The Website Maintenance Checklist for Small Businesses

A website maintenance checklist is a short list of jobs that keep your site safe, working and accurate, grouped by how often they need doing. For a small business, that means a 15 minute check every week, a fuller pass every month, and a bigger review every quarter and every year. The checklist below is built for a service business site: a plumber, a dentist, a small law firm.

Most website problems are quiet. A contact form stops sending, the phone number on the site still shows last year’s line, or the domain lapses because the card on file expired. Nobody tells you. You just get fewer calls. Regular checks catch these before they cost you jobs.

Before you start: know who holds the keys

Write down where each of these lives, who has the login, and whose card pays for it:

• Domain registrar (where you bought the domain name).
• Hosting account.
• Website admin login (WordPress, Squarespace, Shopify or whatever runs the site).
• Google Business Profile.
• Google Search Console and Google Analytics.
• Call tracking and form tools, plus wherever form emails get delivered.

Every account should be in the business’s name, with you as an owner. A web designer or agency should be added as a user, not hold the account. If someone who left the company is still the only admin on your domain, fix that first.

Weekly checks (about 15 minutes)

• Confirm last night’s backup ran. Open the backup tool and check the date. Make sure a copy is stored somewhere other than the web server, so a server failure or a hack doesn’t take the backup with it.
• Send a test through each form on the site. Check that the email arrives, that it isn’t landing in spam, and that it reaches your CRM or booking tool if you use one.
• Call the phone numbers shown on the site from your mobile. If you use call tracking, confirm the call rang through and was recorded against the right source.
• Look at your uptime alerts. A free uptime monitor checks the site every few minutes and emails you when it goes down. If it went down this week, ask your host why.
• Install any security updates flagged in your website dashboard.

If you only do one thing on this list, test the forms and the phone. A broken form can sit unnoticed for weeks while you wonder why leads dried up.

Monthly checks (about an hour)

Once a month, run updates, check Search Console for security issues, fix broken links, reread your hours, contact details and prices, and compare leads with last month.

Updates

Update the website software, plugins and theme. Take a backup first, then check the main pages and forms afterwards. The WordPress upgrade guide says the same: back up your files and database, then verify the backups are usable before you upgrade.

On WordPress, minor core updates install automatically by default. Plugins and themes don’t, but you can turn on auto updates plugin by plugin. That works well for small, well kept plugins. For big ones, like page builders or ecommerce plugins, update by hand so you can check the site straight after.

While you’re in there:

• Delete plugins and themes you no longer use. Fewer plugins means fewer things to update and fewer things to break.
• Check the list of admin users. Remove anyone who no longer needs access.

Security and Search Console

Open Google Search Console. The Security issues report shows it if Google finds your site has been hacked or is serving malware or phishing pages. While you’re there, look at the Pages report for new errors and at any pages that dropped out of Google. Our technical SEO guide explains what those errors mean.

Broken links

Run a link checker over the site, or use a crawler like Screaming Frog. Fix links to pages you deleted or renamed, and any links to other sites that now go nowhere. Pay most attention to links in the menu, footer and service pages.

Hours, contact details and prices

Read the contact page, footer and service pages as if you were a customer. Check:

• Phone number, address and email.
• Opening hours, including holiday hours.
• Service areas and the services you actually offer now.
• Prices, offers and financing details, if you show them.
• Staff names, photos, licenses and insurance details.

Then check the same details on your Google Business Profile. Google lets you set special hours for holidays and short closures without changing your regular hours. It also suggests confirming your hours for official holidays even when they don’t change, so customers know the listing is accurate.

Leads

Compare this month’s form leads and tracked calls with last month. A sudden drop with no obvious reason, like a slow season, usually means something broke: a form, a tracking number, a redirect or a page that fell out of Google.

Comments and spam

If your blog allows comments, clear out the spam. If nobody comments, turn comments off.

Quarterly checks (half a day)

Once a quarter, test that a backup restores, check speed on mobile, test the site on phones and browsers, check accessibility basics and refresh your main pages.

Test a restore

A backup you have never restored is a guess. Once a quarter, restore the latest backup to a staging copy of the site (a private test version your host or developer can set up) and check that it works.

Speed

Run your home page and main service pages through PageSpeed Insights, on mobile. Google’s Core Web Vitals guidance sets three targets for a good experience:

• The main content loads within 2.5 seconds (Largest Contentful Paint).
• The page responds to taps and clicks within 200 milliseconds (Interaction to Next Paint).
• The layout doesn’t jump around, with a shift score of 0.1 or less (Cumulative Layout Shift).

Google’s guidance judges these at the 75th percentile of real page loads, on mobile and desktop separately, so one fast result on your office internet doesn’t prove much. The usual fixes on small business sites are oversized photos, too many plugins, chat widgets and sliders. On WordPress, our WordPress SEO guide covers speed fixes along with the rest of the setup.

Phones and browsers

Open the site on an iPhone and an Android phone, and in Chrome, Safari and Edge on a computer. Tap the phone number, open the menu, fill in a form. Do the phone checks first, since a customer with a burst pipe isn’t sitting at a desk.

