blog / speed & technical / 12 min read
Website Maintenance Checklist: Weekly, Monthly, Quarterly, Yearly
short answer
The short answer
02 · speed & technical
Why you need a website maintenance checklist (not good intentions)
Every site owner intends to "keep an eye on it." Then a busy quarter happens, and six months later a plugin is three major versions behind, the contact form has been silently failing and nobody remembers the hosting login.
A checklist fixes that by turning vague worry into small, boring, repeatable jobs. Boring is the goal. When maintenance is boring, emergencies are rare.
"My site has auto-updates switched on, so it maintains itself."
Auto-updates install code. They don't check that your checkout still works afterwards, that your backups can be restored or that your domain renews on time. Automation does the typing; someone still has to look.
03 · speed & technical
Weekly: the 15-minute pulse check
Weekly tasks are about noticing problems early. You aren't fixing much here, just confirming the basics are alive. Tick these off as you go; the page keeps score.
Weekly pulse check
If any of these fail two weeks running, that's no longer maintenance. That's a project, and it deserves a proper look.
04 · speed & technical
Monthly website maintenance checklist
The monthly website maintenance checklist is where the real work lives: updates, performance, search health and security. Block out a recurring slot in your calendar and protect it like a client meeting.
Five monthly jobs
Update everything, safely
Apply core, theme and plugin updates on a staging copy first, test key pages, then push to the live site.
Read Search Console
Check the Pages report for new indexing problems, the Core Web Vitals report and the Security issues and Manual actions sections.
Run a speed check
Test your top pages against Google's thresholds: LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1.
Fix broken links
Crawl the site for 404s and broken outbound links. Redirect moved pages with 301s.
Review the numbers
Compare traffic, inquiries and top pages against last month. Flat is fine; sudden drops need a reason.
Search Console deserves a special mention because it's free and it's Google telling you directly what it sees. If the reports look like hieroglyphics, my Google Search Console guide explains every report that matters.
Speed is the other monthly job people skip. A site that gets a little slower every month never triggers an alarm, until one day it's noticeably sluggish. If you're already there, read why your WordPress site is so slow for the usual culprits.
05 · speed & technical
Quarterly: the deep clean
Every three months, step back from the routine and ask harder questions. These are the jobs that feel optional right up until the day they aren't.
- 01
Test a full restore — Restore last week's backup to a staging site and click around. A backup you've never restored is a hope, not a plan.
- 02
Audit user accounts — Remove former staff and agencies. Downgrade anyone who doesn't need administrator access.
- 03
Remove unused plugins and themes — Deactivated code can still be a target. If you don't use it, delete it.
- 04
Review your top content — Update outdated prices, team members, service details and screenshots on your most visited pages.
- 05
Check forms end to end — Confirm every form's notifications reach the right people and that auto-replies still make sense.
- 06
Run a technical crawl — Look for redirect chains, duplicate titles, missing meta descriptions and orphan pages.
The technical crawl can get deep quickly. My technical SEO audit checklist ranks the checks by impact, so you fix what matters before polishing what doesn't.
06 · speed & technical
Yearly: the big-picture review
Once a year, look at the things that only break on anniversaries.
- CRITICAL
Domain renewal — Confirm the renewal date, turn on auto-renew and make sure the registrar account uses a current email and card.
- CRITICAL
Hosting review — Is your plan still the right size? Is your PHP version still receiving security support? php.net lists supported versions.
- IMPORTANT
SSL certificate — Most certificates renew automatically now, but confirm renewal is actually working, especially after a hosting move.
- IMPORTANT
Legal pages — Review your privacy policy and cookie consent against the tools you actually use today.
- WORTH IT
Design and accessibility check — Does the site still reflect your business? Can someone navigate it with a keyboard alone?
- WORTH IT
Access inventory — Document every login: registrar, hosting, DNS, analytics, Search Console, email. Store them in a password manager.
Expired domains don't send warning letters to the person who left two years ago. They just expire.
07 · speed & technical
WordPress website maintenance checklist: the extra bits
WordPress powers a huge share of the web, which is great for flexibility and makes it a popular target. A WordPress website maintenance checklist needs everything above, plus a few platform-specific habits.
Most of my maintenance work is on WordPress, because most of the sites I build are custom themes and plugins. If yours was built by someone who's since disappeared, WordPress development support can untangle the code before you start updating it.
WordPress maintenance checklist: updating without breaking things
Updates are where WordPress sites break. This sequence keeps that risk small. Treat it as the WordPress maintenance checklist you follow every single month.
- 01
Back up first — Take a fresh full backup (files and database) before touching anything.
- 02
Read the changelogs — Major version jumps deserve extra caution; minor security releases should go in promptly.
- 03
Update on staging — Apply updates to a copy of the site, not the live one.
- 04
Update in order — Plugins first, then themes, then core, testing as you go so you know which update caused a problem.
