Website Maintenance Checklist: Weekly, Monthly and Quarterly Tasks (and What It Costs)

Why maintenance matters more than the redesign

Most small business websites do not fail dramatically. They decay: a plugin falls behind and gets exploited, a contact form stops sending emails and nobody notices for two months, the SSL certificate expires on a Sunday, or pages slowly get heavier until mobile visitors give up. Each of these costs enquiries, and none of them shows up in the analytics as a single obvious event.

Regular maintenance is cheap insurance against all of that. It also protects the investment you made in the site in the first place. A well-maintained five-year-old site usually outperforms a neglected two-year-old one, and fixing a hacked or broken site almost always costs more than a year of routine care.

The exact tasks depend on how the site is built. WordPress and similar CMS sites carry the most update work because of plugins and themes, each with its own release cycle. Static sites and sites on hosted builders need fewer updates but still need form tests, SEO checks, content reviews and domain care. Custom-built sites and web apps add dependency updates, framework upgrades and server patching, which usually need a developer rather than an office manager.

Weekly tasks (15 to 30 minutes)

Weekly work is about catching problems early. Security updates are the most important item: most compromised small business sites are running outdated plugins, themes or core software with publicly known vulnerabilities. On WordPress, apply security releases promptly and review other updates before applying them, ideally on a staging copy first for anything major.

Check that last night's backup actually ran and that uptime monitoring shows nothing unusual. Free and low-cost uptime monitors will ping your site every few minutes and alert you by email or messaging app when it goes down. For online stores and booking sites, also glance at the latest orders or bookings to confirm the flow is working end to end.

• Apply security updates to CMS core, plugins, themes and server packages
• Confirm automated backups completed and are stored off the server
• Review uptime monitor alerts and response-time trends
• Scan security logs or your security plugin for failed logins and malware warnings
• For e-commerce or bookings, confirm recent orders and payments came through correctly

Monthly tasks (1 to 2 hours)

Monthly tasks keep the site working for visitors and search engines. Start with forms: submit every contact, quote and booking form yourself and confirm the email or WhatsApp notification arrives. Email deliverability changes quietly, and a broken form is one of the most common and most expensive silent failures on small business sites.

Then look at speed and search health. Google Search Console shows indexing problems, Core Web Vitals issues and manual actions for free. Core Web Vitals measure loading (Largest Contentful Paint, good at 2.5 seconds or less), responsiveness (Interaction to Next Paint, good at 200 milliseconds or less) and visual stability (Cumulative Layout Shift, good at 0.1 or less). A sudden drop usually points to a new plugin, an oversized image or a third-party script.

• Test every form, checkout and booking flow, including confirmation emails and messages
• Check Search Console for indexing errors, Core Web Vitals and security issues
• Run PageSpeed Insights on the home page and your top landing pages
• Scan for broken links and fix or redirect them
• Review analytics for unusual drops in traffic or conversions
• Remove spam comments, old drafts and unused media
• Apply non-security feature updates after testing on staging

Quarterly tasks (2 to 4 hours)

A backup you have never restored is a hope, not a backup. Once a quarter, restore a recent backup to a staging environment and check that the site loads, logins work and recent content is present. This is the task most often skipped and the one people most regret skipping, because backups fail silently: wrong folders, a missing database, or files that are corrupted.

Quarterly is also the right rhythm for housekeeping that reduces risk over time. Remove users who no longer need access, especially former staff and agencies. Delete plugins and themes you are not using, since deactivated code can still be vulnerable. Review your content for outdated prices, services, team members or offers, and refresh the pages that bring in the most traffic.

• Restore a backup to staging and verify it works
• Audit admin and editor accounts, remove old users and enforce strong passwords or two-factor login
• Remove unused plugins, themes and integrations
• Update outdated content: prices, services, contact details, team, offers
• Review on-page SEO for key pages: titles, descriptions, headings, internal links
• Check mobile layout on a couple of real phones, not just a desktop emulator
• Review hosting resource usage and error logs

Yearly tasks and renewals

Domains and certificates cause the most embarrassing outages because they happen rarely enough to be forgotten. Turn on auto-renew for your domain and make sure the payment card and contact email on the registrar account are current and belong to the business, not to a former employee or agency. Losing a domain can be very hard to reverse.

Most sites now use automatically renewing SSL certificates, but automation breaks when DNS or hosting changes, so monitor expiry dates anyway. Maximum certificate lifetimes are also being shortened in stages by the industry's certificate rules, from just over a year towards a few weeks by the end of the decade, which makes manual renewal increasingly impractical. Once a year, also review your hosting plan, your privacy policy and cookie notices, and whether the site still reflects the business.

• Confirm domain auto-renew, registrar contact details and account ownership
• Check SSL certificate automation and expiry monitoring
• Review hosting plan, PHP or runtime version, and server end-of-life dates
• Update privacy policy, terms and cookie notices
• Review accessibility basics: contrast, alt text, keyboard navigation
• Decide whether any section needs a redesign or rebuild

The checklist at a glance

If you only keep one thing from this article, keep this table. Print it, put it in a shared task tool, or hand it to whoever looks after your site. The time estimates assume a typical small business site with 10 to 50 pages and a handful of plugins or integrations; an online store needs more.

DIY vs a care plan: what it costs

Doing it yourself costs time and a few tools. Hosting with daily backups, a free uptime monitor, Search Console and a security plugin cover the basics; paid backup or security tools typically add a few hundred to a couple of thousand rupees a month. DIY works well if someone on your team is comfortable with the CMS and, crucially, actually does the work every week.

A care plan makes sense when nobody owns the task, when the site drives real revenue, or when it is custom-built and needs a developer for updates. Compare plans on what is included, not on price alone: are updates tested on staging, are restores tested, how many hours of small changes are included, and how fast do they respond when the site is down? The figures below are typical 2026 ranges for India and vary with the size and complexity of the site.

Getting started this week

Start with the three tasks that prevent the worst outcomes: confirm you have off-site backups and restore one to check it, set up free uptime monitoring, and turn on domain auto-renew with current contact details. That takes an afternoon and removes most of the catastrophic risk. Then add the weekly and monthly routines as a recurring calendar reminder.

Keep a simple log of what was done and when; it helps enormously when something breaks and you need to know what changed. If you would rather hand it over, RED SAG offers website maintenance plans for business and custom sites, but whoever does the work, the checklist above is what good maintenance looks like.