Website Maintenance Checklist: Monthly, Quarterly, Yearly

Once a month, check the things customers act on: your hours, prices and phone number, and a test request through your own form. Once a quarter, check speed, software updates and backups, and whether your Google Business Profile still matches the site. Once a year, check the domain and SSL renewal dates, who has logins, and whether the site still describes the business you run today.

Nothing on this checklist is hard. Busy owners mostly need it on a calendar, because a website rarely breaks loudly. A form that stopped sending, or holiday hours from last winter, can sit there for months while customers quietly call someone else.

Start with one page of logins and dates

Before the first check, write down:

the registrar for your domain, the login and the expiration date
the host, and who manages it
the email provider
where form messages go
the login for your Google Business Profile
who else has access to each of these

Keep the sheet somewhere that doesn't depend on the website or the email. A printed page in the office is fine. If the words registrar and host blur together, our article on what a host does and what it leaves to you sorts them out.

Every month: what customers act on

Hours, prices and the phone number

Open the site on your phone, the way a customer would, and read the pages people actually use: the homepage, your main service pages, the contact page.

Hours, including any line about weekends or emergency calls.
Prices or price ranges, if you show them. An old price on the site makes for an awkward phone call.
The towns you serve, if you've added or dropped any.
The phone number. Tap it and make sure it rings the line that gets answered.
Promotions or seasonal notes that have ended.

Holidays need their own look. Google Business Profile has special hours for this, meant for when your hours change "for a brief period of time." Google's help page on special hours says they cover a closure of up to 6 days in a row, and suggests marking the business temporarily closed for anything longer. It also says, "It's a good idea to confirm your hours for official holidays," even when they're your usual hours. Put the same holiday hours on the website on the same day, so the two never disagree.

Send yourself a test request

Fill in your own form from your phone, as a customer would, and attach a photo if the form takes one. Then check:

that it arrived, and how long it took
that it landed in the inbox, not in junk
that it went to the right person, especially if someone has left
that hitting reply answers the customer, not the website

A form can stop sending without showing any error on the page. This is the one monthly check never to skip.

Add a few recent jobs

If you have new job photos, add a couple. A gallery that stops two years ago makes people wonder whether you're still busy.

Every quarter: speed, updates and backups

Run a speed check

Put your homepage and one service page through our free website checker. It runs Google's own mobile speed test, plus checks for getting calls, phone fit and Google search. Write down the scores each quarter. When a score drops, look at what was added since the last check: photos uploaded straight from a phone, a new plugin, a chat widget, a video at the top of the page.

Software updates

If your site runs on WordPress or another system with plugins, the core software, the theme and each plugin get updates, and some of those are security fixes. The FTC's cybersecurity guide for small businesses puts it plainly: "it's essential that you use the latest versions with up-to-date security patches."

Run the updates, or confirm that whoever manages the site has.
Delete plugins you no longer use.
After the updates, send the test request again. An update can break a form or a layout without anyone noticing.

If your site is on a hosted builder, the platform updates its own software and your part is the content. A site built without a content system has less to update, but its hosting still needs someone looking after it.

Backups you've seen work

The FTC's basic advice to businesses is to "back up important files regularly." Your website counts. Ask whoever runs your hosting:

How often is the site backed up, and how far back do the copies go?
Where are the copies kept? A backup stored on the same server as the site doesn't help if that server has a problem.
Has anyone ever restored one?

A backup nobody has restored is a guess. Ask to see one restore, once, so you know it works before the day you need it.

Your Google profile next to the site

Open your Google Business Profile and your website side by side, and check that these match:

the business name, written the same way
the phone number
the address, or the service area if you don't serve customers at your address
the hours
the website link, and that it opens the right page
the list of services

When one of them changes, change it everywhere at once. Our guide to keeping your name, address and phone the same everywhere covers the directories and listings beyond Google too.

Every year: renewals, access and the big picture

Domain renewal

Look up the expiration date at your registrar. Make sure auto-renew is on, the card on file won't expire before the renewal, and the renewal notices go to an address you read. That address shouldn't be at the same domain: if the domain lapses, the website and the email on it stop together, and the notices have nowhere to land.

SSL certificate

SSL is what puts the "https" and the padlock on your site. In most browsers you can click the icon to the left of the address and open the certificate details to see when it expires.

Certificates are getting much shorter lives. In 2025 the CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules, voted to cut the maximum lifetime of a certificate from 398 days to 47 days, in steps starting in March 2026 and ending in March 2029. A yearly calendar reminder can't keep up with that. Renewal has to be automatic, so ask your host or web person to confirm that yours is.

Who has access

Go down your sheet of logins. Remove former employees and any agency you no longer work with. Change shared passwords, and turn on two-step login wherever it's offered. The main admin on every account should be you or someone in the business.

Does the site still describe your business

Once a year, read the whole site start to finish, as a stranger would. Look for:

services you've added or stopped doing
towns you've moved into
license or insurance details that were renewed
staff names and photos, if the team has changed
an About page whose story has moved on

If most pages need rewriting, that's no longer maintenance. It's a sign the site needs a bigger change.

Who should do which part

You're the best person for the monthly checks. You know when hours or prices change, and nobody else will notice that the form went quiet. The quarterly and yearly checks are more technical: updates, backups, SSL and speed. You can do them yourself, call in someone when they come due, or have them covered by a plan.

Here's what our care plan covers: hosting and SSL, updates and backups, and changes when you need them. It's optional, and without it the site is still yours and keeps working.

Whichever way you go, set three reminders: one monthly, one quarterly, one yearly. Then do the checks on the day they come up.

A site that's easy to keep current

If your current site is a chore to update, starting fresh can be less work than patching it every month. Get your free preview: we build the first version of your website free, in 2 days, and you click around it before you decide.