Website Maintenance Checklist for Business Owners

Maintenance fails when nobody owns it. Name a person or vendor responsible for technical updates, and a person responsible for content accuracy. Keep an inventory of domains, hosting, DNS, CMS admin, analytics, Search Console, email delivery and payment dashboards.

Review who has admin access at least quarterly. Remove former staff and unused contractor accounts. Prefer individual logins over shared passwords. Store recovery emails and phone numbers where your leadership team can find them if the primary contact is unavailable.

• Domain registrar and DNS provider
• Hosting or platform account
• CMS and staging credentials
• Analytics and advertising tags owners
• SSL and email/SMTP configuration contacts

Confirm that backups exist, that they include both files and database where relevant, and that someone has tested a restore — not only that a backup job is “enabled.” Know retention length and where backups are stored (ideally separate from the live server).

Before major updates, theme changes or plugin installs, take a fresh backup or use staging. Document how long a restore typically takes so leadership understands recovery expectations during an incident.

Keep CMS core, themes, plugins, frameworks and server runtimes within supported versions. Outdated components are a common source of bugs and vulnerabilities. Update in a controlled way: staging first when the site is business-critical, then production with a quick smoke test of key pages and forms.

Remove unused plugins, themes and leftover demo content. Every unused component is another surface to maintain. For Shopify and similar platforms, review apps and theme customisations on a similar cadence even though core platform updates are handled for you.

1. List installed plugins, apps and custom code owners
2. Update staging, test checkout/contact flows, then update live
3. Record what changed and when for easier troubleshooting
4. Retire components that no longer serve a purpose

Good hygiene reduces risk; it does not guarantee that a site will never be compromised. Use strong unique passwords or a password manager, enable multi-factor authentication where available, limit admin accounts, and keep software current. Monitor for suspicious admin users, unexpected file changes and sudden traffic spikes when you have the tools to do so.

If you handle customer data or payments, confirm that payment flows use reputable providers and that you are not storing card data unnecessarily. For WordPress and similar stacks, discuss web application firewalls, malware scanning and hardening with your technical partner — as layers of defence, not as absolute protection.

Outdated prices, closed locations, expired promotions and wrong phone numbers damage trust more visibly than most technical issues. Schedule a content review: homepage offers, service pages, contact details, team bios, blog posts that make time-sensitive claims, and footer links.

Keep privacy policy, terms and refund or shipping policies aligned with how you actually operate. When you add analytics, chat widgets or marketing pixels, update disclosures as needed and remove tags you no longer use.

• Phone, WhatsApp, email and address consistency
• Business hours and holiday notices
• Product availability and pricing accuracy
• Broken links on high-traffic pages

Test contact forms, quote forms, newsletter signups and checkout paths regularly. Confirm messages arrive in the correct inbox (and spam folder checks after DNS or hosting changes). Watch for silent failures after plugin updates or SMTP credential expiry.

If you rely on WhatsApp click-to-chat buttons, verify numbers and pre-filled messages. For ecommerce, place a small test order periodically on staging or live with a refundable method when appropriate.

Watch Core page weight: oversized images, unused scripts and heavy page builders slow mobile users. Compress new media before upload. After redesigns, re-check mobile rendering of key templates.

Use uptime monitoring if downtime has business cost. Keep Google Search Console (or equivalent) access active and glance at coverage or crawl issues monthly. After URL changes, confirm redirects. Maintenance is not a full SEO programme, but broken technical foundations undo SEO work.

Monthly: review updates applied, form tests, backup status, uptime incidents and any content that must change for campaigns. Quarterly: access review, deeper plugin or app audit, restore test when feasible, analytics tag audit, and a walkthrough of top conversion paths on mobile.

Document the cadence in a shared checklist so holidays and staff changes do not erase institutional memory. If a vendor handles maintenance, ask for a short monthly summary of what was updated and what remains risky or deferred.