What website maintenance includes, and how often to do it

What does website maintenance include?

A website isn’t printed once like a brochure. It runs on software other people keep updating. It sits on a domain and a security certificate that expire, and on hosting someone pays for every month. Your business changes too: prices, hours, services and staff.

Website maintenance, or web maintenance, is the routine work that keeps all of that safe, working and accurate. It doesn’t include a redesign or new features; those are projects, priced on their own, even when a plan bundles them. Marketing is a separate job too. If your site works but feels tired, start with improvements worth making before a full redesign.

Guides online list eleven or twelve “types,” but they fold into seven jobs:

• Software and security updates. The platform, plugins or code the site is built on, and the server under it. Add a regular scan for malware, or for files that changed without anyone knowing.
• Backups. Copies of the site and its data, kept somewhere else, and proven by restoring one.
• Logins and access. A second step at sign-in, and removing people who no longer work with you.
• Renewals. The domain, the security certificate (the padlock, often called SSL) and the hosting plan. If one lapses, the site or your email can go down.
• Checks. The site is up, forms deliver, links open, and pages load fast and work on a phone and with a keyboard.
• Content upkeep. Hours, prices, services, photos, staff, service area and anything with a date on it.
• Fixes and small changes. Finding the cause when something breaks, and the small edits your business needs.

How often each task matters

How often depends on how much the site changes and what it does. A five-page site for a plumber changes less than a café’s online ordering. If your site takes payments or bookings, or stores customer details, keep to the weekly and monthly items strictly. A few simple pages on a site builder can do some of them less often.

Security updates sit near the top for a reason. CISA, the US government’s cybersecurity agency, tells people to install updates as soon as possible. It warns that attackers may go after a known weak spot for months or even years after a fix is out.

Here is a starting schedule for a small business site with a contact or booking form:

• After every change: open the page you changed on a phone. If you touched a form or installed an update, send a test request. A problem caught minutes after a change is far easier to undo than one found weeks later.
• Weekly, or automatic: backups run, security updates go live soon after they’ve been checked, and an uptime monitor emails you if the site stops loading. Ask whoever runs your hosting whether one is set up, and whose inbox it alerts.
• Monthly: regular updates, checked first. Send a test request through every form. Confirm the latest backup exists. Look for alerts in Google Search Console if you use it.
• Quarterly: read every page for out-of-date facts. Run a speed test and a quick accessibility check. Review who has logins. Restore a backup to a test copy.
• Yearly: confirm renewal dates and the card on file for the domain, hosting and email. Check that your privacy policy still names the forms and tools the site uses. Review the whole site against how the business runs now.

References: CISA: Understanding Patches and Software Updates (opens in a new tab) · Google Search Console Help: About Search Console (opens in a new tab)

Who does what depends on what your site is built on

The biggest difference in upkeep is the platform. Find yours below, then you’ll know which jobs are already done for you and which are still yours.

• A hosted site builder, like Wix, Squarespace or Shopify. The company runs the servers and the core software, so you don’t install updates. Squarespace’s help pages, for example, say every domain correctly connected to a Squarespace site gets a free security certificate automatically, refreshed every 90 days (when we checked in October 2026). Your jobs are mostly content, forms, any add-on apps, logins and the domain.
• WordPress on your own hosting. WordPress’s own documentation says automatic core updates are on by default on most sites, though older installs may only get minor and security releases this way. Plugins and themes update on their own only in special cases, unless an administrator turns on auto-updates for each one. WordPress also advises backing up before you update. Someone has to watch the plugins, because one update can clash with another plugin.
• A site or system built for you. The code depends on ready-made parts and a server that need updates too. Each update should be tried on a test copy, then put live. If the website feeds a booking or quote system, upkeep covers both; see who looks after your software after launch.

