Website maintenance is the recurring work that keeps a site secure, fast and accurate after launch. It is unglamorous, and it is the difference between a site that still works in three years and one that quietly degrades until something breaks publicly.
Software and plugin updates
The large majority of website compromises exploit known vulnerabilities in outdated software, not novel attacks. Updates should be applied on a schedule, and tested on staging first where the site is business-critical. Monthly is a reasonable floor; security patches should not wait.
Backups you have actually restored
Backup frequency should match how often the site changes — daily for an active e-commerce or content site, weekly for a largely static brochure site. Store them somewhere other than the server being backed up, and restore one occasionally. An untested backup is a guess.
Uptime and error monitoring
You want to hear about downtime from a monitor, not a customer. Alongside uptime, watch server error rates: a page throwing a 500 for weeks is invisible in analytics because it never registers a pageview.
Security review
Beyond updates: review who still has admin access, enforce strong authentication, keep SSL current, and check that configuration files, backups and logs are not reachable over the web. Access lists in particular drift as people leave.
Performance checks
Sites get slower by accretion — a new tracking script here, an unoptimised image there. Re-measure periodically rather than assuming launch-day performance holds. Images and third-party scripts are the usual causes.
Broken links and redirects
Internal links break when pages move; external links break when other sites reorganise. Both frustrate visitors and waste crawl budget. A quarterly crawl catches them.
Content accuracy
Prices, staff, opening hours, service descriptions and copyright years all drift out of date. This is the maintenance task most often skipped and the one visitors notice first, because a stale price or a departed staff member reads as neglect.
Form and checkout testing
Submit your own contact form periodically. Forms break silently — an expired API key, a changed mailbox, a plugin update — and nothing announces that enquiries have stopped arriving. For most businesses this is the single highest-value check on the list.
Analytics and tracking validation
Confirm analytics and conversion tracking still fire correctly. Tracking breaks the same silently forms do, and the consequence is decisions made on wrong numbers.
SEO health
Watch for crawl errors, pages that dropped out of the index, and unintended noindex directives. A deployment can change indexability without anyone noticing until traffic falls.
How often
Weekly: uptime, backups, form test. Monthly: updates, broken links, performance. Quarterly: security and access review, content accuracy, analytics validation. The cadence matters less than it being a schedule rather than a reaction.
