Website maintenance: the checklist for weekly, monthly and yearly

A website is not a brochure you print once. It runs on software, which changes; on a server, which has to keep running; and on content, which ages. Anyone who does nothing after launch only notices when something breaks: a form that no longer arrives, a certificate that expires or a page that suddenly shows an error. This article is a practical checklist, organised by frequency. We name no fixed times or percentages; how much time it takes depends on how big your site is and what it is built on. What we do is indicate what the official documentation says, and what our own approach is.

Why maintenance is needed

The OWASP Top 10 (2025 edition) is a widely used overview of the most important security risks for web applications. That edition lists, among others, “Security Misconfiguration” and “Software Supply Chain Failures”: precisely the risks you act on with maintenance, by checking settings and keeping third-party components up to date. The Dutch National Cyber Security Centre (NCSC) is the Dutch point of contact for cybersecurity and publishes advice for organisations. More on security in website security: the basics.

Weekly (or automatic)

1. Check that the site is reachable. Preferably with automatic monitoring that sends an alert. In its documentation on status codes, Google explains that server errors (5xx) can cause Google to crawl less often and that URLs that persistently return a server error can disappear from the index. See hosting and uptime for business owners.
2. Test the contact form. Send a message yourself and see whether it arrives, including in your spam. This is the expensive mistake nobody sees.
3. Look at notifications. Updates available, error messages from the host, warnings in Search Console.

Monthly

1. Install updates, with a backup first. The WordPress documentation advises making a backup before you run an update, so you can restore if there are problems. WordPress also has automatic background updates, whose behaviour you can configure. Whether you turn them on depends on your situation: automatic updates reduce the risk of known vulnerabilities, but may break something. A staging environment helps with bigger changes. With a custom site without a CMS, it is about dependencies and the server environment.
2. Check the backups. Does the backup exist, is it recent and can it be restored? A backup that has never been tested is a hope.
3. Clean up users and permissions. Who still has access they no longer need? Limit administrator accounts and use strong, unique passwords with two-step verification where possible.
4. Look at Search Console. According to Google, Google Search Console shows how your site performs in Google Search and helps you find problems. Look at indexing messages and at the searches you are found for.
5. Check the speed. web.dev describes Web Vitals (LCP, INP, CLS) as metrics for user experience. A new plug-in, large image or external tool can worsen them. See Core Web Vitals explained.
6. Check links and pages. Do the most important pages and buttons still work?

Quarterly

1. Go through your content. Are opening hours, address, phone number, prices or terms correct? See also local SEO and your Google Business Profile.
2. Review the components. Which plug-ins, themes or libraries do you use and are they still maintained? Remove what you do not use. Fewer components means less risk.
3. Look at your figures. What are your most important pages, where do people drop off, how many enquiries came in? See privacy-friendly web analytics.
4. Test on multiple devices. A phone, a tablet and a desktop, in at least two browsers.

Yearly

1. Check server versions. In its requirements, WordPress names which PHP and database versions it needs. Check what your hosting runs and whether it still meets those requirements, and plan an upgrade before a new version of your CMS or its components demands it.
2. Domain name and certificate. Does your domain name or SSL certificate expire? Who receives the notice? An expired domain is one of the most avoidable problems.
3. Privacy statement and cookies. Do you still use the same tools? Is the statement up to date? See cookies and GDPR for your website.
4. Accessibility. Check that new pages are still accessible; see accessible website and the European Accessibility Act.
5. Recalibrate your goals. Does the site still do what you expect of it? What would you do differently?
6. Evaluate hosting and maintenance. Does the contract still fit what you need?

What do you do in an outage?

First establish what is going on: is the site completely unreachable, or is one part not working? Check whether the hosting reports problems. Turn on a temporary notice if the site is unavailable for longer and make sure the server returns a server error code, instead of an empty page with status code 200. Google describes that such empty or error pages can be treated as a “soft 404”. Then restore from a backup if needed, and write down what happened. That way you prevent the same error from recurring.

Who does what?

You can do this yourself, have the agency that built the site do it, or have it as a fixed part of hosting. What fits best depends on your time and your technical knowledge. Keep three things in mind: someone has to really do it, it must be recorded in an agreement who does what and you must be able to check that it happened. At CUBO, Botbasis takes care of hosting and maintenance after launch; we record the arrangements beforehand, see also how to brief a web agency.

Common mistakes

• “It is running, isn't it.” A site that is no longer updated often keeps working for years, until it no longer does. You do not choose that moment yourself.
• Postponing updates until there are many. Many small steps are easier to recover from than one big jump.
• One person with all access. If that person leaves, you are locked out of your own site. Record accounts and ownership.
• Backups on the same server. If the server fails, the backup is gone too. Keep copies elsewhere.
• Only looking, never testing. A report says a backup exists; only a restore proves it works.
• No log. Briefly write down what you change and when. That way you find the cause of a problem faster later.

What falls outside maintenance?

Maintenance keeps the existing site healthy. New features, a new page layout or a campaign are usually outside it and are a separate project. Record that distinction beforehand, so there are no surprises about what is included. For changes to content you can be responsible yourself, or hand that to us; you agree that.

A short checklist to keep

• Availability monitored, with alerts.
• Contact form tested.
• Backup recent and restored in a test.
• Updates applied (after backup).
• Unused components and accounts removed.
• Search Console reviewed.
• Speed checked.
• Content up to date.
• Domain, certificate and server versions in order.
• Privacy statement and cookie choices correct.

In conclusion

Maintenance is boring when it goes well. That is exactly the point. Want to know what we can take over? Look at our hosting and maintenance service, or book a free intro call.

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• Upgrading WordPress, incl. Configuring Automatic Background Updates (WordPress Advanced Administration Handbook)
• Hardening WordPress (WordPress Advanced Administration Handbook)
• WordPress requirements (WordPress.org)
• HTTP status codes, network and DNS errors (Google Search Central)
• Web Vitals (web.dev)
• About Google Search Console
• OWASP Top 10:2025
• Nationaal Cyber Security Centrum (NCSC)

Book an intro call