Website Maintenance Checklist: Essential Tasks for Small Businesses

Website maintenance is the recurring work that keeps a small-business site available, understandable and safe enough to send customers to. Someone in the business should own that work even when a partner performs it. Use this website maintenance checklist to organise the tasks. When you want Kode Builder to carry them, the commercial page is website maintenance and support.

What website maintenance includes

Small business website maintenance is a set of checks and small corrections, not a redesign and not a new product build. A useful list covers six areas:

• Availability — the public URL loads, the certificate is valid, and the main pages are not stuck on an error.
• Customer journeys — a person can find the phone number, send a form, or complete a purchase you actually offer.
• Security housekeeping — updates you understand, admin accounts you still recognise, and a backup you could restore.
• Speed and errors — pages are not suddenly huge, and obvious broken links or images are fixed.
• Content — hours, prices, staff names and offers match the business this month.
• Evidence — analytics and Search Console still receive data, so you notice a silent failure.

Keep four kinds of work separate so a checklist does not hide a larger job:

• Routine maintenance — the cadence on this page.
• Emergency repair — the site is down, a form is dead, or a payment path is taking money incorrectly. Fix that before you resume the monthly list.
• Hosting — where the site lives, how renewals and DNS are handled, and whether capacity still fits the traffic. Hosting is related to maintenance, but a server move is its own project.
• Redesign or custom development — a new structure, a new visual system, or functionality a normal page update cannot hold. A new small-business site belongs on business website packages. Portals, bookings that need their own software, or integrations that outgrow the CMS belong on custom software development.

Checklist at a glance

Run the short pass every week. Use the longer passes on a calendar you will actually open. A site that takes payments or publishes several times a week needs the weekly pass even when the monthly list is handled by someone else.

Weekly checks

Weekly website maintenance tasks should take a short sitting, not a project day. You are looking for failures a customer would hit before you do.

• Open the public homepage on mobile data, not only on the office Wi-Fi. Note any certificate warning or long blank pause.
• Walk one customer journey: menu or service page, contact method, and the thank-you state after a form. If you sell online, stop before a real charge unless a test mode exists.
• Submit one enquiry form with a subject you can recognise, then confirm it arrived in the inbox the business actually reads. Check the spam folder once.
• If the site takes bookings or orders, confirm the last real transaction still shows in the admin and that the customer email left the system.
• Read hosting, plugin and security alerts that arrived since the last check. Urgent means “the site is exposed or unavailable,” not every marketing email from a plugin vendor.
• Glance at uptime or error mail if you have it. Write down anything you defer so it is not forgotten until the monthly pass.

If the homepage is down or a payment is wrong, stop the checklist and treat it as a repair. Routine ticks do not fix an outage.

Monthly tasks

This monthly website maintenance checklist is the core of the plan. Do it on the same day each month, after you know you have a backup.

• Backups. Confirm a backup completed and that you know where it is stored. It should not live only on the same server as the site. Record the date. You do not need a full restore every month; you do need to know the file exists and is recent.
• Updates. Review CMS core, plugins, themes, and the language or PHP version your host is asking about. Update what you can test. Leave abandoned or customised items for a written decision instead of clicking “update all.”
• Security scan. Run the scanner you already use, or review the host’s malware report. Investigate new admin users, unexpected files, and plugins you did not install. A clean scan is not proof the site cannot be compromised.
• Performance. Load the homepage and one heavy page. Check image weight, a sudden jump in plugins, and any script that blocks the page. Fix the obvious problem; do not chase a perfect score.
• Broken links and media. Click the main navigation, the footer, and the newest content. Repair links to dead pages, missing PDFs, and images that show as broken icons.
• Analytics. Confirm the last seven days still show visits. A drop to zero often means the tracking snippet was removed during an edit, not that demand disappeared.
• Search Console. Look for coverage errors, manual actions, and a spike in excluded pages. This is a health check. It is not a ranking programme, and this checklist does not promise positions.
• Forms and inboxes. Repeat one form test if the weekly test was skipped. Confirm notification recipients still work at the company.
• Contact details. Phone, WhatsApp, address, hours and the email on the contact page match the business. Update holiday hours before the holiday, not after.
• Content freshness. Remove or date-stamp offers that ended. Replace staff who have left. Check that prices on the site match prices you will honour.