References: Squarespace Help Center: Understanding SSL certificates (opens in a new tab) · WordPress Developer Resources: Upgrading WordPress (opens in a new tab) · WordPress.org Documentation: Plugin and themes auto-updates (opens in a new tab)

What you can do yourself, and what needs someone technical

Most owners can handle more than they think, without touching code. Leave a few jobs to someone technical. They include installing updates on a site that takes bookings or payments, restoring a backup, fixing errors, moving hosts, and changing your domain’s settings. These are where one wrong click takes the site offline. For text and photo edits you do yourself, see how to update your website content without breaking it.

Once a quarter, add two free checks to the monthly list below. Run your homepage and busiest page through Google’s PageSpeed Insights. Google’s Core Web Vitals count a page as good when its main content shows within 2.5 seconds, it responds to a tap within 200 milliseconds, and the layout barely jumps. Google judges this at the 75th percentile, so at least three in four real visits should meet it. One slow test isn’t a verdict.

Then try W3C’s easy accessibility checks: page titles, headings, image descriptions, form labels, and moving through the page with the Tab key. They catch obvious problems, but they aren’t a full audit. The Justice Department’s guidance says the ADA applies to the web services of businesses open to the public. This isn’t legal advice; ask a lawyer how it applies to your site.

Every month, put this check on your calendar. Each step takes a few minutes:

• From your phone, send a real test request through each form, and confirm it arrives where it should. If it doesn’t, here’s what to check when your website form stops sending.
• Compare this month’s form requests and calls from the site with last month’s. A sudden drop can mean a broken form, not a slow month.
• Read your hours, holiday hours, prices, phone number, service area and staff names on the live site.
• Tap the main buttons: call, book, request a quote, directions, menu and order links.
• Look at the address bar on the live site. A “Not secure” label, or a full-page “Your connection is not private” warning, means the secure connection or its certificate needs attention today.
• Remove logins for anyone who has left, including past web people.
• On WordPress, open Tools > Site Health and write down anything marked critical. Pass it on rather than guessing at a fix.

References: web.dev: Web Vitals (opens in a new tab) · W3C WAI: Easy Checks, a first review of web accessibility (opens in a new tab) · ADA.gov: Guidance on Web Accessibility and the ADA (opens in a new tab) · Google Chrome Help: Check if a site’s connection is secure (opens in a new tab) · WordPress.org Documentation: Site Health screen (opens in a new tab)

Backups, updates and logins: the safety work

CISA’s advice for small businesses is the 3-2-1 rule: three copies of important files, on two kinds of storage, with one copy off-site. Backups should run automatically. CISA also says to test that you can restore fully and partly, and roll back at least seven days.

For a website, that means a backup kept only on the same server goes down with it. WordPress’s own backup guide adds that a full backup needs both the database and the files. It suggests weekly backups for smaller sites, daily for active ones, and 3–⁠5 recent copies kept in different places. Ask where copies are kept, how many days back they go, and when someone last restored one. A restore to a test copy is the only real proof a backup works.

For logins, CISA recommends a second sign-in step, called multifactor authentication or MFA, wherever possible, including email. It says to start with admin accounts. On a website, that covers the site admin, the hosting account, the domain account, and the email your forms send to.

Give each person their own login instead of sharing one. Then you can remove one person without changing everyone’s password. Updates follow the same care: try them on a test copy, then put them live, and don’t let security updates wait for a quiet month.

References: CISA: Back Up Business Data (opens in a new tab) · WordPress Developer Resources: WordPress Backup (opens in a new tab) · CISA: Require Multifactor Authentication (opens in a new tab) · CISA: Understanding Patches and Software Updates (opens in a new tab)

Renewals that quietly take a site down

Not every outage is a hack. Sometimes something just expired. Start with the domain. ICANN requires registrars to send two renewal reminders, about one month and one week before it expires. If it lapses, the website and email tied to it can stop. Most registrars offer auto-renew, as long as the card on file is current.

The catch: reminders go to the contact details on the domain record, usually an email address. ICANN tells owners to keep those up to date. If that’s an old web person’s address, you’ll never see them. Log in to your registrar, the company you pay for the domain, and check the contact email and the expiry date. If you don’t know who that is, look for a renewal receipt in your email or ask whoever set up the site.

