Website Maintenance Checklist for Small Business Owners
By Nemanja Vukmirović, Lizzard Solutions. Last updated 10 November 2026.
Most small business websites don’t break in one dramatic moment. A plugin goes unpatched, the contact form quietly stops sending, the certificate expires on a Sunday, and nobody notices until a customer calls to ask whether you’re still in business.
This website maintenance checklist stops that slow decay. You get the exact tasks to do weekly, monthly, quarterly and yearly, a split of what the owner can handle and what needs a developer, and a worked example for a typical ten-page service site.
TL;DR
- Website maintenance is the recurring work that keeps a live site secure, fast, findable and able to send you leads.
- Weekly checks take minutes: backups ran, forms deliver, the site is up. Updates, Search Console and speed belong to the monthly slot.
- Once a year, check every renewal date: domain, hosting, certificate and paid plugins. An expired domain can take your email down with it.
What Is a Website Maintenance Checklist?
A website maintenance checklist is a schedule of recurring tasks that keep a live website working: software updates, backups, security checks, form and speed tests, search monitoring and renewals. It turns “someone should look at the site” into dated, owned jobs, so problems are found by you, not by your customers or an attacker.
It is different from a one-off review. A website audit checklist tells you where the site stands today. Maintenance keeps it there after the fixes are done. Building a new site? Run our website launch checklist before it goes live.
| Website audit | Website maintenance | |
|---|---|---|
| When | Once, or before a redesign | Every week, month, quarter and year |
| Goal | Find what is wrong | Stop it from going wrong again |
| Output | A prioritized fix list | A routine with owners and dates |
| Typical trigger | Low leads, a new agency, a relaunch | Always on, like servicing a car |
Key takeaway
An audit is a snapshot. Maintenance is the habit. Without it, the fixes from your last audit slowly undo themselves.
Action for today: open a shared calendar and create four recurring reminders named Weekly, Monthly, Quarterly and Yearly site check.
Weekly Website Maintenance Tasks (10 Minutes)
Weekly checks catch the failures that cost you leads right now. None of them needs technical skills.
- ☐ Backups ran. Open your hosting panel or backup plugin and confirm last night’s backup exists and isn’t empty.
- ☐ Contact form delivers. Send yourself a test message and confirm it lands in the right inbox, not spam.
- ☐ Site loads on your phone. Open the homepage and one service page on mobile data, not office Wi‑Fi.
- ☐ No security alerts. Read emails from your host, security plugin or Search Console instead of archiving them.
- ☐ Spam is under control. If junk submissions are rising, apply the fixes in our contact form spam protection guide.
A form that stopped sending is the most expensive silent failure on a small business site. You don’t get an error. You just get fewer enquiries.
Action for today: send a test message through your contact form and time how long it takes to arrive.
Monthly Tasks: Updates, Speed and Search
Monthly work is where most security risk is removed. Outdated software is one of the easiest ways into a site, which is why CISA’s advice on keeping software updated lists updates among the basics for everyone.
Software updates
- Update the CMS core, theme and plugins. On WordPress, follow WordPress’s official guide to updating and take a backup first.
- Update on a staging copy first if the site has a shop, bookings or custom code.
- Remove plugins and themes you don’t use. Disabled code can still be vulnerable.
- After updating, re-test the contact form, checkout and login.
Speed and search health
- Check the homepage and your top service page with a speed test. Our Core Web Vitals guide explains what LCP, INP and CLS mean.
- Open Google Search Console and read the Pages and Security reports for new errors.
- Fix broken internal links and 404 pages that appeared after content changes.
- Review who has admin access and remove anyone who no longer needs it.
Example
A clinic adds a new booking plugin and the mobile menu stops opening. A monthly check after updates catches it in days. Without the check, it could stay broken until someone complains.
Action for today: list every plugin or extension on your site and mark the ones you can delete.
Quarterly Tasks: Test the Things You Assume Work
Quarterly checks prove that your safety nets actually hold. These are the tasks most teams skip, and the ones that matter most on a bad day.
- ☐ Restore a backup. Restore last week’s backup to a staging site. A backup you have never restored is a hope, not a plan. See our 3-2-1 data backup guide.
