Website Maintenance Checklist: Monthly, Quarterly and Yearly Tasks

Websites rarely fail on launch day. They fail months later, when a plugin falls behind on patches, a certificate lapses over a weekend, a contact form quietly stops delivering, or a redesign leaves a few hundred broken links. None of those problems announce themselves. A small, regular routine finds them while they are still cheap.

This website maintenance checklist is for owners of brochure sites, shops and blogs who do not have a full-time developer. It splits the work into a monthly pass of about an hour, a quarterly pass of a few hours and a yearly review, with a record you keep so that anyone can pick it up. It assumes a typical setup of a CMS (WordPress is used for examples), a host, a domain and Google Search Console.

Short answer: A website maintenance checklist is a repeating schedule of tasks: monthly, update software, check backups, review Search Console and test forms; quarterly, crawl for broken links, review users and performance; yearly, renew the domain and review content and costs. Write down who does each task and when.

Before you begin

Gather the facts you will need on every pass and keep them in one document: where the site is hosted, who owns the domain registration and when it renews, which CMS and plugins are installed with their versions, where backups are stored, who has admin access, and which forms or checkout flows must work. Google's guidance on preventing a compromised site recommends exactly this kind of inventory: a list of all the software and plug-ins used, with version numbers and updates.

You need admin access to the CMS and hosting panel, Search Console access, and a few minutes per task. The risk is in updates and restores, so take a backup before changing anything. If you are not sure whether your site has a staging copy, ask the host. Updating on staging first is safer for shops and sites with custom code.

How often should you do website maintenance?

Cadence	Time	Main purpose
Weekly (optional)	10 minutes	Glance at uptime alerts and Search Console messages
Monthly	45 to 90 minutes	Updates, backups, forms, security and search reports
Quarterly	2 to 4 hours	Broken links, users, speed, content and redirects
Yearly	Half a day	Renewals, platform review, accessibility and costs

The times are planning estimates, not measured figures; a bigger site needs longer. Pick a fixed day (for example the first Monday) so it becomes habit.

Step-by-step instructions

Step 1: Create the maintenance record

Make a simple log with one row per task run: date, task, who did it, result and notes. This is what turns a to-do list into a routine, and it is the first thing a new developer will want. Add a column for "next due".

Date	Task	By	Result	Next due
2026-11-04	Plugin updates, 6 applied, 1 held back	Sam	Home and contact form tested after	2026-12-02

What success looks like: One log exists, and the last row says when the next pass is due.

Step 2: Check backups every month

Google's own prevention advice stops short of detailed backup guidance, so use your platform's. WordPress documentation says a typical site needs both the database and the files to be restored fully: the database holds posts, comments and links, while the files hold core, plugins, themes, uploads and configuration. For a site with few changes it suggests weekly backups, daily for busy sites, and always one before an upgrade. It also suggests keeping several recent copies in different places, not only on the host. Each month confirm that the latest backup exists, is recent, contains both parts and is stored somewhere other than the server it protects. Once or twice a year, test a restore on a copy of the site. An untested backup is a hope, not a backup. Hacked Site SEO Spam: Find and Clean Injected Spam Pages explains why clean copies matter after a compromise.

What success looks like: You can name the date of the newest backup and where it lives, and a restore has worked at least once.

Step 3: Apply updates and remove what you do not use

Google's malware prevention page says to stay up to date with software updates and patches, and notes that a host that has not applied recent operating system patches can leave you exposed even when your own software is current. WordPress hardening guidance adds that older core versions are no longer patched, plugins should be kept updated, and an unused plugin should be deleted instead of left idle. Each month: take a backup, update core, themes and plugins, then open the home page, a content page, search, the contact form and, for shops, the checkout. Delete plugins and themes you no longer use. Install add-ons only from sources you trust.

What success looks like: Nothing in your inventory is out of date without a recorded reason, and the key pages still work after updating.

Step 4: Review Search Console

Open these reports monthly and note any change:

Security Issues: whether Google has found hacked content, malware or social engineering on the site. Affected pages can carry a warning in results or an interstitial in the browser.
Page indexing: new "Server error (5xx)", "Not found (404)", "Soft 404" or "URL marked 'noindex'" reasons on pages you want indexed. Many not-indexed URLs are expected, so look for changes, not an empty list. See Page Indexing Report Explained: Every Status and What to Do.
Sitemaps: that your sitemap still says "Success". Google retries a failed fetch for a few days and then stops, so resubmit after fixing a failure.
Core Web Vitals: whether more URLs now need improvement than last month. See Core Web Vitals Report in Search Console: Read It and Prioritize Fixes.

Check that someone reads the email Search Console sends. The malware prevention page says you can have message-panel notices forwarded to your email.

