Website maintenance for a small business: a monthly checklist

Why websites need upkeep

Websites rarely break with a crash. They wear out quietly. A security certificate stops renewing and visitors see a warning. A plugin goes years without an update. The holiday hours were never changed. The form that used to email the owner now emails someone who left. Each one costs inquiries, and nobody notices until a customer mentions it.

The fix isn’t a big project. It’s a short routine on a schedule, the same way you service a truck. Google’s own advice on Search Console sets the pace: “Many users need only a quick site check-up once a month, unless we alert you that we’ve found a problem.”

Every month: 15 minutes

1. Open Search Console. Google lists its own critical checks: your property’s overview, how you’re performing on Google, whether your site has been hacked, and whether it breaks Google’s policies. The Security issues report covers hacked content, malware and social engineering. The Manual actions report shows whether a person at Google has found pages that break its spam policies. If you haven’t set it up, our guide Can Google read your website? starts there.

2. Glance at clicks and impressions. The Performance report counts how often your site appeared in Google results and how often people clicked. You’re looking for a sudden drop, not day-to-day wobble.

3. Send yourself a test inquiry. Fill in your own contact form on your phone and confirm it arrives where your team will see it. Tap your phone number and map link too. Nothing in your analytics tells you a form silently stopped sending.

4. Check your hours. On your website and your Google Business Profile, including upcoming holidays. Google says that without special hours set for a holiday, a warning may appear on your profile telling people your hours might differ.

5. Apply updates. On WordPress, minor and security releases install automatically on current versions; major releases and most plugins still need you. WordPress’s own advice: “To keep your WordPress site secure, you should always update your plugins and themes to the latest version.” Back up first. On a hosted builder, ask your provider what’s yours to update.

Every quarter: about an hour

• Test a restore. CISA recommends the 3-2-1 rule (three copies, on two kinds of storage, one off-site) and testing that your team can restore data, fully and partially. A backup you’ve never restored is a guess.
• Read your own site. Prices, services, staff, photos and service areas drift out of date faster than anything technical.
• Review who has access. Remove anyone who left or finished their work, in every account. Our guide Who owns your website logins? has the full list.
• Check Page indexing. Your important pages should be indexed. Google’s own advice is to fix only the 404 errors you link to yourself or list in a sitemap, and not to expect every URL to be indexed.

Certificates are getting shorter

The padlock in a browser comes from a security certificate (TLS, often still called SSL). Certificates expire, and when one does, visitors get a warning instead of your site. The industry body that sets the rules, the CA/Browser Forum, voted in April 2025 to cut the maximum lifetime of these certificates in steps:

The 200-day limit is already in force. Let’s Encrypt, the free certificate authority many hosts use, issues 90-day certificates by default and has announced it will shorten them further. It also stopped sending expiration reminder emails in June 2025. So don’t count on a warning email.

What to do: confirm with your host that certificates renew automatically, and note the current expiry date. Let’s Encrypt’s own getting-started page says that for many people, the hosting provider gets and manages certificates for them. Make sure that’s true for you.

Every year

• Domain renewal. ICANN’s rules require registrars to send reminders about a month and a week before your domain expires, and again within five days after. They go to the registrant’s contact email, so that address has to be one you still read. Turn on auto-renew and keep the card current.
• Two-step sign-in. The FTC’s advice to small businesses: “Require multi-factor authentication to protect sensitive information.” Check email, registrar, website and Google accounts.
• Email authentication. The FTC explains that SPF verifies which mail servers may send email for your domain, and DKIM puts a digital signature on outgoing mail. Ask your email provider whether SPF, DKIM and DMARC are set up. They help stop scammers from sending email that looks like yours.
• A fresh-eyes review. Read the site as a new customer would. Does it still describe the business you run today?

When you remove or rename a page

Google’s blog says that a page returning a 404 does not, by that fact alone, hurt your site in search results. But Google’s documentation also says that pages already in its index that start returning a 4xx error are removed from the index. If a page people find on Google moves, redirect the old address to the new one, and update any links on your own site that pointed to it.

The checklist

Tick as you go, or print it and keep it with your monthly paperwork. Nothing you tick is saved or sent.

Who should do it

Anyone careful can do the monthly checks. What matters is that one named person owns them, with a date on the calendar, and that someone technical is on call for what the checks turn up.

If you’d rather hand it off, our Care plan includes a monthly check of your Google profile details, one form test, and routine platform care where your hosting and access are confirmed in writing. It doesn’t promise uptime or backups, and you keep ownership of everything.