What ongoing website maintenance should include

Launching a website is the beginning of its operational life—not the end of the project. Software changes, content becomes outdated, certificates and domains renew, forms can stop delivering messages, search engines recrawl pages and new security issues appear.

Ongoing website maintenance is the repeatable work that keeps the site available, protected, accurate and aligned with the business. The exact tasks depend on whether the site is static, uses a content-management system such as WordPress, accepts payments or personal information, connects to other platforms or supports essential customer activity.

Website maintenance is broader than content updates

Changing text and images is only one part of maintenance. Technical care includes software updates, backups, security monitoring, uptime, form testing, performance, accessibility and recovery. Business care includes reviewing services, pricing, hours, staff information, legal notices, analytics, search visibility and ownership records.

A site can appear normal while contact forms fail, analytics stop recording, an administrator account remains exposed or backups become unusable. That is why a maintenance plan should identify tasks, frequency, responsibility, evidence and escalation—not simply promise that someone will “keep an eye on it.”

A 12-point website maintenance checklist

1. Apply software and security updates

   Keep the content-management system, plugins, themes, frameworks, server software and third-party components supported and current. Back up before significant changes, review release notes and test important functionality after updating.

2. Monitor for vulnerabilities and suspicious changes

   Watch for outdated components, unexpected administrator accounts, modified files, malicious redirects, abnormal traffic and security alerts. Remove unused plugins, themes, integrations and accounts because inactive components can still create risk.

3. Maintain tested backups

   Back up website files, databases, configuration and other necessary assets. Store copies separately from production, restrict access and test restoration. Confirm that the backup contains everything required to rebuild the site.

4. Check uptime, HTTPS and domain renewals

   Monitor whether the site is reachable and whether TLS certificates are valid. Track domain, hosting and service-renewal dates under business-controlled accounts so an expired card or departed employee does not interrupt service.

5. Test forms and customer journeys

   Submit every contact, booking, quote, newsletter or checkout form and verify delivery, confirmation messages and mobile behaviour. Test important links, calls to action, downloads and error pages from a visitor’s perspective.

6. Review content for accuracy

   Confirm services, descriptions, prices, hours, locations, team details, certifications and contact methods. Remove expired offers and claims that can no longer be supported. Assign business owners to approve important changes.

7. Find broken links and missing assets

   Check internal and external links, images, videos, documents and redirects. When removing or renaming a page, use an appropriate redirect and update navigation, internal links and the sitemap.

8. Measure speed and user experience

   Watch loading, interactivity and visual stability on mobile and desktop. Optimize oversized images, unnecessary scripts, fonts, caching and server response, then verify improvements with real-user or field data where available.

9. Review accessibility

   Check keyboard navigation, focus visibility, headings, labels, alternative text, colour contrast, link purpose and zoom behaviour. Automated tools can find some issues, but important pages also need human testing.

10. Monitor search visibility

    Use Search Console to review indexing, crawling, sitemap processing and search performance. Check that important pages are internally linked, canonical addresses are correct and pages intended for search are not blocked accidentally.

11. Verify analytics and privacy controls

    Confirm that analytics, conversion events and consent mechanisms operate as intended. Review which services collect information, update privacy notices when practices change and avoid retaining unnecessary form submissions or logs.

12. Maintain documentation and recovery contacts

    Record the technology stack, hosting, domain registrar, DNS, vendors, renewal dates, backup locations, administrator process and emergency contacts. Store credentials securely rather than inside an ordinary maintenance document.

A practical maintenance schedule

Frequency should increase when the site changes often, handles transactions or personal information, supports essential operations or depends on many extensions and integrations. Critical security updates may need prompt action rather than waiting for a scheduled window.

Use a safe change process

Before a significant update, create a current recoverable backup and define how to roll back. When practical, test changes in a staging environment rather than experimenting on the live site. After deployment, clear relevant caches and verify representative pages, forms, logins, integrations, analytics and mobile layouts.

Document what changed, who approved it, when it was released and what was tested. This record becomes especially valuable when several providers work on hosting, content, advertising, analytics or application integrations.

Keep business ownership and access clear

The business should have appropriate ownership or administrative control of its domain registration, DNS, hosting, website platform, analytics, Search Console, email-delivery service and important third-party integrations. Providers should use their own named accounts or delegated access instead of sharing the owner’s password.

Require MFA where available, remove access promptly when responsibilities change and keep at least two authorized business contacts for critical accounts. Confirm in writing who owns the website content, design, source files, databases and licenses, and what the provider will return or transfer when service ends.

What a maintenance report should show

• Updates applied, deferred or requiring approval
• Backup completion and most recent restore test
• Uptime, security alerts and resolved incidents
• Forms, links and customer journeys tested
• Performance, accessibility or search issues identified
• Content changes and business approvals
• Renewals, risks and recommended next actions

Questions to ask a website maintenance provider

1. What exactly is included?

   Clarify updates, content time, monitoring, backups, restoration, security response and separately billed work.

2. How quickly are critical issues handled?

   Define support hours, alert handling, severity levels, response targets and emergency contacts.

3. How are changes tested and reversed?

   Ask about staging, backups, rollback, post-change checks and documented approvals.

4. Who controls accounts and assets?

   Confirm business ownership, delegated access, source files, licensing and exit procedures.

5. What evidence will we receive?

   Request understandable reports showing completed work, open risks and recommended priorities.

6. What is excluded from recovery?

   Confirm which files, databases, email services, integrations and third-party platforms are not covered.

Official guidance and next steps

WordPress documentation recommends keeping WordPress current and creating a backup before updates so the site can be restored if problems occur. Google Search Console provides information about how Google crawls, indexes and serves a website, while sitemaps help search engines discover important URLs. Google’s Web Vitals guidance focuses on loading performance, interactivity and visual stability. W3C accessibility guidance explains that accessible websites should work for people with diverse abilities.

Review the official guidance for updating WordPress, using Google Search Console, website sitemaps, Core Web Vitals and web accessibility. Related CommzzTech guidance includes the cybersecurity checklist and backup and recovery guide.

Important: This article provides general information. Maintenance, accessibility, privacy, security and legal requirements depend on the website, business activities and jurisdiction. Obtain appropriate technical and professional advice for your environment.

← Back to all resources