What success looks like: You can say in one sentence whether anything new appeared since last month.

Step 5: Test the things that earn or cost money

Submit your own contact form and confirm the message arrives and the auto-reply reads correctly. Walk through the checkout or booking flow up to the payment step. Test the newsletter signup and any download. Open the site on a phone. Forms fail silently when a mail setting changes, so this is the task most likely to catch a real loss. If your forms send mail from your domain, also see Why do my website emails go to spam?.

What success looks like: Every form and flow completes, and the test messages are in the right inbox.

Step 6: Check certificates, domain and DNS before they expire

An expired certificate makes browsers warn visitors, and an expired domain takes the site offline. Each month, open the site over HTTPS and look for any warning. Record the certificate expiry date and the domain renewal date in your inventory, and put reminders in a calendar well ahead of them. Make sure automatic renewal has a working payment method and that the renewal notices go to a mailbox more than one person reads. Any DNS change is worth a log entry: see DNS Records Explained: A, AAAA, CNAME, MX and TXT for Your Launch.

What success looks like: Both expiry dates are in a calendar with a reminder, and the site loads over HTTPS without a warning.

Step 7 (quarterly): Crawl for broken links, check speed and tidy users

Once a quarter, run a link check on the site or review a crawl. Google says crawlable links are <a> elements with an href, so check that navigation uses them and that important pages receive at least one internal link. Fix or redirect broken links, and check that deleted pages return a real 404 or 410. Then run your three most important templates through PageSpeed Insights and record field and lab figures so you can compare next time. Finally review who has access. WordPress guidance suggests strong passwords, avoiding guessable admin usernames such as "admin" and enabling two-step authentication, so remove former staff and agencies and turn on two-step sign-in for admins.

What success looks like: The broken-link list is empty or ticketed, performance figures are logged, and every account belongs to someone who still needs it.

Step 8 (yearly): Review the platform, content and costs

Once a year, check whether the CMS version or PHP version your host runs is still supported, review domain, hosting and plugin renewals and cancel what you do not use, and update dates, prices, contact details and legal pages. Read the pages that matter most and ask whether they are still accurate. Run an accessibility pass; Website Accessibility Audit: Fix the Most Common Problems helps. Review analytics and Search Console for pages that no longer earn their place; Content Pruning: Decide What to Update, Merge or Remove covers that decision.

What success looks like: The renewals calendar is current, outdated pages are updated or retired, and the log records the review.

Final verification checklist

A maintenance record exists with owners and a "next due" date.
The newest backup is recent, contains the database and files, and is stored off the server.
A restore has been tested on a copy within the last year.
Core, themes and plugins are up to date, and unused ones are deleted.
Search Console shows no unreviewed Security Issues, new indexing errors or sitemap failures.
Each contact form and checkout flow has been tested this month.
Certificate and domain expiry dates are in a calendar with reminders.
Broken links were checked this quarter and admin accounts reviewed.

Common mistakes to avoid

Updating without a backup. Take one first, every time.
Keeping backups only on the same server. If the server is lost or hacked, so are they.
Never testing a restore. Do it on a copy and note how long it took.
Leaving unused plugins installed. Delete them rather than deactivating.
Assuming forms work because the page loads. Submit them.
Sending renewal emails to one person's inbox. Use a shared role address.
Skipping the log. Without it nobody knows what was changed or when.

Frequently asked questions

How often should a website be maintained?

Do a short pass monthly and a longer one quarterly, plus a yearly review. Busy or high-risk sites such as shops may need backups and update checks more often. WordPress guidance cited above suggests weekly backups for small, rarely changed sites and daily for active ones.

What is the minimum website maintenance a small site needs?

Keep software updated, keep tested backups off the server, renew the domain and certificate, and test your forms. Those four prevent the failures that are hardest to explain to customers.

Does website maintenance help SEO?

It protects the conditions search engines depend on: pages that load, return correct status codes and stay free of hacked content. It does not by itself raise rankings. Crawvix repeats a set of about 115 health checks on a schedule, which helps notice when something regresses, but it is not a substitute for backups or updates.

Who should do the maintenance, me or my host?

Check what your host covers. Some manage server updates and backups, but plugins, content, forms and Search Console rarely fall under hosting. Write down who is responsible for each task.

What should I do if I find hacked content?

Do not just delete the visible pages. Follow Hacked Site SEO Spam: Find and Clean Injected Spam Pages, fix every affected page and then request a review in Search Console's Security Issues report. Google says not to resubmit while a request is pending.

Official references

Next step: Try the free website sample to see how your own site does on a few of these checks. This guide provides technical information, not a guarantee of rankings, traffic or index inclusion.