Write a five-line note: what was updated, what was skipped, and what needs a quotation. That note is the website maintenance plan for the next month. It is more useful than a long policy nobody opens.

Quarterly tasks

Once a quarter, look at whether the site still does the job, not only whether it loads.

• Conversion paths. From the homepage, can a new visitor tell what you sell and how to enquire or buy? Remove one obstacle you can see, such as a buried phone number or a form with fields you never use.
• Accessibility spot check. Tab through the menu and a form with the keyboard. Look for text that is unreadable on its background, images of text that cannot be resized, and buttons that are only an icon. This is a spot check, not a full audit or a legal opinion.
• Mobile and browser check. Open the key journey on a current phone and on one desktop browser you do not use every day. Note overlapping text, menus that cannot close, and buttons under the fold that no longer tap.
• Indexation review. In Search Console, confirm the pages you care about are indexed and that staging, thank-you, or thin tag pages are not multiplying. Decide what should stay out of the index. Do not treat this as a guarantee of traffic.
• Integrations. Payment, email, maps, chat, booking and newsletter connections still use accounts the business controls. Renew tokens that are about to expire.
• User permissions. Remove admin and editor logins for people who have left. Turn on an extra sign-in step for administrators if the CMS offers it.
• Recovery test. Once a quarter, restore a backup to a staging copy or follow the host’s documented restore far enough to see the homepage. A backup you have never opened is only a hope.

Annual tasks

Annual work is where renewals and accumulated plugins surprise people. Put these on a date at least six weeks before the domain or hosting invoice.

• Domain, SSL and hosting. Confirm who owns the registrar account, the renewal date, and the card on file. Confirm the certificate renews automatically or has an owner. Read the hosting plan against current traffic and email needs. A renewal review is not permission to migrate on the same afternoon.
• Technology and plugin audit. List plugins, themes, and custom snippets. Remove what is unused. Flag anything that has not been updated by its author in a long time, or that you cannot explain. Replacement is a small project, not a checkbox.
• Content inventory. List the pages that still matter. Merge or retire duplicates. Make sure legal, pricing and service pages point at the current offer.
• Privacy and legal pages, where they apply. Ask the business’s own adviser if the privacy notice, cookie note and terms still match the forms, analytics and payment tools in use. This article is not legal advice.
• Design and usability. If customers misunderstand the offer, or the site no longer matches the shopfront, plan a redesign instead of another year of patches. New marketing sites can start from business website packages.
• Support-plan review. Decide what stays in-house, what a host includes, and what you will ask a maintainer to do. Write exclusions: new pages, extra shops, and custom features are quotations, not leftovers from the checklist.

WordPress notes

Many small-business sites run on WordPress, so this section is a WordPress website maintenance checklist layered on the cadence above. It is general guidance. Kode Builder does not support every plugin or theme, and a theme you bought from a third party may need its own author when it breaks.

• Update WordPress core only after a backup, and after you know whether the host’s PHP version still matches what core expects.
• Update plugins and the active theme in a batch you can roll back. Prefer a staging copy when the site takes payments or uses a page builder with heavy custom CSS.
• Delete unused themes and plugins. An inactive plugin can still be a way in.
• Review users with Administrator and Editor roles. Reuse of a shared “admin” password is a standing risk; give people their own accounts.
• Check that comment spam, file-editing in the dashboard, and directory browsing are not left open if you do not need them.
• Confirm automatic updates are limited to items you are willing to accept without a look, or turn them off and keep the monthly review instead. Either choice needs an owner.
• After updates, test the homepage, one interior page, the menu, and the enquiry form. Page-builder layouts often break in ways a “successful update” message will not mention.

