm the email arrives. Forms can stop sending without any visible error.
- Check the latest backup ran. Look for a recent date in your backup tool or host’s dashboard.
- Apply urgent security updates. If a plugin or app you use has a known security flaw, update it now, not at month’s end.
- Check alerts. Read any downtime emails or security notices from your host or monitoring service.
If you run an online shop, add a test order or a check of recent orders. Our WooCommerce maintenance checklist covers store-specific tasks.
What should I do every month?
Update everything, safely
Take a fresh backup, then update the core software, theme and plugins (or apps and extensions, depending on your platform). Afterwards, retest the forms, checkout and pages that bring in business. An update that breaks a layout won’t announce itself. For WordPress-specific steps, see our complete WordPress maintenance checklist.
Scan and review
- Run a malware scan and read the results.
- Open Google Search Console and check the Security issues report. It flags hacked content, malware and deceptive pages, which can trigger warning labels in search results and browsers (Google).
- Remove plugins you no longer use, and delete accounts for staff or contractors who have left.
Keep the content honest
Check prices, opening hours, phone numbers, staff names and any promotions. Out-of-date details cost enquiries and trust, and they’re the easiest thing on this list to fix.
What should I do every quarter?
- Test-restore a backup. Restore a recent copy to a staging site and check it works. A backup you’ve never restored is a guess. Our guide to restoring a website from backup walks through the process.
- Check speed. Google’s “good” thresholds are a Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less (web.dev).
- Fix broken links. Check Search Console for pages returning errors, and redirect or update them. Our guide to fixing broken links shows how.
- Review access. List everyone with an admin login. Turn on two-factor login for each one, and remove anyone who doesn’t need it.
- Read your legal pages. Make sure the privacy policy still matches the forms, tools and tracking you use.
What should I check every year?
Domain renewal
Check when your domain expires and whether auto-renew is on. auDA lets you renew a .au domain up to 90 days before expiry. After it lapses, there’s a 30-day grace period in which your website and email stop working, before the name is released to anyone (auDA). Since May 2026, a .com.au also won’t renew if the ABN behind it has lapsed, as our article on the .com.au renewal ABN check explains.
SSL certificates
Certificates are getting shorter lives. Let’s Encrypt’s default certificates last 90 days, falling to 64 days in February 2027 and 45 days in February 2028, in line with industry rules (Let’s Encrypt). Nobody can renew those by hand reliably, so confirm yours renew automatically.
Hosting and the bigger picture
- Review your hosting plan, its resources and the web hosting renewal price before it renews.
- Update a single list of logins: registrar, host, website admin, email, analytics and payment provider. Store it in a password manager.
- Ask whether the site still does its job. If it looks dated or doesn’t work well on phones, plan the next refresh.
How long does all this take?
For a simple site, the weekly check takes minutes. The monthly round takes longer, mostly because of testing after updates. Quarterly and yearly tasks add a few hours across the year, more if a restore test or an update goes wrong.
That’s the real question: is this the best use of your time? Our honest comparison of whether to outsource website maintenance weighs the hours against the cost. If you decide to hand it over, our guide to choosing a website maintenance company lists the 12 questions to ask first.
Can my host do this for me?
Partly. A standard host keeps the server running and usually stops there. Managed hosting takes on more of the platform work, such as server updates, security and backups. But testing forms, checking content and reviewing access still need someone who knows your site.
Our Maintain & Protect website care plans cover most of this checklist. Every plan includes updates (monthly, with high-risk security updates weekly), off-site backups kept for 30 days, daily malware scans, uptime monitoring and a monthly report. Advantage adds visual and form checks after updates, plus broken link repairs. Elite adds a search engine health report.
Frequently asked questions
How often should a website be maintained?
Check it weekly, update it monthly and apply urgent security fixes within days. Add a quarterly restore test and access review, and a yearly check of domain, SSL and hosting renewals. Busy shops and sites with many plugins need more frequent attention.
What is included in website maintenance?
Software, theme and plugin updates, backups, security scans, uptime monitoring, testing after updates, content checks and renewals. Good maintenance also includes proving backups restore and keeping a record of what was done.
Does this checklist work for Shopify, Squarespace or Wix?
Mostly. Hosted platforms handle core software updates and server security for you, so skip those tasks. Apps, content, forms, user access, domain renewals and backups of your content still need your attention.
What happens if I skip website maintenance?
Usually nothing at first, which is the trap. Over time, outdated plugins become easy targets, forms quietly stop sending and renewals lapse. Problems tend to surface at the worst time, and fixing them costs more than preventing them.
Can I print this checklist?
Yes. Print this page from your browser, or save the checklist image. Tick off each task as you go, and keep notes of what you updated and when. That record helps if something breaks later.
Sources
- State of WordPress Security in 2026, Patchstack
- Characteristics of Australian Business, 2024–25, Australian Bureau of Statistics, June 2026
- Security issues report, Search Console Help, Google
- Web Vitals, web.dev
- Renewing your domain licence, auDA
- Decreasing certificate lifetimes to 45 days, Let’s Encrypt, December 2025