Website maintenance: what actually needs doing every month

A website is not a brochure you print once. It runs on software that is constantly updated, it talks to other services, and it is a target for automated attacks every day. Regular maintenance is what keeps it working quietly in the background.

Here is what a sensible routine looks like for a typical small-business website, such as one built on WordPress.

Every month

• Update the core software, theme and plugins. Many updates fix security problems. Test updates on a copy of your site first if you can, so a conflict does not take the live site down.
• Check your backups. Make sure they are running, stored somewhere other than your web server, and that you know how to restore one. A backup you have never tested is a hope, not a plan.
• Review security alerts from your security plugin, host or firewall, and remove any user accounts that are no longer needed.
• Test your forms. Send a test enquiry through every form and confirm it arrives. Broken forms are one of the most common and most expensive problems we find.
• Check that the site is fast on a phone and that nothing obvious has broken on key pages.

Every quarter

• Remove plugins you no longer use. Every unused plugin is code that still needs updating and could still be exploited.
• Check for broken links and update or redirect them.
• Review Google Search Console for crawl errors, security issues and pages that have dropped out of the index.
• Refresh important content, such as prices, team details, opening hours and service descriptions.

Every year

• Check your domain and SSL certificate renewals, and make sure they are set to renew automatically using a card that will not expire.
• Review your hosting plan and whether it still suits your traffic and needs.
• Review your privacy policy and cookie banner against the tools you now use on the site.
• Confirm who has access to your hosting, domain, website and analytics accounts, and that you, the business owner, hold the main logins.

What happens if maintenance is skipped

Usually nothing, for a while. Then one day the site is slow, a form stops sending enquiries without anyone noticing, an expired certificate shows visitors a security warning, or an outdated plugin lets someone inject spam links. Each of these is far more expensive to fix than to prevent.

Doing it yourself or getting help

If you are comfortable with the steps above and have the time, a monthly hour with this checklist will keep most small sites in good shape. If you would rather not think about it, a care plan hands the whole routine to a team that does it every day, with monitoring that spots problems before your customers do.