A website maintenance checklist for business owners.

Launch day is the last day a website is fully up to date. After that the software underneath gets older, the content drifts away from what the business now does, and small faults build up in places nobody looks. business.gov.au lists maintaining, monitoring and measuring as a step in running a business website, next to building it.

There is a security reason too. In July 2026 the Australian Signals Directorate warned of a large campaign against content management systems and their plugins, and said many small and medium Australian businesses had been affected. The weaknesses being used were already public, and fixes were already available. Its first piece of advice was to patch website software and plugins quickly.

The list below is grouped by how often each job comes around. Most of the examples are from WordPress, but the same jobs exist on any platform.

Every week

• Apply updates to the content management system, its plugins and its themes. WordPress has been able to update each plugin and theme automatically since version 5.5. It emails the site owner after every attempt, including the ones that fail, so someone has to read those emails.
• Confirm the backup ran, and that it covers the database as well as the files. WordPress suggests a weekly backup for a small site that rarely changes, a daily one for a busy site, and one before every upgrade.
• Send a test enquiry through the contact form and check that it arrives. A form that has stopped delivering is easy to miss, because the only symptom is that nothing turns up.

Every month

• Look at Google Search Console. Google emails you when it finds a new problem, and suggests checking in about once a month to see which pages are indexed and whether visits from search are falling.
• Open the Site Health screen if the site runs on WordPress. It is under Tools in the dashboard, and it lists critical issues, such as background updates that have stopped working, ahead of the minor ones.
• Click through the main pages on a phone and on a computer. Look for broken links, missing images and menus that lead nowhere.
• Read the facts: opening hours, prices, phone numbers, staff names, service areas. These go out of date without anyone deciding to change them.
• Check the speed of your busiest pages. Our lesson on Core Web Vitals explains the three measurements and where to find them.

Our free website health check covers several of these in one pass and is a reasonable place to start the monthly look.

Every quarter

• Restore a backup somewhere other than the live site and open it. WordPress recommends keeping at least three to five recent backups in different places. They are only useful if one of them can be turned back into a working site, which is the subject of A backup you have never restored is a guess.
• Delete what is not used. WordPress’s hardening guide says to delete a plugin you are not using. Switching it off leaves its files on the server.
• Review who can log in. Remove former staff, old agencies and shared accounts. Give each remaining person their own login with a strong password and multi-factor authentication.
• Check each plugin is still looked after. A plugin whose author has stopped releasing updates will not receive the next security fix.

Every year

• Check the expiry dates of the domain name and the security certificate, and confirm that the business itself is the registered owner of the domain. The domain and certificate expiry check shows both dates.
• Ask the host which version of PHP the site runs on. PHP is the language WordPress is written in. Each PHP release is supported for four years, the last two for critical security fixes only, and after that it gets nothing.
• Read the whole site as a customer would, start to finish, and note anything that no longer describes the business.
• Look at the numbers. business.gov.au suggests using analytics, and feedback from customers, to judge whether the site is doing what you built it for.

What to ask whoever looks after the site

If an agency, a host or a staff member maintains the website, you do not need to follow each step. You do need answers to a few questions, preferably in writing.

• Who applies updates, and how soon after they are released?
• Where are the backups kept, and when was one last restored as a test?
• Who is told if the site goes down or an update fails?
• Who holds the logins for the domain, the hosting and the website itself?
• If the site were broken into tomorrow, what would happen first? The Australian Signals Directorate’s advice is to restore from a recent backup that is known to be good, then patch whatever let the attacker in.

A vague answer to any of these is the thing to fix first.

Where to go next

Run the website health check and the security headers check to see where your site stands today. If you would like the list above handled for you, hosting and maintenance are part of Websites.