- ☐ Check security headers and HTTPS. Use our security headers checklist or run the free website security check.
- ☐ Refresh key pages. Update prices, team, opening hours and service descriptions that have changed.
- ☐ Review analytics. Compare enquiries and top pages with the previous quarter and note what dropped.
- ☐ Check third-party scripts. Remove old tracking pixels, chat widgets or embeds nobody uses. Each one adds weight.
Action for today: book one hour this quarter to restore a backup to a test location.
Yearly Tasks: Renewals, Legal Pages and a Bigger Review
Yearly tasks are about dates and decisions. The risk here is not hackers. It is an expired domain or a forgotten card on a hosting account.
- Domain renewal. Confirm the expiry date, auto-renew and the contact email at the registrar. For .rs domains, our .rs domain registration guide explains how registrars work.
- SSL certificate. Free certificates from Let’s Encrypt last 90 days and are designed to renew automatically, per the Let’s Encrypt FAQ. Confirm auto-renewal works, and note the expiry date of any paid certificate.
- Hosting and paid plugins. List every subscription, its renewal date and which card pays for it.
- Privacy policy and cookies. Check they still match the tools you use. Serbian sites can use our ZZPL website guide.
- Technology review. Decide whether the CMS, theme and hosting still fit, or whether a rebuild is cheaper than another year of patches.
Key takeaway
Put every renewal date in one place with a company email as the contact, not a personal address of someone who might leave.
Action for today: look up your domain’s expiry date and add it to the calendar with a reminder 30 days before.
Who Does What: Owner vs Developer
You don’t need a developer for every task. You need one for the tasks where a mistake can take the site down.
| Task | Owner or office staff | Developer or IT partner |
|---|---|---|
| Form test, mobile check, alerts | Yes | No |
| Content and price updates | Yes | Only for layout changes |
| CMS and plugin updates | Simple sites only | Shops, bookings, custom code |
| Backup restore test | Can watch | Yes |
| Security headers, server config | No | Yes |
| Renewals and subscriptions | Yes, with one shared list | Can advise |
| Speed problems | Can spot them | Yes, to fix them |
If you outsource this, ask for a short monthly report: what was updated, backups confirmed, issues found and what is next. A partner who can’t show that is not maintaining the site.
Action for today: write your name or your provider’s name next to each row of the table above.
Worked Example: A Ten-Page Service Website
Here is how the routine looks for an example local accounting office with a WordPress site, a contact form and a blog. This is an illustration, not client data.
- Every Monday: the office manager checks the backup email, sends a test enquiry and opens the site on a phone.
- First Tuesday of the month: the IT partner applies updates on staging, then live, re-tests the form and checks Search Console.
- Each quarter: the partner restores a backup to staging and runs the speed and security checks. The office updates prices and team photos.
- Every January: the owner reviews domain, hosting and plugin renewals and the privacy policy.
The result is predictable: problems surface on a known day, and each one has an owner. For the full picture of speed and security work, read our website speed and security check guide or run the free website speed check.
Action for today: copy this example and replace the roles with real names in your team.
Website Maintenance Checklist: FAQ
How often should a small business website be maintained?
Do quick checks weekly, updates and search checks monthly, restore and security tests quarterly, and renewals yearly. Sites with a shop, bookings or many plugins need updates more often, because each extension can release security fixes at any time. Apply critical security updates as soon as they come out.
What does website maintenance include?
It includes software updates, backups and restore tests, security checks, contact form and checkout tests, speed checks, Search Console monitoring, content updates, removing unused plugins and admin accounts, and tracking renewals for the domain, hosting, certificates and paid tools.
Can I maintain my website myself?
Yes, for weekly checks, content updates and renewals. Simple brochure sites can also be updated by the owner after a backup. Leave updates on shops, booking systems and custom code, plus server and security configuration, to a developer, because a failed update there can take the site offline.
What happens if I don’t maintain my website?
Unpatched software becomes easier to attack, forms can stop delivering without warning, certificates or domains can expire, and pages slow down as scripts pile up. Search engines may also flag hacked or broken pages. Most of these failures are silent, so you notice them only when leads drop.
Want someone to keep your site healthy?
We can run your website maintenance on a fixed monthly routine and send you a short report each month.
Book a free consultation