- 05
Test what earns money — Forms, checkout, booking, login and your top landing pages.
- 06
Push live and recheck — Clear caches and test the same pages on the live site.
WordPress security checklist
Security isn't one plugin. It's a set of habits that remove easy wins for attackers. Here's my WordPress security checklist, written as the red flags I look for first.
WordPress security red flags
- An account called "admin" with administrator rights — the first username bots try.
- No two-factor authentication on admin accounts — passwords alone get leaked and reused.
- Everyone is an administrator — give editors and authors only the role they need.
- Plugins from unknown sources or "nulled" premium plugins — these are a classic route for malware.
- Backups stored only on the same server — follow the 3-2-1 rule: three copies, two types of storage, one off-site.
- The theme and plugin file editor is switched on in wp-admin — a stolen login becomes a code-editing session.
- An outdated PHP version — old versions stop receiving security fixes.
Some of those fixes take one line. These go in wp-config.php, above the line that says "That's all, stop editing!":
// Disable the theme and plugin file editor in wp-admin
define( 'DISALLOW_FILE_EDIT', true );
// Install minor core (security and maintenance) releases automatically
define( 'WP_AUTO_UPDATE_CORE', 'minor' );
// Never display PHP errors to visitors on the live site
define( 'WP_DEBUG', false );Then open Tools → Site Health in your dashboard. It's built into WordPress and flags outdated PHP, inactive plugins, missing HTTPS and more.
08 · speed & technical
Website maintenance checklist template
Here's the whole thing as one website maintenance checklist template. Copy it into a spreadsheet, add an "Owner" column and a "Last done" date, and you've got a system.
09 · speed & technical
How much does website maintenance cost?
The honest answer to "how much does website maintenance cost?" is that it depends on what you're paying for. Four things drive the price:
- Size and complexity — a five-page brochure site needs far less attention than a WooCommerce store with dozens of plugins.
- What's included — updates and backups only, or also speed work, SEO monitoring, content edits and emergency fixes.
- Response time — "we'll look at it next week" costs less than "we'll fix it today."
- Tools — premium backup, security and monitoring services each carry their own subscription.
My own care plans start at $99 a month and are listed on my pricing page. If you're budgeting for a new build at the same time, my breakdown of how much a website costs covers the build side. Here's a quick way to decide between doing it yourself and handing it over.
Maintenance Cost Calculator
This tool needs JavaScript to run.
Do it yourself
Works when the site is small, you're comfortable with a staging site and backups, and you'll genuinely block out the time. You save money and learn your site. The risk is the month you skip it.
Hand it over
Works when your time is worth more spent on the business, the site earns real revenue or you'd struggle to recover from a failed update. A website maintenance plan turns this whole checklist into someone else's job, with reports so you can see it's done.
Not sure how far behind your site already is? My free website audit checks updates, security basics, speed and Search Console health, and gives you a prioritized to-do list.
What should a website maintenance checklist include?
At minimum: off-site backups, core, theme and plugin updates, uptime monitoring, form testing, security checks, speed checks, broken link fixes and a Search Console review. Add quarterly restore tests and user audits, plus yearly domain, hosting, SSL and legal reviews. Group tasks by frequency so each session stays short and nothing gets forgotten.
How often should I update WordPress plugins?
Review the updates queue weekly and apply updates at least monthly, on a staging copy first. Security releases deserve faster action, ideally within days of release. Major version jumps need more caution, so read the changelog and test your forms, checkout and key pages before pushing them live.
Do I need a security plugin for WordPress?
A good security plugin helps with firewall rules, login protection and malware scanning, but it doesn't replace habits. Strong unique passwords, two-factor authentication, least-privilege user roles, timely updates, trusted plugin sources and off-site backups do most of the work. Choose one reputable security plugin rather than stacking several that overlap.
How much does website maintenance cost for a small business?
It depends on site size, what's included, response time and the tools involved. A simple brochure site with updates and backups costs far less than an online store with speed, SEO and emergency support. My plans start at $99 a month. Use the calculator above to compare a quote with the value of your own time.
Can I use this as a website maintenance checklist template?
Yes. Copy the table above into a spreadsheet, add columns for owner and last completed date, and set recurring calendar reminders for each frequency. If several people share the work, assign each row to one named person. Shared responsibility tends to become nobody's responsibility.
What happens if I stop maintaining my website?
Nothing dramatic at first, which is the trap. Over time, outdated plugins become security risks, speed slowly declines, broken links and forms pile up, and a single failed update can take the site offline with no clean backup to restore. The longer the gap, the bigger and costlier the eventual catch-up job.
free audit
Make maintenance someone else's job
This website maintenance checklist works whether you run it yourself or hand it over. If you'd rather know exactly where your site stands first, I'll audit it and send a short, plain-English list of what needs attention now, what can wait and what's fine.
Free audit · No obligation · Reply within one business day
keep reading