Website Maintenance Checklist for Small Businesses: Weekly, Monthly and Yearly Tasks

Most small business websites don’t fail all at once. A plugin falls 6 versions behind, a contact form quietly stops sending email, the SSL certificate lapses on a Saturday, and a customer sees a browser warning instead of your booking page. Each problem is small. Together they cost you leads you never knew you lost.

The fix is a simple, repeatable routine. This checklist splits website maintenance into weekly, monthly, quarterly and yearly tasks so you always know what to do and when. It works for WordPress, Wix, Squarespace, Shopify or a custom site, with notes where the platform changes the job.

What website maintenance actually covers

Website maintenance is the ongoing work that keeps a site secure, fast, accurate and findable. It falls into 5 buckets:

• Software updates: the platform core, themes, plugins and the server software underneath them.
• Backups and recovery: copies of your files and database, plus proof you can restore them.
• Security: user accounts, logins, certificates and monitoring.
• Performance and SEO health: page speed, broken links, indexing errors.
• Content: hours, prices, staff, offers, photos and legal pages that drift out of date.

How much of this you handle depends on your platform. On hosted builders such as Wix or Squarespace, the vendor patches the core software for you, so your list is mostly content, accounts and SEO. On a self-hosted WordPress site, you (or your developer) own all 5 buckets. If you are still choosing a platform, our comparison of WordPress vs Wix vs Squarespace covers that trade-off.

Weekly, monthly, quarterly and yearly tasks

Work through the list in 4 rhythms. The short weekly routine catches most problems early; the longer reviews keep the site current.

Weekly website maintenance tasks

These take 15 to 30 minutes. Put them on the calendar for the same day each week.

• [ ] Apply updates. Update plugins, themes and the platform core. WordPress has updated minor core releases (maintenance and security fixes) automatically since version 3.7, but plugins and themes still need attention unless you have turned on auto-updates for them.
• [ ] Confirm last night’s backup ran. Don’t assume. Open your backup tool or host dashboard and check the date and size of the latest copy.
• [ ] Test every form. Submit your contact, quote and booking forms and confirm the email or CRM entry arrives. Broken forms are the most common silent failure.
• [ ] Click through your top pages. Home, services, contact and any page that takes payments or bookings. Look for layout breaks after updates.
• [ ] Scan for spam. Delete spam comments and fake form entries, and check that no unknown pages or users have appeared.
• [ ] Read uptime alerts. If you use an uptime monitor, review any downtime it logged and ask your host about repeat outages.

Key takeaway: Updates and backups belong together. Always make sure a fresh backup exists before you click “update all”, so a bad plugin release is a 10-minute rollback instead of a lost weekend.

Monthly website maintenance tasks

Block about an hour once a month.

• [ ] Check page speed and Core Web Vitals. Google’s published “good” thresholds are a Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of real visits. PageSpeed Insights and the Core Web Vitals report in Search Console show where you stand.
• [ ] Review Google Search Console. Look at the Pages (indexing) report, any security or manual action notices, and queries that are gaining or losing clicks. New to the tool? Start with our Google Search Console guide.
• [ ] Fix broken links. Run a link checker and repair or redirect anything returning a 404, especially links from your Google Business Profile and ads.
• [ ] Audit user accounts. Remove former staff and contractors, downgrade anyone who doesn’t need admin rights, and make sure every admin uses multi-factor authentication.
• [ ] Remove unused plugins and themes. Deactivated code can still be exploited if it stays installed. Delete what you don’t use.
• [ ] Check your Google Business Profile. Hours, holiday hours, photos and the website link should match your site exactly. Our guide to Google Business Profile optimization lists every field.
• [ ] Update time-sensitive content. Promotions, event dates, menus, pricing and staff bios.

Quarterly website maintenance tasks

Every 3 months, step back and look at the bigger picture.

• [ ] Test a restore. Restore a backup to a staging site or a spare folder and confirm the site actually works. CISA advises businesses to test backup procedures so they can restore data fully and partially.
• [ ] Run a technical SEO pass. Check redirects, duplicate titles, sitemap status and mobile usability. Our technical SEO checklist walks through it without developer jargon.
• [ ] Run an accessibility spot check. Test keyboard navigation, color contrast, image alt text and form labels on your key pages. See our web accessibility checklist for the WCAG 2.2 items to check.
• [ ] Review analytics. Which pages bring leads? Which ones get traffic but no action? Plan content updates around the answer.
• [ ] Check server software versions. Ask your host which PHP or Node version your site runs and whether it is still supported. Unsupported versions stop getting security fixes.

