The Website Maintenance Checklist for Small Businesses: Weekly, Monthly, Quarterly and Yearly

A website rarely breaks in a way anyone notices on the day it happens. A plugin falls a few versions behind. The contact form stops delivering after a hosting change, and nobody tests it. A marketing script added for one campaign stays for three years and slows every page. The domain auto-renewal fails because the card on file expired. Months later, someone asks why inquiries have dried up.

Maintenance is how you catch those problems while they're still small. This checklist is the routine we recommend to small businesses, split by how often each task needs doing. It works for WordPress, Shopify, Webflow or a custom-built site; only the specifics of updating differ.

Why maintenance matters more than it looks

• Security: outdated software, especially plugins and themes, is one of the most common ways small business sites get compromised
• Leads: broken forms, booking widgets and phone links lose inquiries silently, and nothing on the site tells you
• Search visibility: slow pages, broken links and indexing errors gradually erode rankings
• Accessibility: new content added without alt text or proper headings adds up, and for US businesses inaccessible sites carry ADA-related legal risk
• Availability: an expired domain or SSL certificate can take the whole site offline or show visitors a security warning

Weekly: a ten-minute health check

• Submit your own contact form and confirm the message arrives in the right inbox
• Open the homepage and one key service or product page on your phone
• Check that your uptime monitor hasn't reported outages, and set one up if you don't have one yet
• Confirm the automatic backups actually ran
• Skim any security or update notices from your platform or hosting provider

The form check is the one people skip, and it's the one that matters most. Forms fail for mundane reasons: an email provider change, a spam filter, an expired API key, a plugin update. The page still says "Thanks, we'll be in touch," and the lead goes nowhere.

Monthly: updates and a look at the data

• Apply core, theme and plugin updates, testing on a staging copy first where possible, and apply urgent security updates as soon as they're released rather than waiting for the monthly slot
• Remove plugins, themes and apps you no longer use instead of just deactivating them
• Review Google Search Console for indexing errors, Core Web Vitals problems, security issues and manual actions
• Compare traffic and conversions in your analytics with the previous month and look into any sudden drop
• Test every conversion path end to end: contact forms, quote requests, booking, checkout and click-to-call links
• Scan for broken links and fix or redirect them
• Review admin and editor accounts, and remove anyone who no longer needs access

Quarterly: the checks that prevent expensive surprises

• Restore a recent backup to a staging environment and confirm the site works, because a backup you've never restored is a hope, not a backup
• Run your top pages through Google PageSpeed Insights and compare with last quarter (our Core Web Vitals guide explains what to fix)
• Do an accessibility spot check: navigate with the keyboard only, check that images have meaningful alt text, and confirm form fields have labels
• Review content for anything out of date: prices, opening hours, team members, service areas, offers and the footer copyright year
• Audit third-party scripts and tag manager tags, and remove anything tied to a finished campaign or tool you've stopped using
• Check that your privacy policy and cookie banner still match the tools the site actually uses

“The most expensive maintenance problems are the ones nobody was checking for: the backup that won't restore, the form that stopped sending, the domain that lapsed.”

Yearly: renewals, access and the bigger picture

• Confirm domain and SSL renewals are set to renew automatically, and that the payment method on file is still valid
• Check that you can log in to your domain registrar, DNS, hosting and email provider, and that two-factor authentication is on for each
• Check that your platform, hosting environment and major dependencies are still supported, and plan upgrades before anything reaches end of life
• Review whether your hosting plan still fits your traffic and performance needs
• Do a full content and SEO review: which pages bring in traffic and leads, which are thin or outdated, and what's missing
• Decide honestly whether the site still fits the business, or whether it's time for a redesign or rebuild

Security basics that prevent most problems

Most small business security incidents aren't sophisticated. They come from reused passwords, old plugins and admin accounts nobody remembers creating. A handful of habits cover most of the risk:

• Turn on two-factor authentication for the site admin, hosting, domain registrar and business email
• Use a password manager, with a unique password for every account
• Give people the lowest level of access they need, and remove it when they leave
• Keep software updated, and delete what you don't use
• Keep backups off-site, so a compromised server doesn't take the backups down with it
• Serve the entire site over HTTPS

Know who owns what

A surprising number of businesses discover they don't control their own website only when the person who built it becomes unreachable. Make sure the business, not a freelancer or agency, owns the admin login for each of these, and keep the details in a shared password manager:

• Domain registrar and DNS
• Hosting account
• Website or CMS administrator account
• Business email provider
• Google Analytics and Google Search Console
• Google Business Profile (our local SEO checklist covers how to set it up properly)
• Any payment, booking or form services the site depends on

Do it yourself or hire someone?

For a simple brochure site, doing this yourself is realistic, provided one named person owns the checklist and the recurring reminders are in a calendar. It makes sense to hand it off when the website directly brings in revenue, when you run ecommerce or custom functionality, when updates need to be tested before they go live, or when the checklist keeps slipping because nobody has time.

If you do hire help, such as a website maintenance service, ask exactly what's included: how updates are tested, how often backups are restored as a test, what's monitored and who responds when something breaks, how much editing time is included each month, and whether you get a regular report of what was done.

Where to start

Pick an owner today. Put the weekly check in their calendar, run this month's list this week, and schedule the first quarterly backup restore. If the first pass turns up more problems than you expected (plugins years out of date, forms that don't deliver, accounts nobody can log in to), that's a sign the site needs more than routine maintenance, and it's worth getting a second opinion on what to fix first.

Frequently asked questions