Website Maintenance Checklist for Small Business Owners

A website maintenance checklist for small business owners is a short list of weekly, monthly, quarterly, and annual tasks that keep a site backed up, patched, fast, and able to capture leads. The whole cycle takes three to five hours a month on a brochure site. Skipping it costs far more. The failures are quiet: a contact form stops delivering to the inbox, a backup job silently stops running, a plugin goes three versions behind and gets flagged in a crawl.

Website maintenance is not glamorous work, and it does not produce visible output the way a new landing page does. It is the layer that keeps your most important marketing asset running. Below is the exact sequence I use when auditing small business sites, broken out by cadence so you can hand pieces of it to a developer, a virtual assistant, or nobody at all if you run it yourself.

What maintenance do websites need?

Websites need four kinds of upkeep: patching the software that runs the site, protecting the data behind it, verifying the paths that generate revenue, and watching performance so it does not drift. That is the whole job. Everything below is a scheduling decision about when each one happens.

Cadence	Core tasks	Time per cycle
Weekly	Apply security updates, confirm backups ran, test forms, review uptime, clear spam	20 to 40 minutes
Monthly	Speed test, broken link crawl, analytics review, malware scan, content freshness pass	45 to 90 minutes
Quarterly	Cross-device testing, plugin cleanup, account audit, legal page review, accessibility scan, restore drill	2 to 3 hours
Annually	Renewals, full content audit, hosting fit review, documentation update	3 to 5 hours

I have audited sites where the owner believed all four tiers were covered because a host was billing them monthly. In most of those cases the host handled patching and nothing else. Nobody had tested a restore, nobody had submitted the form since launch, and the last speed test was from the build week. Paying for maintenance and receiving maintenance are different things, and the gap is where revenue leaks.

The weekly maintenance list

Twenty minutes once a week covers the highest-risk items. Pick the same day, because a checklist that floats gets skipped.

Check for CMS, plugin, and theme updates. Apply security patches within days. Feature updates can wait for a maintenance window, but anything with a published vulnerability should not sit unpatched over a weekend. WordPress sites feel this most, since plugin abandonment is common and unmaintained plugins are the usual way a small business site gets compromised. If your site runs on WordPress and you have never triaged a vulnerable plugin, our WordPress hardening guide walks through the order of operations.

Verify backups ran successfully. Open the backup dashboard and confirm the date, size, and destination. A backup that stopped running three weeks ago is not a backup, it is a false sense of safety. Set the alert threshold so a failed job emails you the same day.

Test critical forms and conversion paths. Submit your own contact form and confirm the email arrived. If you run ecommerce, place a test order and check that the confirmation, receipt, and fulfillment notification all fire. Do this weekly, not monthly. Form plugins break on update more often than any other component, and a broken form produces silence rather than an error message you would notice.

Review uptime alerts. If the site dropped, find out why and for how long. Repeated short outages usually point at hosting, DNS, or an expired certificate rather than random bad luck.

Clear spam and comments. Unmoderated spam reads as neglect to visitors and to anyone evaluating whether the business is still operating.

How to build a website checklist for your own site

A generic checklist is a starting point. The version that survives contact with a real business is built from your own site's weak points. Five steps get you there.

1. List every component that can break. Forms, checkout, booking calendar, chat widget, email capture, payment processor, CDN, SSL certificate, domain registration, hosting account, analytics. Each one is a line item.
2. Assign a cadence based on blast radius. Anything that touches money or lead capture gets checked weekly. Anything that touches trust and legal exposure gets checked quarterly. Renewals live on a calendar with two reminders.
3. Name one owner per task. Not "the team." A person, with a name, in a shared calendar. In a business with three employees, this is usually the same person wearing a different hat, and that is fine as long as the task has a home.
4. Define the evidence. "Checked backups" is not evidence. "Backup completed 2026-11-05, 1.2 GB, stored in remote bucket, restore tested 2026-09-14" is evidence. Require the second kind in the log.
5. Put it in one document with one link. A shared doc, a Notion page, a spreadsheet, anything reachable from a phone. If the checklist lives in someone's memory, it dies when that person takes a vacation.

