A website can appear normal while an important part has stopped working. A form may no longer deliver email, a backup may be impossible to restore, or an expired card may be days away from suspending a domain. Maintenance is the routine used to find those problems before a customer does.
Assign every task to a named role and record the result. “The agency handles it” is not enough unless the agreement identifies what is monitored, how incidents are reported and what remains the business’s responsibility.
Every month: test the customer journey
- Open priority pages on a phone and desktop browser.
- Submit each important contact, quote, booking or application form.
- Confirm the visitor sees an accurate success message.
- Check the message reaches the intended inbox or CRM with complete details.
- Test key phone, email, map, download and checkout links.
- Review error monitoring and uptime alerts for recurring incidents.
Use a clearly labelled test identity and remove it from commercial reporting. A visual check of the form is not a substitute for verifying delivery.
Every month: review software and security
Apply supported updates for the content management system, framework, extensions and server packages. Read release notes for significant changes and take a current backup before risky updates. Test the priority journey again afterwards.
Remove unused extensions and themes rather than leaving them disabled indefinitely. Confirm security certificates are valid and automated renewal is operating. Review security alerts for the domain and hosting accounts.
Website maintenance is only one part of wider account, device and access work.
Every month: verify backups
Confirm that scheduled backups completed for both files and databases. Keep at least one copy outside the live hosting account so a provider or account failure does not remove every version.
A successful backup message does not prove recovery. Schedule restore tests into a separate safe environment. Record how long recovery takes and which credentials or supplier contacts are needed.
Every quarter: check business information
- Prices, service descriptions and delivery expectations.
- Phone numbers, email addresses, opening hours and service areas.
- Staff or company information that is publicly presented.
- Policies, consent wording and third-party providers.
- Portfolio examples, downloads and external references.
- Copyright dates only where they are meaningful and correctly generated.
Remove claims that cannot be verified and mark demonstrations clearly. A stale fact can mislead a customer even when the page itself loads perfectly.
Every quarter: review access
Export a list of administrator, editor, hosting, domain, analytics and integration accounts. Remove people and suppliers who no longer need access. Give each person their own account instead of sharing one password, and require multi-factor authentication where available.
Check who controls recovery email addresses and phone numbers. The business should not depend on a former employee or supplier to reset a critical account.
Every quarter: inspect performance and accessibility
Test several representative pages, not only the homepage. Look for oversized new images, scripts added by marketing tools and layout shifts caused by embeds. Compare results with previous checks so gradual deterioration is visible.
Use keyboard navigation, zoom the text and check important forms with labels and visible errors. Automated accessibility tools are useful for finding patterns but do not replace trying the actual journey.
Every quarter: examine search and analytics health
Review crawl errors, indexing changes and important broken links. Check that sitemap and robots files still reflect the public site. Confirm analytics is receiving data only where the required consent has been obtained and that important conversion events still represent completed actions.
Traffic changes are a reason to investigate, not proof that the website is technically broken. Check seasonality, campaigns, tracking changes and search visibility before drawing conclusions.
Every year: verify ownership and continuity
- Confirm domain registrant details, renewal method and expiry date.
- Review hosting capacity, support and recovery arrangements.
- Inventory paid licences and subscriptions.
- Export or document essential configuration and integration details.
- Review supplier agreements, responsibilities and exit arrangements.
- Run a recovery exercise using the current backup and documentation.
Record where source files, brand assets and technical documentation are stored. If the current maintainer became unavailable, another competent person should be able to identify the accounts, restore service and contact the right providers.
Keep a small maintenance log
For each check, record the date, person, result, action and completion date. This does not need a complicated platform; a controlled ticket list or table is enough. The log prevents the same warning being rediscovered every month without an owner.
Sources and further reading
- NCSC Small Business Guide — UK National Cyber Security Centre advice covering backups, malware, devices, passwords and phishing.
- W3C WCAG overview — the standards reference behind the accessibility review in this checklist.
If you want these checks handled under a written scope, review Xapner’s website maintenance and support service and confirm what your current hosting provider already covers.