Websites rarely break with a bang. They break quietly: a security certificate expires, a plugin update breaks the checkout, a contact form stops delivering messages, or a hacked site starts showing spam pages to Google while it looks perfectly normal to its owner. We have cleaned up all of these, and almost every one would have been caught by a simple routine.
This checklist is that routine. It works for WordPress, Shopware, Shopify and most other platforms; only the tools differ.
Always on: set it up once
These run automatically in the background. If you don’t have them yet, start here.
- Uptime monitoring. A service checks your site every few minutes and alerts you the moment it goes down, so you hear it from a tool, not from a customer.
- Daily backups, stored off the server. A backup that lives on the same server as the website disappears together with it. Keep copies somewhere else, and keep several days, not just the latest one.
- Security monitoring. Alerts for new administrator accounts, changed core files and malware. Hacked sites are often used for spam for weeks before anyone notices.
- Automatic SSL renewal. An expired certificate makes browsers show a full-page security warning. Most hosts renew automatically, but check that yours does.
Every week
- Install updates for the CMS, plugins and theme. Make a backup first. For big updates (a new major version, a shop plugin), test on a staging copy before updating the live site.
- Click through the key pages after updating: homepage, a service or product page, the contact page and, for shops, the cart and checkout.
- Read your security and uptime alerts. A handful of failed logins is normal; hundreds per hour, or a new admin user you don’t know, are not.
Every month
- Test every form for real. Send a test message and check three things: it arrives, it doesn’t land in spam, and pressing “Reply” goes to the sender’s address. A setting as small as the wrong reply-to address means every reply to a new inquiry goes to yourself instead of the customer.
- Place a test order if you run a shop, including payment and the confirmation email.
- Check Google Search Console for pages that can’t be indexed, security issues and sudden drops in clicks. If pages you never created show up, your site may be hacked.
- Look for broken links, especially links to pages you have renamed or deleted. Redirect old addresses to their new pages.
- Run a speed test on PageSpeed Insights for your most important pages and compare it with last month. New plugins, scripts and large images slow sites down gradually. (Our guide to why WordPress websites get slow explains the usual causes.)
- Review user accounts. Remove people who no longer need access, and make sure every administrator uses a strong password and, ideally, two-factor authentication.
Every three months
- Restore a backup to a test environment. A backup you have never restored is only a hope.
- Remove plugins and themes you don’t use. Inactive plugins can still contain security holes.
- Check the server software. Is your PHP version still supported? Is the database up to date?
- Review your content. Outdated prices, old team members, last year’s opening hours and dead offers cost trust.
- Do a quick accessibility check: can you use the site with the keyboard only, is the text readable, do images have descriptions?
Every year
- Check renewal dates for your domain, hosting and paid plugins or licenses. An expired domain takes your website and your email offline at once.
- Update your legal pages, such as the privacy policy and legal notice, when you add or remove tools and services.
- Review your setup: which tracking, chat or marketing tools are still in use, and which can go?
- Look at the bigger picture. Does the site still reflect your business? Which pages bring visitors and inquiries, and which don’t? This is where small improvements or a redesign start.
The checklist at a glance
| Task | How often |
|---|---|
| Uptime and security monitoring, off-site backups, SSL renewal | Always on |
| Updates with a backup first, check key pages afterwards | Weekly |
| Test forms and checkout, Search Console, broken links, speed, user accounts | Monthly |
| Test a backup restore, remove unused plugins, server software, content review | Every 3 months |
| Renewal dates, legal pages, tools review, overall review | Yearly |
Signs your website needs attention now
- The site, or the admin area, has become noticeably slower
- Inquiries have dropped, even though traffic hasn’t
- Google Search Console shows pages or search terms you don’t recognize
- Your hosting company has warned you about resource usage or malware
- Updates haven’t been installed for months because “something might break”
Do it yourself, or hand it over
Everything on this list can be done in-house if someone has the time and checks it reliably. Many businesses prefer to hand it over, so that updates, monitoring and fixes happen without anyone having to remember them. That is exactly what our website maintenance and monitoring service covers: regular manual checks by our team, plus automated 24/7 monitoring that alerts us the moment something goes wrong.
Not sure what state your website is in? Request a free audit or send us a message.