A website maintenance checklist you can actually run

This is the checklist our care plans run, with the reason behind every line. If you keep your own site, print it, put a name next to each cadence, and you will catch almost everything that goes wrong with a small organization’s website before a visitor does.

The lists are short on purpose. Website maintenance is not complicated; it is relentless. The failure mode is never that someone did not know to update the plugins. It is that nobody owned Tuesday.

Before you start: the setup that makes the list cheap

Four things, done once, turn this from an afternoon a week into twenty minutes.

• A staging copy. Most managed hosts give you one in a click. Updates get applied there first on a fragile site, so a broken layout is seen by you and not by a parent at 7 a.m.
• An uptime monitor. A free one that checks every five minutes and texts a person. Not a shared inbox, a person.
• Backups that leave the server. A backup stored on the same host as the site disappears with the site. Send it to separate storage and keep thirty days of it.
• One shared, written record of every login. Registrar, DNS, host, content system, analytics, forms, email sender, payment processor. The organization’s name on every account, two people with access, nothing in a departed volunteer’s personal email.

With those in place, the weekly list is mostly reading dashboards.

Every week

• Update the platform, plugins, and theme, after a backup. Patchstack’s 2026 report counted 11,334 new WordPress vulnerabilities disclosed in 2025, 91 percent of them in plugins, and a weighted median of five hours between disclosure and the first exploit attempt. Weekly is the slowest cadence that keeps up. Take the backup first so an update that breaks a layout is a five-minute rollback, not an evening.
• Check the site after updating. Open the homepage, one interior page, and one form on a phone. Updates break page builders, sliders, and form plugins more often than anything else, and the only way to know is to look.
• Read the security scan and the firewall log. You are looking for a spike in failed logins, a file that changed when nothing was updated, or a user account you did not create. Most compromises leave a footprint days before they do damage.
• Confirm uptime and the SSL certificate. An uptime monitor that checks every five minutes should be alerting a person, not a shared inbox. A lapsed certificate puts a full-page “Your connection is not private” warning in front of every Chrome visitor.
• Clear spam. Comment spam and form spam pile up, and a form plugin’s spam folder sometimes catches a real inquiry. Look before you delete.

Every month

• Post what changed. News, events, the calendar, staff, hours, prices, documents. A site that still lists a board member who left in 2024 or a lottery date from last year tells visitors the organization stopped paying attention.
• Submit every form yourself, and confirm the email arrives. This is the single most valuable item on the list. Since February 2024, Google’s sender guidelines require every sender to authenticate with SPF or DKIM and keep a valid reverse DNS record; a form that sends from an unauthenticated domain is junked with no error shown to anyone. A plugin update can change the sending address; the inbox a form forwards to can be closed. You find out from a customer who says they tried, unless you test it monthly.
• Find and fix broken links and 404s. The Pew Research Center found that 38 percent of web pages that existed in 2013 were gone by 2023. Your site links outward to pages that disappear, and inward to pages you renamed. A crawler finds them in minutes.
• Check the embeds. Instagram feeds, maps, calendars, and social posts break when the platform behind them changes. Instagram’s Basic Display API stopped answering on December 4, 2024, and every personal-account feed built on it went blank. A Google Maps embed built on the JavaScript API shows a dark “for development purposes only” map when the key or the billing lapses.
• Write down what you did. A three-line log per month is enough. When a client asks why the site is slow in March, the log that says a gallery plugin was added in February answers it. The report we send clients on a care plan is the same three lines, expanded: what was updated, what was changed, what we noticed, and what we recommend. If you keep your own site, keep the same log; it is the only way the next person will understand what happened.

Every quarter

• Measure speed against Core Web Vitals. Google’s thresholds are a Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1. The usual culprits on a small site are photos uploaded straight from a phone, a slider nobody scrolls past, and a chat widget loading before the phone number. Resize the images and remove the widget. Google says Core Web Vitals are used by its ranking systems and that there is no single signal; the practical reason to care is that visitors on a parking-lot phone leave before a slow page paints.
• Run an accessibility pass on what is new. New pages, new images, new PDFs. Alt text on images, headings in order, labels on form fields, contrast on buttons, keyboard focus you can see, and tags on PDFs. A site can meet WCAG 2.1 AA at launch and fail by the following quarter through nothing but uploads. Our accessibility guide covers what to fix first.
• Compare the Google Business Profile to the site, field by field. Name, category, hours, holiday hours, address, phone. The two records disagreeing is the most common local ranking problem I find, and it is free to fix.
• Read the analytics. What people searched for to arrive, which pages they left from, which forms were started and not finished. Twenty minutes a quarter with the report turns maintenance into improvement.