Then run it for a month before you trust it. The first pass almost always surfaces two or three tasks that do not apply to your stack and one gap nobody thought of, like the email deliverability check for form notifications that land in spam rather than failing outright.

The monthly maintenance list

Monthly work keeps performance stable and content current. This is where most maintenance programs go from "keeping the lights on" to "protecting rankings and conversion rate."

Run a speed test and record the numbers. Use PageSpeed Insights for field data and Lighthouse for lab data. Log both. The trend matters more than any single score, because a slow drift from 2.1 seconds to 4.8 seconds over a year happens through small additions, not one bad decision. Our Core Web Vitals breakdown explains which of those metrics actually move search performance and which are noise.

Crawl for broken links and 404s. A free crawler catches internal links pointing at deleted pages, redirect chains that have grown three hops long, and external links to sites that vanished. Fix internal links by pointing them at the correct live page. Remove external links to dead resources rather than leaving them.

Review analytics with a specific question. Do not open the dashboard and nod. Ask what changed. Which pages gained traffic, which lost it, where did the drop-off happen on the quote form. Sudden changes in a stable site usually indicate a technical break, not a market shift.

Update the pages that carry revenue. Homepage, services, pricing, testimonials, and the about page. Stale pricing is the most expensive form of staleness, because it either scares off qualified buyers or attracts unqualified ones.

Run a malware and integrity scan. Many compromises are invisible until the site gets flagged in search results or starts redirecting mobile visitors. A scan that runs monthly catches injections early enough to fix without a full rebuild.

Testing the paths that make money

The single highest-return task on this list is testing the flow that converts visitors into customers, end to end, the way a real person would. Not the way the plugin says it works.

For a services business, that means filling the contact form on a phone, using a real mobile network rather than office wifi, and confirming the notification lands in the inbox that a human actually reads. Then check the auto-reply. Then check that the lead appears in the CRM or spreadsheet. Three separate systems can break independently, and the failure mode of all three is silence.

For an ecommerce site, the path is longer: add to cart, apply a discount code, check shipping cost at checkout, pay with a real card or the processor's test mode, receive the confirmation email, and confirm the order shows in the admin. Test a refund or cancellation path too. Anything involving a third-party integration deserves a quarterly test at minimum, because integration keys expire.

I have seen a booking calendar accept appointments and never send the confirmation, which produced a month of no-shows the owner attributed to flaky customers. I have also seen a checkout that worked on desktop and silently failed on iOS Safari because of a script that loaded late. Both were caught in under ten minutes of manual testing.

The quarterly maintenance list

Quarterly work addresses things that accumulate slowly.

Test on real devices and current browsers. An iPhone, an Android phone, and a desktop browser cover the practical majority. Focus on forms, navigation menus, and checkout. Simulator testing misses real-world network conditions.

Remove unused plugins, extensions, and scripts. Every plugin is code that runs on your site and a dependency that needs patching. Delete what you do not use. Deactivating is not the same as deleting, because deactivated code still sits on disk and still gets flagged.

Audit user accounts and permissions. Remove accounts for former employees and contractors. Confirm admin access is limited to people who currently need it, and that no one is logging in with a shared credential.

Review legal pages. Privacy policy, terms of service, refund policy, cookie disclosures. Laws and business practices change, and the W3C Web Accessibility Initiative resources plus your own jurisdiction's rules are the places to verify current requirements. Outdated policies create liability that costs more to fix than to prevent.

Run an accessibility scan and fix the obvious failures. Automated tools catch missing alt text, low contrast text, unlabeled form fields, and empty buttons. They do not catch everything, but they catch the issues that generate complaints and demand letters. See our WCAG compliance guide for the standard that applies to business sites, and our accessibility auditing walkthrough if you want to run the audit with AI assistance.

