Website maintenance: what to check every month

A business website needs about an hour of attention a month. In that hour you check five things: that you have a good backup, that the software is up to date, that the HTTPS certificate is renewing, what Google says in Search Console, and that your contact form actually reaches you. The rest is routine upkeep, like servicing a car.

1. The backup: does it exist, and does it work?

The first question isn't "do we have a backup?" It's "how old is the latest one, and has anyone ever tried restoring it?" The WordPress documentation is clear that a full backup has two parts, the database and the files, and that you need both to rebuild the site. It also recommends keeping several recent copies in different places: on the server, in cloud storage, on a computer. A copy that lives only on the same server as the site won't help you if that server has a problem.

For a small site, one backup a week is enough, plus one before every update. Every few months, restore the site from a backup to a test address. That's the only way to know the backup really works.

2. Updates: core, plugins, theme

On WordPress, minor and security updates have installed themselves since version 3.7, as long as the server allows it. Major versions you start yourself from the dashboard. Plugins and themes have their own schedule, and the official docs tell you to check compatibility with the new version first, then visit the site afterward to make sure everything still works.

What we do each month:

1. take the backup;
2. read the release notes for the plugins that matter (forms, bookings, the shop);
3. update, then click through the main pages on a phone and on a computer;
4. delete plugins nobody uses anymore. A deactivated plugin that's still installed is still code sitting on your server.

If your site isn't on WordPress, the idea is the same: know what components it's built from and who keeps them current.

3. The HTTPS certificate and the domain

The padlock in the browser bar comes from a certificate that expires. Let's Encrypt certificates, the most common choice on small servers, are valid for 90 days, and Let's Encrypt recommends renewing at 60. Renewal is usually automatic. Each month, just look at the expiry date: if less than a month is left, the automation isn't working, and soon visitors will see a red warning instead of your site.

Once a month, also check when your domain expires. A domain that isn't renewed on time takes down both the website and your email addresses. We explained how the domain, hosting and HTTPS fit together in our article on domains and hosting.

4. What Google says in Search Console

Two reports are enough for a small business.

Page indexing shows how many of your pages Google knows about and how many it has indexed. Not every unindexed page is a problem (a duplicate page or a form's thank-you page can stay out), but if your services page or contact page shows up as "not indexed," it's worth finding out why.

Core Web Vitals shows how your site loads for real visitors, with mobile and desktop reported separately. Since March 12, 2024, it uses three measurements: LCP (how long until the main content appears), INP (how quickly the page responds to a tap) and CLS (how much things jump around on the page). INP replaced FID just this March, so you may now see pages flagged "needs improvement" that looked fine until recently. We covered the switch in our article on INP.

5. What no report will tell you

Some problems you only catch by acting like a customer:

• send your contact form and see whether the message arrives, including in the spam folder;
• tap the phone number and the WhatsApp button on a phone;
• read the opening hours, address and offers on the site. Your December holiday hours shouldn't still be up in May;
• open a few links in the menu and the footer to make sure they don't lead to deleted pages.

A form that broke after an update can stay broken for weeks, because nobody gets the message that would tell them.