Every year

• Inventory every login and put it in writing. Domain registrar, DNS, hosting, the content system, analytics, the form tool, the email sender, the payment processor. The most common emergency I am called into is an organization locked out of a site a former volunteer or a former vendor still controls. Our checklist on whether you own your website is four accounts long.
• Confirm the renewals. Domain, SSL certificate, hosting, and any paid plugin or theme licenses, each on a card that will still be valid and an email that will still be read. GoDaddy’s published timeline parks an expired domain on day five and removes it from your account on day 18; Namecheap’s redemption window is 30 days. Set them to auto-renew and check the card anyway.
• Restore a backup to a staging copy. A backup you have never restored is a hope, not a backup. Once a year, take the latest backup, restore it somewhere harmless, and confirm the site comes up.
• Check the PHP version and the hosting plan. PHP 8.1 reached end of life on December 31, 2025 and PHP 8.2 stops receiving security fixes on December 31, 2026, per php.net. Hosts handle it differently: GoDaddy, for one, moves sites on unsupported versions onto a paid “PHP Extended Support” add-on billed at renewal. Move to a supported version on your own schedule, not theirs.
• Audit the content. Every page, once a year, with one question: is this still true? Archive, rewrite, or redirect the ones that are not. Redirect rather than delete anything that ranked.
• Review the privacy page and the analytics setup. Analytics tools change under you; Google deleted all Universal Analytics data in July 2024 for anyone who had not moved. Make sure what the privacy page says you collect matches what the site actually runs.

Platform notes

WordPress. Everything above applies. WordPress runs 39.6 percent of all websites per W3Techs in October 2026, and its plugin ecosystem is where the vulnerabilities live, so the weekly list is not optional. Remove plugins you do not use rather than leaving them deactivated; an abandoned plugin is still a file on your server.

Squarespace and Wix. The platform handles hosting, SSL, and software updates, so the weekly list mostly disappears. Keep the monthly and yearly lists: content, forms, links, embeds, accessibility of what you upload, the domain renewal, and the annual content audit. Builder sites go stale exactly as fast as WordPress sites do; they just do not get hacked the same way.

Shopify. Add theme and app updates to the monthly list, test the checkout quarterly with a real card and a refund, and check the tax settings whenever a rate changes. Clothing is exempt from Minnesota sales tax, and a wrong product category charges it anyway.

Custom-coded sites. Swap “plugin updates” for dependency updates and a developer who can read the release notes. The rest of the list is the same.

Sector add-ons

The generic list misses the obligations that make maintenance a standing job for some organizations.

Charter schools. Minnesota charter boards must post minutes on the school website within 30 days of approval under Minn. Stat. 124E.07, the standardized testing calendar by October 1, the literacy plan by June 15, and the annual report and lottery policy whenever they change. Add those dates to the monthly list. The whole year is laid out on our charter school maintenance page.

Nonprofits. Post the latest Form 990 where a donor can find it, test the donate button every month, keep the board page current, and if you hold a Google Ad Grant, remember it requires a 5 percent click-through rate each month and a site with no broken links. Give to the Max Day falls on November 19 in 2026; test the path to the button in October. See maintenance for nonprofits.

Clinics and care providers. The careers page rots fastest: wage ranges, open shifts, counties covered. Keep intake forms on a tool that will sign a Business Associate Agreement, and keep advertising pixels off any page that collects health details. See maintenance for healthcare and care providers.

Mosques and Islamic centers. Adhan times are calculated, but the iqamah table is set by the board and changes with the seasons, and Ramadan, which begins around February 8, 2027, is a month of nightly updates. See maintenance for mosques and Islamic centers.

When to hand it to someone

Run the list yourself if one person on staff genuinely owns it and the site is on a hosted builder. Most organizations I meet are not in that position. The site is on WordPress, the person who knew it has moved on, and the weekly list has not been run since launch.

That is what a care plan is: one person at a studio running this exact list every week, month, quarter, and year, posting what you send, and writing a short report so you can see it happened. Ours are month to month, for sites we built and sites we did not, and the price is a fixed monthly quote after a free look at the site. What each plan includes, and where the market sits for that level of service, is on the website maintenance page. If you want the cost side first, read how much website maintenance costs.

What to do next

Run the yearly list this week, because the login inventory and the renewal check are where the expensive surprises hide. Then put the weekly list on one person’s calendar. If there is no such person, send us the URL and we will tell you what the site needs, whether or not you hire us.