Website maintenance checklist: weekly, monthly, quarterly, yearly

A website maintenance checklist is the list of recurring tasks that keep a site secure, fast, accurate and visible in search: backups and updates, security and uptime checks, speed, forms and checkout, content, search health, accessibility and renewals, each on its own cadence. The simplest way to run it is by frequency, with an owner for every task, so nothing depends on someone remembering. This guide sets out what to do weekly, monthly, quarterly and yearly, a table of owners, and what a good support agreement should cover if you hand the work to a partner.

Last updated: 23 October 2026.

Why is maintenance not optional?

A website is software that runs on other software: a content management system, plugins or apps, a server, certificates, third-party scripts. Each of these changes over time, and each change can open a security hole, slow the site down or break a feature quietly. Meanwhile prices, people, opening hours and services change in the business, and a site that does not follow them loses trust.

Most website problems that reach customers were visible in advance to someone who looked. Maintenance is simply the habit of looking, on a schedule.

At Odduel, a creative and technology agency in Barcelona and São Paulo, our maintenance and support service runs this checklist for the sites we build and for sites built by others. The cadence below is the one we use.

In short: back up and update on a fixed rhythm; watch security and uptime continuously; test forms, checkout and key journeys monthly; check speed, search health and accessibility quarterly; review content, access, renewals and the hosting plan yearly. Give every task an owner. Keep a log, so you know what changed when something breaks.

Which tasks are continuous or weekly?

Some things should be watched all the time by tools, with a person reviewing the alerts each week.

1. Uptime monitoring. An alert when the site is down or very slow, sent to someone who can act.
2. Backups. Automatic backups of files and database, stored away from the server, kept for several weeks. Daily for sites that change often; at least weekly for others.
3. Security alerts. Notices from the CMS, plugins and hosting about vulnerabilities and updates.
4. Form and order notifications. Check that enquiries and orders are still arriving; a broken form can go unnoticed for weeks.
5. Error logs. A quick look for new errors on the server and in the browser console.

Which tasks are monthly?

1. Updates. Apply updates to the CMS, theme, plugins or apps, on a staging copy first where the site is complex, then on the live site with a fresh backup.
2. Key journeys. Test the contact form, sign-up, booking and checkout on a phone and a desktop, end to end.
3. Broken links. Run a link check and fix or redirect broken internal and external links.
4. Search Console. Check for indexing problems, security issues and manual actions in Google Search Console, and any drop in clicks on important pages.
5. Analytics sense check. Make sure tracking still works and consent rules are respected.
6. Content freshness. Prices, team, opening hours, offers, events and legal notices are still correct.

Our WordPress security guide explains how to apply updates safely and which settings to review on WordPress sites in particular.

Which tasks are quarterly?

1. Speed and Core Web Vitals. Measure the main templates on mobile and fix what has slipped: heavy images, new scripts, unused plugins.
2. Accessibility spot check. Keyboard navigation, focus states, contrast, alt text on new images, form labels.
3. Restore test. Restore a backup to a test environment to prove that backups actually work.
4. User accounts. Remove accounts of people who left, check roles, require strong passwords and two-step sign-in for administrators.
5. Third-party scripts. Review chat, tracking, advertising and embed scripts; remove what is no longer used.
6. SEO review. Pages that lost traffic, titles and descriptions of new pages, internal links to new content.

Which tasks are yearly?

1. Renewals. Domain, certificate, hosting, licences for themes, plugins, fonts and images.
2. Legal pages. Privacy notice, cookie policy and terms still match what the site actually does.
3. Content audit. Archive, merge or update old pages; refresh key pages with current information and pictures.
4. Hosting and stack review. Is the server still the right size, the PHP or runtime version supported, the CMS still the right choice?
5. Full QA pass. Run a complete check across devices and browsers; our website QA checklist covers what to test.
6. Roadmap. Decide what to improve next year based on analytics, feedback and business plans.

Who owns each task on the website maintenance checklist?

Tasks without owners do not happen. The split below suits most companies that work with an outside partner.

Task	Cadence	Usual owner
Uptime, backups, security alerts	Continuous, reviewed weekly	Support partner or IT
Updates and staging tests	Monthly	Support partner
Key journey tests	Monthly	Support partner, with the business checking orders arrive
Content freshness	Monthly	Marketing or the business owner
Search Console and analytics	Monthly	Marketing or SEO partner
Speed, accessibility, restore test	Quarterly	Support partner
User accounts and scripts	Quarterly	Site owner with the support partner
Renewals, legal pages, stack review	Yearly	Site owner, with legal advice where needed

What extra maintenance do shops, booking sites and multilingual sites need?

Some sites need extra items on the list. An online store adds a weekly look at failed payments and abandoned checkouts, a monthly test order on every payment method, a check that taxes and delivery rates are still correct, and attention to stock and product data feeds to marketplaces and advertising platforms. A booking site adds a test booking each month, a check that calendar connections still sync and that confirmation emails reach the inbox rather than spam.

A site in several languages adds a check that new pages exist in every language, that language switchers lead to the matching page, and that translated titles and descriptions were updated when the original changed. Each of these takes minutes when done on schedule and hours when discovered by a customer.

Why plan maintenance before the site launches?

The easiest site to maintain is one built with maintenance in mind: few plugins, each chosen for a reason; a staging copy for testing updates; backups configured from day one; accounts in the owner’s name; and documentation of how the site is put together. When you brief a new website, include these points, and ask every agency how the site will be kept up to date after launch and by whom.

Why keep a maintenance log?

Write down every update, fix and change, with the date and who made it. When something breaks, the log tells you what changed last, which is usually the cause. It also shows how much maintenance the site needs, which helps when you plan a budget or a rebuild. A shared document or a ticket system is enough.

What does a good support agreement cover?

If you hand maintenance to a partner, the agreement should leave no doubt about what is included.

1. Scope. The tasks on this checklist that the partner performs, and how often.
2. Response times. How fast urgent problems (site down, checkout broken, security breach) and ordinary requests are handled, and in which hours.
3. Backups and recovery. Frequency, where they are stored, how long they are kept, how quickly a restore happens.
4. Updates policy. What is updated automatically, what is tested first, what happens if an update breaks something.
5. Reporting. A monthly summary of what was done, issues found and recommendations.
6. Included hours. Small content or design changes covered, and how extra work is quoted.
7. Access and ownership. Hosting, domain and admin accounts in your name, with the partner as a user.
8. Exit. Handover of credentials, documentation and backups if the agreement ends.

Should updates be automatic?

Automatic updates are tempting: switch them on and forget. For small, simple sites with few plugins, automatic security updates of the core software are usually a good idea. For sites with a shop, bookings, custom code or many plugins, fully automatic updates carry a risk: an update that conflicts with another plugin can break checkout at night with nobody watching. The safer pattern is automatic security patches for the core, scheduled manual updates for everything else, tested on staging, with a backup taken just before.

What are the signs your website is not being maintained?

• Admin warnings about pending updates that have been there for months.
• The copyright year, prices or team pages are out of date.
• Forms that send to an address nobody reads.
• A certificate warning in the browser.
• Speed that has slowly got worse as plugins and scripts were added.
• Nobody can say when the last backup was restored successfully.

Questions people ask

Copy the cadences above into your calendar, assign an owner to each task and start a maintenance log this month. If you would rather hand the checklist to a partner, see our maintenance and support service or tell us about your site.