Next, the security certificate behind the padlock. Let’s Encrypt, a free certificate provider, issues certificates that last 90 days by default. It plans to cut that to 64 days in February 2027 and 45 days in February 2028. In 2025, the CA/Browser Forum, the industry group that sets certificate rules, approved a schedule shrinking the longest a public certificate can last. The first cut came in March 2026, and by March 2029 the limit will be 47 days, down from 398. So renewal has to be automatic. Check that it is, and who gets the alert when it fails.

Last, hosting and any paid plugins renew on a card too. An expired card can take a site offline or quietly stop updates. If your site is down right now, start with what to check first when a WordPress site is broken.

References: ICANN: FAQs for Registrants: Domain Name Renewals and Expiration (opens in a new tab) · Let’s Encrypt: FAQ (opens in a new tab) · Let’s Encrypt: Decreasing Certificate Lifetimes to 45 Days (opens in a new tab) · CA/Browser Forum: Ballot SC-081v3, schedule of reducing validity and data reuse periods (opens in a new tab)

What maintenance looks like in your trade

The seven jobs are the same everywhere, but the weak spots differ. Pages that copy facts you keep somewhere else, like a menu, vacancies or stock, go stale fastest. If you fix the same page every month, the lasting fix is having that page read those facts from where you already keep them. That’s a project, not maintenance, but it’s worth knowing it exists. A few examples:

• HVAC or plumbing. For example, a 6-truck HVAC company’s site has a booking form, a service-area page and seasonal tune-up offers. The booking form is the page that brings in work, so test it after every update. Take each offer down when it ends, and keep the service area matching the towns you’ll actually drive to.
• Café or restaurant. Hours, holiday hours and the menu go stale fastest. A PDF menu drifts from the prices at the counter. Online ordering and catering links break when the ordering app changes, so tap them every month.
• Property management. Vacancies must come down when a unit rents. The maintenance request form needs testing like a booking form, including a photo upload from a phone. Tenant portal and rent payment links belong on the monthly tap-through.
• Shop or showroom. Product pages, prices and “in stock” notes drift from what’s on the floor. Delivery areas and fees change. If the site connects to Shopify or Square, a change on that side can break a page on yours.

Keep a one-page maintenance record

Checklists tell you what to do. A record shows what was done, and it makes every later job faster. When something breaks, the first question is always “what changed?” A shared document or spreadsheet is enough. Keep passwords in a password manager, not on the page, and update the record whenever anything changes. If you ever switch web help, this page is most of the handover. Keep these on it:

• Accounts: the domain, hosting, site admin, email and any form or booking tool. Note who holds the owner login and whose card pays.
• Renewal dates for each of those, with auto-renew on or off.
• A dated change log: what was updated or edited, and by whom.
• Backups: where they’re kept, how far back they go, and the date of the last restore test.
• Check results: the last test request, speed test and accessibility check, and anything they found.
• Who to call for help, and the hours they answer.

How we handle website maintenance

Our team looks after websites and business software, whether we built them or someone else did. For a site someone else built, we review it first: how it’s built, who has access and what shape it’s in. Then we tell you what we can look after.

A monthly plan covers fixes, updates checked before they go live, and small changes, like new hours, prices or pages. Bigger additions are quoted first. Each plan is priced in your quote, based on what we look after, how many hours of changes you want and how fast you need replies.

Each month you get a short note of what we updated, fixed and changed. Reply times are written into your plan. Calls run Monday to Friday, 7 am to noon Pacific, and we don’t promise 24/7 support. Your domain and connected apps stay in your name. Hosting runs on our account, and you can take it over after payment.

Every site we launch includes 30 days of fixes. If something is broken now, a one-off fix is $750–$3,000 and takes 1–⁠2 weeks. These are our prices as of October 4, 2026. The first call is free, and you get the price in writing within 48 hours. See how our website maintenance and support works.