A few years ago a client rang me in a panic. Their contact form had stopped working, and nobody noticed for six weeks. Enquiries had been going nowhere the whole time. The fix took ten minutes. Finding out late cost them real business.Most website disasters look like this. Something small breaks quietly, nobody is checking, and the problem grows. A short routine, done on a schedule, catches nearly all of it.You don't need to be technical to do this. You need a calendar and a bit of discipline. Much of the work can also be automated, so I've flagged where.
Why routine maintenance matters
A website is more like a shop than a brochure. Doors stick, lights fail and stock goes out of date. If nobody walks the floor, customers notice before you do.
Regular maintenance protects you from three common problems:
• Downtime, when your site is unreachable and you lose sales and trust.
• Security breaches, which usually exploit outdated software, not clever hacking.
• Slow decay, where pages get heavier, links break and forms fail without anyone noticing.
The routine below is built around the tasks that prevent these. It's not exhaustive, and that's deliberate. A short list you actually do beats a long one you abandon.
Daily: let automation watch for you
You shouldn't spend daily time on your site. You should have tools that tell you when something is wrong.
Set up uptime monitoring. UptimeRobot has a free plan that checks your site every five minutes and emails or texts you if it goes down. Setup takes about five minutes. This alone would have saved a few of my clients a very bad weekend.
Turn on security alerts. If your site runs on WordPress, a free security plugin such as Wordfence can email you about failed login attempts, suspicious file changes and known threats. Keep the alerts going to an inbox you actually read.
Glance at your inbox for site notices. Hosting providers send warnings about disk space, expiring plans and security issues. Don't let these sit unread.
That's it for daily. If the alerts are quiet, you're fine.
Weekly: 20 minutes
Pick a regular slot, such as Monday morning with your coffee.
1. Check that your backups ran. A backup is only useful if it exists. Most hosts offer automatic backups, and plugins like UpdraftPlus (free for the basics) can send copies to Google Drive or Dropbox. Each week, confirm that a recent backup is there and dated correctly.
2. Apply updates. Your content management system, themes and plugins release updates constantly, and many of them fix security holes. Take a backup first, then update. Do it weekly so you never face a pile of 30 updates at once.If your site uses a page builder or a lot of plugins, update a few at a time and check the site after each batch. That way, if something breaks, you know which update caused it.
3. Test your forms. Send yourself a message through your contact form, and confirm it arrives. If you take bookings or payments, run a test of that too. Forms are the most common thing to fail silently.
4. Clear spam. Delete spam comments and form submissions, so real messages don't get buried. An anti-spam tool such as Akismet or a simple CAPTCHA reduces the volume.
Monthly: one hour
1. Run a speed test. Paste your homepage and one key page into Google PageSpeed Insights (free). Note the scores and compare them month to month. A sudden drop usually means a new large image, a new plugin or a problem with your hosting.The most common cause of a slow site is oversized images. If yours are several megabytes each, compress them with a free tool like Squoosh or TinyPNG before uploading.
2. Check for broken links. Links go dead as other sites change. Use a free checker such as Dead Link Checker, or the Screaming Frog desktop tool (free for up to 500 pages). Fix or remove anything that leads to an error page, starting with your most visited pages.
3. Review Google Search Console. This free tool from Google shows how your site appears in search and flags problems such as pages that can't be indexed or mobile usability issues. Spend ten minutes checking for new warnings.
4. Review your user accounts. Look at everyone with a login to your site. Remove anyone who no longer needs access, such as a former freelancer or an old employee. Make sure each person has only the level of access they need.
5. Look at your analytics. You don't need to analyse everything. Just check whether traffic has dropped sharply or a page has stopped getting visitors. Unexplained drops are often the first sign of a technical issue.
Quarterly: two hours
1. Test a full restore. This is the task people skip, and it's the most important one. Take a backup and restore it somewhere safe, such as a staging copy of the site that your host can create, or ask your host or developer to do it. If you've never restored from a backup, you don't yet know whether yours works.
2. Clean out unused plugins and themes. Every plugin you install is something that needs updating and could be exploited. If you're not using it, delete it (not just deactivate it).
3. Review passwords and two-step login. Make sure your admin, hosting and domain accounts have strong, unique passwords, ideally kept in a password manager like Bitwarden. Turn on two-step verification wherever it's offered.
4. Check renewal dates. Domain names, SSL certificates and hosting plans all expire. Write the dates in your calendar with a reminder a month ahead. An expired domain can take your whole site and email offline, and recovering it can be slow and expensive.
5. Review your content. Read your key pages as a customer would. Check that prices, opening hours, team names and contact details are still correct. Out-of-date information costs you credibility.
Warning signs that need attention now
Don't wait for the next scheduled check if you see any of these:
• Your site shows a security warning in the browser, or Google flags it as unsafe.
• Pages redirect somewhere you didn't set up, particularly on mobile.
• Strange new pages, products or admin users appear that you didn't create.
• Your site is suddenly very slow or keeps going offline.
• You get a hosting email about suspicious activity or malware.
• Customers tell you something isn't working, such as a form, checkout or login.
• Your site shows in search results with odd text, often in another language.
If one of these happens, take a backup if you can, change your admin and hosting passwords, and contact your host or developer straight away. Early action usually limits the damage.
Your checklist
Automated (set up once)
☐ Uptime monitoring
☐ Security alerts
☐ Automatic backups
Weekly (20 minutes)
☐ Confirm a recent backup exists
☐ Apply updates after backing up
☐ Test your contact form and any checkout or booking
☐ Clear spam
Monthly (1 hour)
☐ Run a speed test and compress large images
☐ Check for broken links
☐ Review Search Console for warnings
☐ Remove accounts that no longer need access
☐ Check traffic for unexplained drops
Quarterly (2 hours)
☐ Test a full restore from backup
☐ Delete unused plugins and themes
☐ Review passwords and turn on two-step login
☐ Check domain, SSL and hosting renewal dates
☐ Read your key pages for outdated information
Start small
If this feels like a lot, begin with the automated tools and the weekly list. Those take about half an hour to set up and 20 minutes a week to keep going. Add the monthly and quarterly tasks once the habit sticks.
A website that gets a little attention regularly rarely needs an emergency. Put the first weekly slot in your calendar today.