A website maintenance checklist you can run yourself

A website maintenance checklist gets run only when every task on it has an interval; “check the site regularly” is the job that never comes around. This one sorts the work by how often it comes up: a short look each week, a longer pass each month, a few deeper jobs each quarter, and the renewals once a year. Like the rest of our maintenance guides, it is written for the owner who will run it, or hand it to whoever looks after the site.

Most of it applies to any website. Where a task belongs only to a self-hosted site, one whose software you or your host run (WordPress, usually), it says so, and the last section shows what Wix, Squarespace or Shopify take off your list.

What you need before the first run

• The three logins. Your domain registrar (the company you pay for the domain name), your hosting account, and the site’s own admin. If you can find only one or two, tracking down the rest is the first job.
• Google Search Console. Google’s free report on how its search engine reads your site, and where it flags errors and security problems. The setup asks you to prove you own the site and walks you through it.
• A log. A spreadsheet or a notebook with three columns: the date, what you checked, and what you found. It turns the list into a routine, and it is what you hand over if someone else takes the site on.
• A recent backup, on a self-hosted site. Nothing on this list should change the site without a copy to go back to.

Weekly website maintenance tasks

The weekly pass is about noticing early. A quiet brochure site can run it every other week; a site taking orders or bookings every day should not skip it.

• Open the home page, a busy inner page and the contact page on your phone. A broken layout is easiest to trace to its cause in the week it appears.
• Check that the newest backup carries this week’s date, in your host’s control panel or your backup tool. A schedule that has stopped running does not always say so.
• On a self-hosted site, look at the updates waiting. WordPress installs its own minor releases, the small security and maintenance fixes, unless someone switched that off; plugins (the separately installed extras that add features) and themes wait for you unless their auto-updates are on. Apply security releases straight away, give ordinary ones a few days, and back up first. Our WordPress maintenance page sets out the full order.
• On a site that takes orders or bookings, compare the week’s count with a normal week; a sudden drop to zero deserves a test order before you blame a slow week.

The monthly website maintenance checklist, step by step

Once a month, take these in order. Each one tests something that can fail without telling anyone.

1. Send every form yourself. Fill in each contact, quote, booking and sign-up form and confirm the message reaches the inbox it should. A form can show its thank-you message while the email behind it never arrives, so the inbox is the only proof.
2. Open Google Search Console. In the Pages report, look for new rows such as “Not found (404)” or “Server error (5xx)”, then open Security issues, which should report none. Search Console also emails a site’s owners when something important happens, so make sure the address on the account is one someone reads.
3. Note when the SSL certificate expires. The SSL certificate is what lets a browser open your site without a security warning. Click the icon at the left of the address bar, open the certificate details, and copy the expiry date into your log. Since March 15, 2026, a new certificate lasts 200 days at most, falling to 100 days in March 2027 and 47 in March 2029, so renewal has to happen by itself; a yearly look would find a failed one months after your visitors did.
4. Run the home page through PageSpeed Insights. Google’s free speed test scores a page out of 100 for phones and for computers; 90 or above counts as good. Log the phone score. It moves a few points between runs even when nothing has changed, so read the trend over months, not one test against the next.
5. Place a test order, if the site sells. Buy something inexpensive with a real card and refund it, or use your payment provider’s test mode where it has one, and follow the order through to the confirmation email.

Quarterly checks: restores, logins and old software

1. Restore a backup. A backup has proved itself only once it has been restored. Put the latest one onto a staging site, a private copy kept out of public view that some hosts set up in one click, and go through the main pages.
2. Delete what you have switched off. On WordPress and other self-hosted platforms, a deactivated plugin or theme leaves its files on the server, and a known flaw in those files can still be attacked. If you are not going to switch it back on, back up and delete it.
3. Review who can log in. Remove accounts for people who have left, replace any shared login with one per person, and turn on two-factor login wherever it is offered: the site, the host, the registrar, and the inbox their notices go to. Change a password when there is a reason to, not on a calendar.
4. Check the PHP version, on a self-hosted site. PHP is the programming language the server uses to run WordPress and many other platforms. Each version gets security fixes for 4 years after its release, then none; php.net lists the versions still covered, and in WordPress, Tools > Site Health > Info shows yours. The version is set in the hosting account, not in WordPress; back up before changing it and check the key pages after.
5. Read the site as a stranger would. Opening hours, prices, staff names, services you no longer offer, last season’s events, the year in the footer. Each takes minutes to fix, and each tells a visitor nobody is minding the site.

Yearly checks: renewals, accounts and policies

• The domain. Check the renewal date, that auto-renew is on, and that the card on file will still be valid that day. Registrars must send reminders about a month and again about a week before a domain expires, but only to the email address on the account, so keep that address current.
• The hosting. The renewal date, the plan you are paying for, and whose card pays for it.
• Who holds what. Write down which company has the domain, the DNS (the records that send visitors and email for your domain to the right servers), the hosting, the email and the site, and whose name each account is in. An account in a former employee’s or an old agency’s name is the one to move first.
• Paid licenses. Renewal dates for premium plugins, themes and any paid tools. A lapsed license stops the updates for whatever it covers.
• The privacy policy. Read it against what the site does today: its forms, its analytics, and anything added since it was written.

What changes on Wix, Squarespace or Shopify

On a hosted builder, the platform runs the servers and updates its own software, so part of a website maintenance checklist is not yours to run. The rest still is.

Tips

• Put each yearly date in your calendar the day you check it, with a reminder a month ahead, so no renewal depends on memory.
• If the list keeps slipping, that tells you something too. On a WordPress site, our website maintenance services take over the updates, the off-server backups and the downtime watch, with a written report each month. What website maintenance costs shows what providers charge for that work, and what the fee should cover.

If you want the site looked over before your first run, a person can read it from the outside, with no logins and no charge, and email you a written report within 3 business days. Get a free website health check