Website maintenance is the routine work that keeps a site fast, secure and online. Every week, check that backups ran, apply updates and review uptime alerts. Every month, test a restore, review security, check forms and broken links, look at performance and send an uptime report. Every year, renew domains and certificates on purpose, review DNS and hosting, and clean up users, plugins and old content. Automated monitoring handles the things that must be watched every minute.
The checklists below are written so an agency can copy them once per client. Each task is short enough to tick off, and most can be delegated.
Before you start: set up once per site
Maintenance goes faster when the basics are in place. For each site or client, set this up once:
- An inventory: domains, registrar, DNS provider, hosting, CMS, plugins or packages, payment and email services, and who has access to each.
- Monitoring: uptime checks on the homepage and the pages that earn money, plus SSL, domain and DNS monitoring and heartbeats for scheduled jobs. Our guide on what to monitor on your website lists them in order of priority.
- Alert routing: who gets what, and on which channel. Critical monitors go to someone who can act at night.
- A staging copy where updates can be tested first.
- A maintenance log, one per client, where you record what was done and when.
Agencies with many clients can group each client’s monitors, domains and status page in one project in Uptimecheck, so the client’s whole setup is in one place and alerts can be routed to the team that looks after that client.
Weekly checklist
Weekly tasks take 15 to 30 minutes per site. The goal is to catch anything that went wrong quietly.
Backups
- Confirm that every scheduled backup ran and that the files have a sensible size. A backup that shrank to a few kilobytes is a failed backup.
- Confirm that at least one copy is stored off the server.
- Better still, let the backup job report in itself. A heartbeat at the end of the script alerts you the night a backup does not finish, instead of the day you need it.
# Nightly backup, then report success to the heartbeat URL
30 2 * * * /usr/local/bin/backup.sh && curl -fsS -m 10 https://heartbeat.example.com/your-unique-id > /dev/nullUpdates
- Apply security updates to the CMS, plugins, themes and packages. Test larger updates on staging first.
- After updating, load the homepage, a product or content page, the login and the checkout or contact form.
- Note each update in the maintenance log, so you know what changed if something breaks next week.
Monitoring and logs
- Read the past week’s incidents. Was each one explained? Did any repeat?
- Scan the error log for new or growing errors.
- Check free disk space on servers you manage.
Monthly checklist
Monthly tasks take an hour or two per site and catch slow problems: growing pages, forgotten forms, security drift.
Restore test
- Restore the latest backup to staging or a scratch environment and load the site. A backup you have never restored is a hope, not a backup.
- Note how long the restore took. That is your realistic recovery time if the server is lost.
Security
- Review admin users and remove anyone who no longer needs access, including former staff and freelancers.
- Check that two-factor authentication is on for admin, hosting, registrar and DNS accounts.
- Remove inactive plugins, themes and packages. Disabled code can still be exploited.
- Run a malware or vulnerability scan if your host or CMS offers one.
Certificates and domains
- Check days left on every certificate, including subdomains, APIs and staging. Automatic renewal fails more often than people expect, usually after a server move or DNS change. See SSL certificate expiry monitoring for the common causes.
- Check registration expiry dates for every domain, including old campaign and redirect domains.
Both checks can be automated. SSL monitoring and domain monitoring list days left for every certificate and domain and send reminders in time, which turns this monthly task into reading a list.
Performance
- Compare this month’s response times with last month’s. A slow upward trend usually means a growing database, a heavy plugin or a full disk.
- Run a page speed test on the homepage and one key page, on mobile.
- Check for oversized images added since last month.
Our guide to website response time explains what to measure and what is a reasonable target.
Content, links and forms
- Run a broken link check and fix or redirect anything returning 404.
- Submit every form: contact, quote, newsletter, booking. Confirm that the message arrives and lands in the inbox, not spam. A form that silently stopped sending is one of the most expensive quiet failures a small business site can have.
- Place a test order or booking on shops and booking sites, then cancel it.
Monitoring review and client report
- Check that every important page and service still has a monitor. New landing pages and new APIs are often forgotten.
- Check that alert recipients are still correct.
- Send the client an uptime report: uptime percentage, incidents and their causes, response time trend and the maintenance you did.
The report is what turns invisible maintenance into visible value. Uptimecheck sends weekly and monthly email reports with uptime, incidents and response times, and exports to CSV, JSON or PDF, so the numbers part of the report is ready without extra work. Add two or three lines on what you did and what you recommend.
Yearly checklist
Yearly tasks are the ones that cause the worst outages when forgotten, because nobody remembers how they work.
Domains and renewals
- Confirm auto-renew is on for every domain you want to keep, and that the card on file is valid.
- Check the registrar contact email. Renewal notices often go to a former employee or an unread shared inbox.
- Decide on purpose which old domains to keep and which to let go.
- Renew any manually issued certificates and note the next expiry date.
DNS review
- Export the zone and go through each record. Remove records for services you no longer use; a dangling CNAME to a cancelled service can be taken over.
- Check that SPF, DKIM and DMARC records match the services that actually send email.
- Check NS records and registrar lock.
Between reviews, DNS monitoring alerts you when an A, MX, NS or TXT record changes, with the old and new value, so an unplanned change does not wait a year to be found.
Hosting, software and access
- Check the PHP, Node or database version against its end-of-life date and plan upgrades.
- Review the hosting plan: is it still the right size?
- Rotate API keys and passwords for integrations, and update the inventory.
- Review legal pages, cookie consent and privacy policy with the client.
- Do a full disaster recovery test: rebuild the site from backups on a fresh server.
A copy-ready checklist per client
Paste this into your project tool once per client and repeat the tasks on schedule:
Client: fjordstudio.se
WEEKLY
[ ] Backups ran, sizes look normal, off-site copy exists
[ ] Security updates applied and key pages tested
[ ] Incidents from the past week reviewed
[ ] Error log and disk space checked
MONTHLY
[ ] Restore test on staging
[ ] Admin users, 2FA and unused plugins reviewed
[ ] Certificate and domain expiry dates checked
[ ] Response time trend and page speed checked
[ ] Broken links fixed, all forms tested
[ ] Monitors and alert recipients reviewed
[ ] Uptime report sent to client
YEARLY
[ ] Domain auto-renew, payment card and registrar contact confirmed
[ ] DNS zone reviewed, SPF/DKIM/DMARC checked
[ ] Software versions vs end-of-life reviewed
[ ] API keys and passwords rotated
[ ] Full disaster recovery testWhat monitoring should cover between checklists
A checklist catches what happens slowly. Monitoring catches what happens suddenly. Between your weekly rounds, the site can go down, a certificate can expire, a DNS record can change or a backup can fail. Let monitoring watch those around the clock, send the alerts to the right person and give each client a status page, so the weekly round is about prevention rather than discovery.
Put every client’s uptime, SSL, domains, DNS and backups in one place. Try Uptimecheck free for 14 days, no credit card required.