A website maintenance checklist for small businesses

Every month, half an hour

If you only ever do one section of this website maintenance checklist, make it this one.

• Send yourself a test enquiry through every form on the site. Then check it actually arrived, including the spam folder. Forms break silently after plugin updates, hosting changes and expired mail settings, and nobody tells you.
• Run the plugin and theme updates. Take a backup first. If an update breaks something you want to be able to go back.
• Check the site loads on your phone on mobile data. Not office wifi.
• Click your main calls to action. Phone number, enquiry button, booking link.
• Glance at Search Console for new errors. Two minutes.

Every quarter, an hour

• Check your backups actually restore. A backup nobody has tested is a hope, not a backup.
• Look for broken links. Pages get deleted and suppliers change their URLs.
• Review your opening hours and contact details on the site and on your Google Business Profile. Christmas and bank holidays catch everyone out.
• Check prices and service descriptions are still accurate. This is the one most often out of date.
• Look at your top ten pages in analytics and ask whether they still say the right thing.

Once a year

• Renew the domain, and check who owns it. Expired domains are the most avoidable disaster in this industry and they are brutal to recover.
• Check the SSL certificate renews automatically.
• Review every plugin and delete what you no longer use. Deactivated is not deleted, and deactivated plugins can still be exploited.
• Update the copyright year in the footer. Small, but it signals whether anyone is home.
• Refresh the photography, especially team and premises shots.
• Re read your main service pages as a customer. A year is long enough for a business to change more than its website has.

The security basics that actually matter

Small business sites are almost never targeted personally. They are found by automated scanners looking for known holes, which is why the boring advice is the advice that works.

• Keep WordPress, plugins and the theme updated. This single habit prevents most compromises.
• Use strong, unique passwords and turn on two factor authentication for admin accounts.
• Remove old user accounts, especially from agencies and contractors you no longer work with.
• Do not install plugins from outside the official directory unless you know exactly where they came from.
• Make sure backups are stored somewhere other than the same server as the site.

Warning signs worth acting on

Any of these means stop and look properly rather than hoping.

• Enquiries have dried up but your traffic has not changed. Check the form first.
• The site has become noticeably slower over a few weeks.
• Pages you did not create appear in Google when you search your own domain.
• Your host emails about resource limits or suspicious activity.
• Browsers show a security warning to visitors.

Running the website maintenance checklist yourself, or paying someone

All of this is genuinely doable yourself. The question is whether it will actually get done in a busy month, because the cost of it not getting done is rarely the repair bill. It is the six weeks of enquiries that went into a form nobody was receiving.

If you are going to do it yourself, put the monthly checks in your calendar as a recurring half hour and treat them like any other obligation. If you know that will not survive contact with a busy fortnight, a care plan exists for exactly that reason.

Michael James

Michael heads up NE1 Web Design & SEO in North Shields and has been building websites for more than twenty years.