If WordPress itself needs a new build or a redesign, that work is WordPress development, not a line on this checklist. Ongoing care after launch is still website maintenance and support.

Ecommerce notes

Use this ecommerce website maintenance checklist only for the shop you already run. It is a short addition, not a separate store build, and it is not a WooCommerce or Shopify service page.

• Checkout. Walk a product into the cart and as far as the payment step. Confirm tax, shipping and the order of the buttons still make sense on a phone.
• Payments. Confirm the live gateway is the one you intend, payout alerts still reach a person, and you know how to refund. Do not store card numbers in the CMS.
• Transactional email. Place a test only where you are authorised to do so, and where the order can be voided or refunded. Confirm the customer receives the order mail and that the shop admin receives its copy.
• Inventory and integrations. Spot-check a few products against the stock figure you trust. If stock or orders sync from another system, confirm the last sync time and what happens when that system is down.
• Catalogue hygiene. Hide products you cannot ship. Check that photos and prices on sale banners match the product page.

A new shop, a marketplace, or a checkout that must talk to custom software is outside routine maintenance. Start that conversation on custom software development or the existing e-commerce service pages, with a written scope.

When the checklist is no longer enough

Maintenance has turned into repair or redesign when any of these are true. Stop adding patches and ask for a written scope.

• The site is down, defaced, or sending visitors to somewhere you do not own.
• There is no backup, no admin access, or no one who knows the host login.
• Updates fail every month because a plugin or theme has been edited by hand, or the author has abandoned it.
• Pages are a stack of builders, sliders and copied sections, and a small text change breaks the layout.
• The enquiry form, checkout or booking path fails more than once in a quarter.
• You need a new catalogue structure, a customer portal, or a workflow the CMS cannot represent without fragile add-ons.
• The visual design no longer matches the business, or customers cannot tell what to do on the homepage.

Those are repair, rebuild, or custom-development decisions. A monthly retainer that pretends otherwise will spend its hours rediscovering the same fault.

In-house or a professional plan

Keep the work in-house when a named person can spare the weekly and monthly passes, can get hosting and CMS access, and knows who to call when an update fails. A simple brochure site with rare content changes can live this way if backups and renewals are real.

Ask for professional help when any of these are true: nobody has time for the monthly pass, the site takes payments, several people edit it, updates have already broken a page, or you cannot explain where the backup goes. A professional website maintenance plan should say what is included, what is excluded, and how a request becomes a quotation. It should not promise that routine care prevents every outage, breach or loss of search visibility.

Kode Builder’s offer for that care is the website maintenance and support service. A first marketing site, with hosting and a support limit, starts on business website packages. Neither page is a ranking service.

Printable checklist

Tick these in the browser, or print this page. The menu and the assessment button are left off the printed sheet so the list stays readable. Items you cannot truthfully tick are the ones to schedule, not to ignore.

Questions owners ask

What does a website maintenance checklist cover?

It covers the recurring tasks that keep a small-business website available and usable: backups, updates, forms, speed, content, analytics and renewals. It does not replace a written scope for repairs, a redesign, hosting changes or custom software.

Who should own website maintenance?

Someone in the business should own the checklist even if a partner does the technical work. That owner confirms what changed, approves test orders or content updates, and decides when a task has become a repair or a new project.

How often should these website maintenance tasks run?

Use a weekly pass for availability and customer journeys, a monthly pass for backups, updates and content, a quarterly pass for recovery and conversion paths, and an annual pass for renewals, plugins, privacy and the support plan. Adjust the cadence when the site takes payments or publishes often.

Will this checklist prevent outages, breaches or ranking loss?

No. Routine maintenance reduces avoidable problems. It does not prevent every outage, security incident or change in search visibility. Treat ranking work, emergency repair, redesign and custom development as separate decisions.