Website Maintenance Checklist for Business Owners

Website maintenance Website maintenance protects customer journeys, business access and the facts shown on each page.

Nothing on the screen tells you that something behind it has failed. A form may no longer deliver email, a backup may be impossible to restore, or an expired card may be days away from suspending a domain. Maintenance is the routine used to find those problems before a customer does.

Assign every task to a named role and record the result. “The agency handles it” is not enough unless the agreement identifies what is monitored, how incidents are reported and what remains the business’s responsibility.

Every month: test the customer journey

• Open priority pages on a phone and desktop browser.
• Submit each important contact, quote, booking or application form.
• Confirm the visitor sees an accurate success message.
• Check the message reaches the intended inbox or CRM with complete details.
• Test key phone, email, map, download and checkout links.
• Review error monitoring and uptime alerts for recurring incidents.

Use a clearly labelled test identity and remove it from commercial reporting. A visual check of the form is not a substitute for verifying delivery.

Every month: review software and security

Apply supported updates for the content management system, framework, extensions and server packages. Read release notes for significant changes and take a current backup before risky updates. Test the priority journey again afterwards.

Remove unused extensions and themes rather than leaving them disabled indefinitely. Confirm security certificates are valid and automated renewal is operating. Review security alerts for the domain and hosting accounts.

Website maintenance is only one part of wider account, device and access work.

Every month: verify backups

Confirm that scheduled backups completed for both files and databases. Keep at least one copy outside the live hosting account so a provider or account failure does not remove every version.

A successful backup message does not prove recovery. Schedule restore tests into a separate safe environment. Record how long recovery takes and which credentials or supplier contacts are needed.

Every quarter: check business information

• Prices, service descriptions and delivery expectations.
• Phone numbers, email addresses, opening hours and service areas.
• Staff or company information that is publicly presented.
• Policies, consent wording and third-party providers.
• Portfolio examples, downloads and external references.
• Copyright dates only where they are meaningful and correctly generated.

Remove claims that cannot be verified and mark demonstrations clearly. A stale fact can mislead a customer even when the page itself loads perfectly.

Every quarter: review access

Export a list of administrator, editor, hosting, domain, analytics and integration accounts. Remove people and suppliers who no longer need access. Give each person their own account instead of sharing one password, and require multi-factor authentication where available.

Check who controls recovery email addresses and phone numbers. The business should not depend on a former employee or supplier to reset a critical account.

Every quarter: inspect performance and accessibility

Test several representative pages, not only the homepage. Look for oversized new images, scripts added by marketing tools and layout shifts caused by embeds. Compare results with previous checks so gradual deterioration is visible.

Use keyboard navigation, zoom the text and check important forms with labels and visible errors. Automated accessibility tools are useful for finding patterns but do not replace trying the actual journey.

Every quarter: examine search and analytics health

Review crawl errors, indexing changes and important broken links. Check that sitemap and robots files still reflect the public site. Confirm analytics is receiving data only where the required consent has been obtained and that important conversion events still represent completed actions.

Traffic changes are a reason to investigate, not proof that the website is technically broken. Check seasonality, campaigns, tracking changes and search visibility before drawing conclusions.

Every year: verify ownership and continuity

• Use the domain renewal and ownership checklist to confirm registrant details, renewal method and expiry date.
• Review hosting capacity, support and recovery arrangements.
• Inventory paid licences and subscriptions.
• Export or document essential configuration and integration details.
• Review supplier agreements, responsibilities and exit arrangements.
• Run a recovery exercise using the current backup and documentation.

Record where source files, brand assets and technical documentation are stored. If the current maintainer became unavailable, another competent person should be able to identify the accounts, restore service and contact the right providers.

Keep a small maintenance log

For each check, record the date, person, result, action and completion date. This does not need a complicated platform; a controlled ticket list or table is enough. The log prevents the same warning being rediscovered every month without an owner.

Twelve months of a maintenance log

A veterinary practice keeps a one-page log. Over a year it records eleven entries, and the pattern in them is the useful part.

Four are routine updates. Two are certificate renewals. One is a form that stopped delivering to the practice manager’s inbox after her email address changed in March and was caught in April’s journey test, thirty-one days of lost enquiries rather than a year of them. One is a broken booking link after a supplier changed their URL structure. Two are performance regressions traced to uncompressed images uploaded by a member of staff. One is the discovery, during the annual ownership check, that the domain was registered to a former employee’s personal account.

That last one took two months to unpick. Everything else took under an hour. The log is what made the difference visible.

Sources and further reading

• NCSC Small Business Guide — UK National Cyber Security Centre advice covering backups, malware, devices, passwords and phishing.
• W3C WCAG overview — the standards reference behind the accessibility review in this checklist.

If you want these checks handled under a written scope, review our website maintenance and support service and confirm what your current hosting provider already covers.

Quick website maintenance action plan

1. Test key forms each month. Write down the result. Name one owner.
2. Apply safe software updates. Test this step. Keep proof of the test.
3. Check that backups can restore. Use real data. Check each fact.
4. Review user access each quarter. Ask one user. Note what feels hard.
5. Check domain and card dates. Fix each fault. Run the check again.
6. Test speed on key page types. Set a due date. Review the result.
7. Review search and analytics health. Write down the result. Name one owner.
8. Keep a short maintenance log. Test this step. Keep proof of the test.
9. Choose one clear goal. Use real data. Check each fact.
10. Name the owner for each task. Ask one user. Note what feels hard.
11. Test the full path before launch. Fix each fault. Run the check again.
12. Set the next review date. Set a due date. Review the result.
13. Keep the plan where staff can find it. Write down the result. Name one owner.
14. Use plain words in each note. Test this step. Keep proof of the test.
15. Save proof for each key check. Use real data. Check each fact.
16. Fix one issue at a time. Ask one user. Note what feels hard.
17. Check the result with a real user. Fix each fault. Run the check again.
18. Remove work that does not help the goal. Set a due date. Review the result.
19. Share each major change with the team. Write down the result. Name one owner.
20. Run the same checks after each update. Test this step. Keep proof of the test.
21. Check the source of every key fact. Use real data. Check each fact.
22. Keep private data out of public notes. Ask one user. Note what feels hard.
23. Plan what to do when a check fails. Fix each fault. Run the check again.
24. Give each choice a clear reason. Set a due date. Review the result.
25. Keep old files until new work is proven. Write down the result. Name one owner.
26. Ask for help when the risk is high. Test this step. Keep proof of the test.
27. Check phone and desktop views. Use real data. Check each fact.
28. Make the next step easy to find. Ask one user. Note what feels hard.
29. Track the result that matters most. Fix each fault. Run the check again.
30. Close each task when proof is saved. Set a due date. Review the result.

Use this website maintenance plan as a live check. Keep the notes short. Review the work after each major change.