Run a restore drill. Details below, because this is the task everyone writes into the checklist and nobody performs.

How much does it cost to hire someone to maintain a website?

Costs fall into four bands, and the spread is driven by what is included rather than the size of the site.

Option	Typical cost	What you get
Do it yourself	Your time, 3 to 5 hours a month	Everything on this page, with no coverage when you get busy
Freelancer, hourly	$75 to $150 per hour	Specific tasks on request, no recurring monitoring
Freelancer or small shop, retainer	$150 to $500 per month for a brochure site; $500 to $1,500 for ecommerce	Updates, backups, monitoring, a monthly report
Agency care plan	$500 to $2,500 per month	The above plus reporting, priority response, and some content or SEO work

Add hosting and tooling separately. US shared or managed hosting runs $10 to $40 a month, managed WordPress $25 to $100, a backup service $50 to $120 a year, and uptime monitoring starts free with paid tiers around $7 to $20 a month. SSL through Let's Encrypt is free. A domain renewal is $12 to $20 a year.

The honest math for a typical service business: a $300 monthly retainer is $3,600 a year. One broken quote form during a slow month costs more than that. But if your site is a five-page brochure with no forms and no transactions, you may not need a retainer at all. You need a calendar reminder, automated backups, and a yearly professional review. Paying for monitoring on a site that generates nothing is a subscription, not an investment. If you are weighing a rebuild against continued maintenance, our rebuild versus refresh analysis covers the break-even point.

How to run a restore drill that proves your backups work

A backup is a claim. A restore is the proof. Do this once a quarter, and it takes about forty minutes.

1. Pick the most recent backup and note its date and size.
2. Restore it to a staging environment or a local copy, never over the live site.
3. Confirm the restored copy loads, the theme renders, and the database tables are present.
4. Check that images and uploads came through, not just the content.
5. Log the result with the date, the backup used, and how long the restore took.

Two things go wrong in restores more than anything else. Backups that exclude uploads, which means the database restores and every image is broken. And retention windows shorter than the interval between a compromise and its detection. If your provider keeps seven daily backups and a compromise sat unnoticed for two weeks, your clean copy is gone. Match retention to realistic detection time, which for small business sites is often 30 to 60 days.

What a maintenance report should look like

If someone else maintains your site, ask for a monthly report with specifics rather than reassurance. It should include:

• Backup status, last successful run timestamp, and the date of the last restore test
• Updates applied, and any deferred with the reason
• Security scan results, including what was scanned
• Uptime percentage and a summary of any incidents
• Speed scores with month-over-month comparison
• Confirmation that forms and checkout were tested, with the date

Vague reports are a warning sign. "Site monitored, all good" tells you nothing about whether anything was actually checked. You want timestamps and named actions.

Where maintenance programs usually fail

Three patterns show up repeatedly. The first is treating the host's backup as the whole backup strategy, with no restore test and no offsite copy. The second is delegating maintenance without a report, so the owner has no visibility until something breaks. The third is doing the work but not the testing, which means the checklist gets followed and the forms stay broken.

There is a fourth, quieter failure: maintaining a site that should be replaced. If your platform is out of support, your plugin stack has grown unmanageable, or mobile performance cannot be fixed without a rebuild, maintenance becomes expensive stability. A migration is the better call, and our guide to migrating a small business site without losing SEO covers how to do it without a traffic cliff.

What to do this week

Set up backups with an offsite copy and a failure alert. Submit your contact form and one other revenue path on a phone. Put a recurring 30-minute block on your calendar for weekly maintenance. Book the restore drill for this month rather than next quarter.

Maintenance is a habit, not a project. The businesses that avoid a crisis are the ones that built the habit before the crisis arrived. If you want a second set of eyes on what your current setup covers and what it misses, our website maintenance service exists for exactly that conversation.