Most business owners think of a website as a project: it gets designed, launched and then forgotten. In reality, a website behaves more like a shop or a vehicle. If nobody checks it, small problems build up quietly - an expired plugin here, a broken form there - until one day the site is slow, hacked or simply not bringing enquiries anymore.
This checklist breaks website maintenance into weekly, monthly, quarterly and yearly tasks. It works for WordPress, WooCommerce, Shopify and custom-built sites, with a few notes where platforms differ. Print it, share it with your team or use it to check what your current developer is actually doing.
Why a schedule matters more than effort
Maintenance is not about doing a lot of work occasionally. It is about doing small, boring checks regularly so that problems are caught when they are cheap and easy to fix. A form that has been broken for two days loses a few enquiries; one that has been broken for two months can quietly cost you a season.
Weekly tasks
These take very little time once a routine is in place.
Backups
- Confirm that the automatic backup ran successfully (files and database).
- Make sure at least one copy is stored off the server - in cloud storage or a separate backup service.
- For busy online stores, daily or even more frequent database backups are usually advisable.
Uptime and errors
- Check your uptime monitor for any downtime alerts.
- Look at the server or application error log for repeated warnings.
- Open the home page and two or three key pages on your phone.
Forms and enquiry paths
- Submit a test enquiry through each important form and confirm it arrives.
- Click the WhatsApp and call buttons on mobile to confirm they open correctly.
- For e-commerce, place a small test order or check that recent orders and payment confirmations (for example via Razorpay or another gateway) are flowing normally.
Security alerts
- Review security plugin or firewall alerts for repeated login attempts or blocked attacks.
- Remove any user accounts that should no longer have access.
Monthly tasks
Updates (with care)
- Update the CMS core, plugins, themes and extensions - after taking a fresh backup.
- Ideally test updates on a staging copy first, especially for WooCommerce, page builders and payment plugins.
- Delete plugins and themes you no longer use; inactive code can still be a risk.
Speed and Core Web Vitals
- Run your main pages through Google PageSpeed Insights.
- Check the Core Web Vitals report in Google Search Console. Google's published "good" thresholds are an LCP within 2.5 seconds, INP under 200 milliseconds and CLS under 0.1.
- Look for new heavy images, sliders or scripts added since last month.
SEO health
- Review Google Search Console for coverage errors, manual actions and security issues.
- Fix broken internal links and 404 pages that receive traffic, using 301 redirects where pages have moved.
- Check that new pages have proper titles, meta descriptions and headings.
Content freshness
- Update offers, team details, timings and contact details.
- Remove expired announcements and events.
Quarterly tasks
Restore test
A backup you have never restored is only a hope. Once a quarter, restore a recent backup to a staging environment and confirm the site works. This is the single most skipped task we see.
Security review
- Change passwords for admin, hosting, database and FTP or SFTP accounts if they are shared or old.
- Enable two-factor authentication for every admin account.
- Review file permissions and check upload folders for unknown files.
- Confirm the SSL certificate is valid and set to auto-renew.
Our cyber security team can run a deeper audit if your site handles customer data or payments.
Analytics and conversion review
- Compare enquiries and conversions with the previous quarter.
- Identify the pages that bring the most and least enquiries.
- Make sure Google Analytics 4 key events are still firing after any site changes.
Accessibility and usability spot-check
- Check text contrast, button sizes on mobile and image alt text.
- Test the main journey (landing page to enquiry or checkout) as if you were a first-time visitor.
Yearly tasks
- Renewals: domain, hosting, premium plugin licences and any third-party services. Make sure the domain is in your company's name and the renewal email reaches someone who still works with you.
- Content audit: merge, update or remove thin and outdated pages.
- Technology review: check whether your PHP version, server software and CMS version are still supported, and plan upgrades before end-of-life.
- Legal pages: review your privacy policy, terms and cookie notice. If you collect personal data from Indian users, keep India's Digital Personal Data Protection Act, 2023 and its rules in mind and take proper legal advice.
- Access audit: list everyone with access to hosting, domain, CMS, analytics and ad accounts, and remove anyone who no longer needs it.
The checklist at a glance
| Task | Weekly | Monthly | Quarterly | Yearly |
| --- | --- | --- | --- | --- |
| Confirm backups ran | Yes | | | |
| Uptime and error check | Yes | | | |
| Test forms, WhatsApp and call buttons | Yes | | | |
| Review security alerts | Yes | | | |
| Core, plugin and theme updates | | Yes | | |
| Speed and Core Web Vitals check | | Yes | | |
| Search Console and broken links | | Yes | | |
| Restore a backup to staging | | | Yes | |
| Password and 2FA review | | | Yes | |
| Analytics and conversion review | | | Yes | |
| Domain, hosting and licence renewals | | | | Yes |
| Content and technology audit | | | | Yes |
Platform notes
WordPress and WooCommerce
These sites need the most hands-on maintenance because of the plugin ecosystem. Keep the plugin list short, prefer well-maintained plugins, and never update payment or shipping plugins on a busy sale day. Our WordPress development team handles this regularly.
Shopify and other hosted platforms
The platform handles core updates and server security, but you still need to review apps, theme updates, broken links, speed, content and access. Uninstalled apps can leave code behind in the theme, so check after removals.
Custom-built sites
Dependencies (frameworks and libraries) need regular updates for security fixes. Server operating system patches, database backups and monitoring are usually your responsibility or your developer's.
What a good maintenance report should show
Whether you use an agency or an in-house person, ask for a short written report every month. It keeps everyone accountable and gives you a history to refer back to when something goes wrong. A useful report includes:
- The date of the latest successful backup and where it is stored
- Which core, plugin, theme or dependency updates were applied, and anything that was held back (with the reason)
- Uptime for the month and details of any outage
- Security events worth knowing about - blocked attacks, suspicious logins, malware scan results
- Speed scores for the key pages compared with last month
- Search Console warnings and how they were handled
- Content changes made on your request
- Recommendations for the next month, in plain language
If your current provider cannot produce something like this, it is a sign that maintenance is happening only when someone complains.
Signs your current maintenance is not working
- You do not know when the last backup was taken or where it is stored.
- Plugins show many pending updates.
- You discover broken forms only when a customer tells you.
- Nobody can tell you the PHP or CMS version your site runs on.
- You receive Search Console security or spam warnings.
Key takeaways
- Maintenance works best as a fixed routine, not a reaction to problems.
- Weekly: backups, uptime, form tests and security alerts.
- Monthly: careful updates, speed, SEO health and content freshness.
- Quarterly: a real restore test, security review and analytics review.
- Yearly: renewals, content and technology audits, legal pages and access review.
If you would rather not manage this yourself, book a free consultation. Our website maintenance team in Jaipur will review your site, explain what it needs and send a written proposal for an ongoing plan.