Yearly website maintenance tasks

Once a year, ideally in your slow season:

• [ ] Renew your domain and turn on auto-renew. Under ICANN’s Expired Registration Recovery Policy, registrars must send renewal reminders roughly 1 month and 1 week before expiration, to the registrant email on file. If that email is old, you won’t see them. Update your contact details and use an address that isn’t on the same domain.
• [ ] Review your SSL/TLS certificate setup. Certificate lifetimes are shrinking. Under CA/Browser Forum Ballot SC-081, the maximum validity for public TLS certificates dropped to 200 days on March 15, 2026, and is scheduled to fall to 100 days in March 2027 and 47 days in March 2029. If your certificate isn’t renewed automatically, fix that now.
• [ ] Review hosting and plans. Compare what you pay with what you use. Check storage, bandwidth and whether your plan includes backups and a staging site.
• [ ] Refresh core pages. Rewrite your home, about and top service pages with current photos, offers and proof such as reviews and case examples.
• [ ] Review legal pages. Privacy policy, terms and cookie notices should reflect the tools you actually use. Our guide to whether your website needs a privacy policy explains the state laws involved. This is not legal advice.
• [ ] Audit third-party tools. Remove tracking scripts, chat widgets and integrations you no longer pay for or use. Each one adds weight and risk.
• [ ] Document everything. Keep one secure document listing your registrar, host, platform, admin accounts (not passwords), backup location and who to call.

Website maintenance checklist at a glance

Backups: the one task you can’t skip

If you only do one thing on this list, make it backups. Ransomware, a hacked plugin, a bad update or a host outage can all wipe out a site. Our guide to ransomware protection for small businesses covers the wider picture, but for a website the basics are:

1. Follow the 3-2-1 rule. CISA recommends 3 copies of important data (1 primary, 2 backups), on 2 different types of storage, with 1 copy offsite.
2. Back up files and the database. A WordPress site has both. A backup of only the files will not bring back your posts, orders or form entries.
3. Keep at least 1 copy away from your host. If your hosting account is compromised or closed, backups stored only inside it go with it.
4. Match frequency to change. A brochure site may be fine with weekly backups. A store or booking site that changes hourly needs daily or real-time backups.
5. Test restores. A backup you’ve never restored is a hope, not a plan.

Hosted builders handle server-level backups, but they don’t always let you export everything. Check what your platform lets you download and keep your own copies of images, product data and content.

Should you do it yourself or pay for a maintenance plan

You have 3 realistic options:

Pricing varies widely by site size, platform and what’s included, so ask for a written scope and compare what each plan covers rather than the monthly figure alone. If you are budgeting a rebuild at the same time, our guide on how much a website costs breaks down the pricing models.

Where to start this week

If your site has had no maintenance for a while, don’t try to do everything at once. Follow this order:

1. Take a full backup and download a copy to somewhere outside your host.
2. Remove old admin accounts and turn on multi-factor authentication for everyone left.
3. Update everything, one plugin at a time if the site is very out of date, checking the site after each.
4. Test your forms and fix any that fail.
5. Turn on domain auto-renew and confirm your registrant email is current.
6. Put the weekly and monthly tasks in your calendar as recurring events.

That first session might take 2 to 3 hours. After that, the weekly routine is short.

Conclusion

Website maintenance isn’t glamorous, but it protects the asset that answers customer questions at 11 p.m. and books jobs while you sleep. Keep updates and backups weekly, health checks monthly, restore tests quarterly, and renewals and content refreshes yearly. If that’s more than you want to manage, hand it to a provider with a written checklist, and keep this one to check their work. For more local marketing basics, see our local SEO checklist and browse our top lists.

Sources

• WordPress Developer Resources: Upgrading WordPress — automatic background updates since 3.7 and backup advice
• web.dev: How the Core Web Vitals metrics thresholds were defined — LCP, INP and CLS thresholds
• CA/Browser Forum: Ballot SC-081v3 — reduction of TLS certificate validity from 398 to 47 days
• DigiCert: TLS certificate lifetimes will officially reduce to 47 days — interim dates of the validity schedule
• ICANN: Expired Registration Recovery Policy — domain renewal reminder timing
• CISA: Back Up Business Data — 3-2-1 backup rule and restore testing