Accessibility basics

You don’t need a full audit every quarter, but check the basics:

• Every meaningful image has alt text that describes it.
• Text has enough contrast with its background. The WCAG contrast guideline asks for a ratio of at least 4.5:1 for normal text and 3:1 for large text.
• You can reach every link, button and form field with the Tab key and see where you are.
• Every form field has a visible label, not just gray placeholder text that disappears when you type.
• Videos have captions.

These checks also make the site easier to use for everyone, including older customers reading on a small screen.

Content

Read your main service pages and your three most visited blog posts. Update anything out of date: prices, photos, the brands you install, the questions customers ask now. Merge or delete thin pages that say the same thing as another page.

Logins

Change passwords for anyone who left, and turn on two factor login (2FA) for the website admin, hosting, domain registrar and Google accounts.

Yearly checks

Once a year, check your domain renewal, your SSL certificate, your hosting plan and every page’s content.

Domain name

Log in to your registrar. Check that auto renew is on, the card on file is valid and the contact email is one you read. ICANN’s renewal rules require registrars to send reminders about one month and one week before the domain expires. If it does lapse, the registrar can switch off the domain’s DNS before deleting it, which takes down your website and your email. There is usually a window to get it back, but it can cost extra. If the reminders go to an old employee’s inbox, you won’t see them.

SSL certificate

The SSL certificate is what puts the padlock in the browser and lets the site load over https. The rules for these changed in 2026. According to Sectigo, a certificate authority, the CA/Browser Forum cut the maximum life of a public certificate from 398 days to 200 days on March 15, 2026. It drops to 100 days in March 2027 and 47 days in 2029.

So a yearly renewal reminder no longer works. Ask your host to confirm that certificates renew automatically, and check the expiry date in your browser’s padlock menu once a year to make sure the automation is running.

Hosting

Check the renewal date and compare the renewal price with what you paid at signup. Ask your host which PHP version the site runs on (for WordPress sites) and whether it is still supported. Confirm what backups the host keeps and for how long, so you know what you can fall back on.

Full content review

Go through every page once a year:

• Delete or redirect pages for services you no longer offer.
• Update team photos, licenses, certifications and insurance details.
• Check your privacy policy still matches the forms, tracking and chat tools you use.
• Update the copyright year in the footer.
• Check the links to your social profiles and review sites still work.

Tracking

Check that Google Analytics, call tracking and form tracking still record leads. Send a test form and a test call and find them in the reports. Tracking quietly breaks after redesigns, plugin changes and new forms.

If your site gets hacked

Signs include strange pages in Google results for your site, a hosting account suspension, or an issue in the Search Console Security issues report. Google can also show a warning label next to your site in search results or a warning page when people try to visit. If it happens:

1. Tell your host and change every password: website admin, hosting, FTP and database.
2. Find out how they got in. Look for an outdated plugin, a weak password or an old admin account nobody uses.
3. Restore a clean backup from before the hack, or have a developer clean the files.
4. Update everything, then fix the weak spot so it doesn’t happen again.
5. If Google flagged the site, follow the steps in the Security issues report and ask Google to review the site once it’s clean.

This is where a tested backup stored off the server earns its keep.

Do it yourself or hand it off

Most of the weekly and monthly checks need no technical skill. Testing forms, calling your own number and reading your hours are jobs for whoever runs the office. Updates, restores, speed fixes and hacked site cleanups are where a developer saves you time and risk.

If you’re weighing a new site against keeping the old one going, our guide to website design pricing covers what a build and its upkeep typically involve.

VentCube is a digital marketing agency for service businesses, founded in 2018, that runs SEO, Google Ads and web design; its team of 10+ people has served 350+ clients. We build WordPress sites for service businesses. Our WordPress web design page covers that work, and our web design services page covers custom builds and redesigns. If you’d like a second pair of eyes on your current site, request a free website audit. We’ll send the findings within 2 business days. Free audit. No obligation. No hard sell.

Common questions

How often should a small business website be maintained?

Do a short check every week, a fuller pass every month, and a bigger review every quarter and every year. The weekly part takes about 15 minutes: confirm the backup ran, send a test form and call the number on the site. The rest can be booked into your calendar like any other job.

What should a website maintenance checklist include?

Backups, software updates, security checks, form and call tests, uptime, broken links, speed, accurate hours and contact details, domain and SSL renewal, and basic accessibility checks. Group them by how often they need doing so nothing is checked too often or forgotten.

Do I still need to renew my SSL certificate every year?

No, it now has to happen more often. Since March 15, 2026, public SSL certificates can be valid for 200 days at most, and that drops to 100 days in March 2027. Ask your host to confirm that renewal is automatic, because doing it by hand is no longer practical.

What happens if my domain name expires?

Your website and any email on that domain stop working once the registrar disrupts the domain's DNS. ICANN rules require registrars to send reminders about a month and a week before expiry, and there is usually a window to get it back, often for an extra fee. Turn on auto renew and keep the card and contact email on the account current.