Website Maintenance: What Needs Doing Every Month, and What Happens If You Don’t

A website isn’t like a printed brochure that stays the same once it’s made. It runs on software — a content management system, plugins, a server, security certificates — and all of that software keeps changing.

Leave a website alone for a year and things quietly break. A plugin stops working with a new version of PHP. The contact form stops sending emails. The SSL certificate expires and browsers show a security warning. Or, worst of all, the site gets hacked and starts redirecting visitors to spam.

This checklist covers what actually needs doing, how often, and how to decide whether to do it yourself or pay someone.

What goes wrong when a site is left alone

These are the problems we see most often on websites that haven’t been maintained:

• Security breaches. Outdated plugins and themes are the most common way small-business websites get hacked. Attackers use automated tools that scan thousands of sites for known weaknesses.
• Broken forms. Enquiries stop arriving, often without anyone noticing for weeks.
• Expired domain or SSL. The domain lapses because the renewal reminder went to an old email address, or the security certificate expires and visitors see a warning.
• Lost content. A server problem or failed update wipes the site, and there’s no recent backup.
• Slow pages. Images and plugins pile up until the site crawls on mobile.
• Outdated information. Old prices, wrong phone numbers, staff who left years ago.

Most of these are cheap to prevent and expensive to fix after the fact.

Every week

• Check that backups ran. A backup you haven’t checked is a backup you can’t rely on. Most backup tools send a report — read it.
• Glance at uptime alerts. A free uptime monitor emails you when the site goes down. If you don’t have one, set one up today.
• Reply to form enquiries and comments. Delete spam comments and check that genuine enquiries are reaching the right person.

Every month

1. Update the CMS, plugins and theme. Do it on a staging copy first if you can, or at least take a backup immediately before updating. Then check key pages and the contact form.
2. Send a test enquiry through every form on the site and confirm it arrives.
3. Check Google Search Console for new errors, security issues or manual actions. Our Search Console guide explains which reports to look at.
4. Run a speed test on your homepage and two or three key pages, and compare with last month.
5. Look for broken links, especially links to pages you’ve removed or renamed.
6. Review content. Are prices, timings, offers and team details still correct?
7. Remove unused plugins and user accounts. Former staff and agencies should not still have admin access.

Every year

• Renew the domain — and make sure it’s set to auto-renew with a payment method that won’t expire. Check that the registrar has a current email address for you.
• Review hosting. Is the plan still right for your traffic? Is the PHP version current? Are you paying for features you don’t use?
• Test a full restore from backup on a staging site. This is the only way to be sure your backups actually work.
• Review legal pages. Privacy policy, terms and cookie notices should reflect what the site actually does today, including any new tracking or forms.
• Audit content. Update or remove old blog posts, merge thin pages and refresh your best-performing pages.
• Change important passwords and confirm two-factor authentication is enabled on hosting, domain and CMS admin accounts.

Security basics every site should have

Beyond regular updates, a few measures stop most attacks on small-business sites:

• Strong, unique passwords for every admin account, stored in a password manager.
• Two-factor authentication for the CMS, hosting control panel and domain registrar.
• Limited admin accounts. Give staff the lowest role that lets them do their job.
• Login protection that blocks repeated failed attempts.
• Off-site backups stored somewhere other than the same server, so a server problem doesn’t take the backups with it.
• Spam protection on forms, so your inbox isn’t flooded and your mail server isn’t blacklisted.

Signs your website needs attention now

Some problems can’t wait for the next monthly check. Act straight away if you notice any of these:

• Browser warnings such as “Not secure” or “Deceptive site ahead” when you open your own website.
• Unknown admin users or posts you didn’t write appearing in the dashboard.
• Customers mentioning strange redirects, pop-ups or spam links when they visit from Google or on a phone.
• Japanese or pharmaceutical words in Google results for your site. Search for site:yourdomain.com to check what Google has indexed.
• A sudden drop in enquiries without an obvious seasonal reason. Test every form first.
• Emails from your host about resource limits, malware or suspended accounts.
• The admin area refusing updates because the PHP or CMS version is too old.

Any of these usually means something has already gone wrong. The sooner it’s handled, the less damage is done to your search rankings and to customer trust.

How much time maintenance really takes

For a simple business website of ten to twenty pages with a handful of plugins, routine maintenance typically takes one to three hours a month when nothing goes wrong. An online store takes more, because there are more plugins, more integrations and more at stake when something breaks during a sale.

The real cost of skipping maintenance shows up later. Cleaning up a hacked site, rebuilding from an old backup or recovering lost rankings usually takes far longer than a year of regular updates would have. That’s why we treat maintenance as insurance rather than an optional extra.

Do it yourself or pay for a maintenance plan?

You can handle maintenance yourself if your site is simple, you’re comfortable with your CMS and you’ll genuinely set aside an hour or two each month. Many business owners start with good intentions and then let it slide when they get busy.

A maintenance plan makes sense when the website brings in a meaningful share of your enquiries or sales, when it’s an online store, or when nobody in-house has the time or skills. When comparing plans, ask:

• How often are updates done, and are they tested before going live?
• How often are backups taken, where are they stored and how long are they kept?
• What’s the response time if the site goes down?
• Are small content changes included, and how many per month?
• Is security clean-up included if the site is hacked, or charged separately?
• Do you get a monthly report of what was done?

A cheap plan that only runs automatic updates without checking anything afterwards can cause as many problems as it prevents.

A simple place to start

If your site has been left alone for a while, start with three things this week: take a full backup and store it off the server, check that your domain is on auto-renew with a working email address, and send yourself a test enquiry. Those three steps protect you from the most expensive failures.

If you’d like someone to take care of it for you, ask about our maintenance plans. We’ll start with a health check of your site and tell you what needs attention now and what can wait.