What should I check on my website, and how often?
Every week, check the site loads on a phone, send a test through each form, and confirm updates and backups ran. Every month, review users, plugins, security, speed, Search Console and your content. Every year, check renewal dates, contact details and payment cards, remove old access, and decide whether the site still fits the business.
Download the website care checklist (PDF)6 pages, 438 KB, free to print. What's inside
The short version
- Weekly (10 to 15 minutes): site up on a phone, forms tested, updates and backups confirmed, nothing odd.
- Monthly (about an hour): users, unused plugins, two-step login, SSL, speed, Search Console, content.
- Quarterly: a test restore, lead sources, email records, a check on several devices.
- Yearly: domain and license renewals, contact details, who has access, and whether the site still fits.
- Write down what you checked, and give each item a named owner.
Why does a website need regular care?
Most website problems aren’t dramatic hacks. They’re a contact form that stopped sending three months ago, a domain that lapsed because the card on file expired, or an update that broke the booking page on a Friday afternoon. A simple routine catches all of these early.
Use this checklist yourself, hand it to whoever looks after your site, or use it to check whether your current provider actually does the work. Our answer on what website maintenance includes explains how care differs from hosting.
What do I need to know before I start?
You can’t look after a site if you don’t know where its pieces live. Spend 20 minutes writing down:
- Where the domain is registered, and which account owns it.
- Where the site is hosted, and who has the login.
- What it’s built on: WordPress, Squarespace, Wix, a static build or something else.
- Where business email is hosted.
- Who has admin access to the site, domain, hosting, Google profile and analytics.
Keep it in a password manager or another secure place. Our article on making sure your business owns its accounts shows how to turn this into an asset register.
What should I check every week?
These catch the problems that cost you customers fastest.
1. Is the site up?
Open your home page and two or three key pages on your phone, not just your office computer. Better, use an uptime monitor that alerts you when the site goes down. If it’s down now, start with why a website goes down.
2. Do the forms work?
Send a test through your contact form and any quote or booking form. Confirm the email arrives and isn’t in spam. Forms fail silently more often than people expect; it’s one of the most common problems in our support records. See why form emails go to spam or go missing.
3. Did updates run, and did anything break?
On WordPress, check for pending updates to WordPress, plugins and the theme. WordPress’s hardening guide says older versions of WordPress “are not maintained with security updates,” and to keep plugins updated too. The safe pattern is to back up, update on a test copy, check the key pages, then update the live site. Our answer on plugin updates covers it.
4. Did the backup run?
Confirm the latest backup finished and that it’s stored away from the web server. The WordPress guide recommends regular backups, including the database, kept in a trusted location. Our answer on how often to back up WordPress sets out what a good backup looks like.
5. Anything odd?
Look for admin users you don’t recognize, pages you didn’t add, strange links in the footer, or a sudden flood of form spam. These are often early signs of trouble. A “Not secure” warning in the browser needs attention too; see why a site says Not Secure.
What should I check every month?
Set aside about an hour.
Security
- Delete plugins and themes you don’t use. The WordPress guide says to delete unused plugins, not just deactivate them.
- Review admin users. Remove anyone who no longer needs access, and lower roles that are higher than needed. See which WordPress role to give staff.
- Confirm two-step login is on for every admin. CISA says people who use multifactor authentication are significantly less likely to get hacked.
- Check the SSL certificate is valid and not close to expiring. Our domain and SSL checker does it in seconds.
Speed
- Test your home page and one key service page on mobile. Google’s Web Vitals set “good” at 2.5 seconds for Largest Contentful Paint, 200 milliseconds for Interaction to Next Paint and 0.1 for Cumulative Layout Shift.
- Look for huge new images uploaded straight from a phone. They’re the usual reason a site slowly gets slower. Try our speed test, and see what to fix first on phones.
Search and visibility
- Open Google Search Console and look for new errors, pages dropping out of the index, or a sudden fall in clicks. See what Search Console shows.
- Search for your business name, and your main service plus town. Is what shows up accurate?
- Check your Google Business Profile for new reviews and outside edits. Our article on keeping your profile working has the routine.
Content
- Are hours, published prices, staff and service areas still correct?
- Any expired offers, past events or “coming soon” notices still showing?
- Do the phone and email links work when tapped on a phone?
- Click the main menu and footer links. Fix anything that leads to an error page.
What should I check every quarter?
- Test a restore. Restore at least one page or file from backup. A backup you’ve never restored is a hope, not a plan.
- Review leads. Where did form and call leads come from, and how fast were they answered? Our answer on tracking calls and form leads shows how to count them.
- Check email records. Run your domain through our email deliverability checker, especially after adding an email or marketing tool.
- Try a few devices. An iPhone, an Android phone and a desktop browser, on the pages that bring you business.
- Read one page as a stranger would. Would they know what you do, where, and how to reach you?
What should I check every year?
Things that expire
- Domain. Check the renewal date, turn on auto-renew and check the card on file. ICANN says that if you choose auto-renewal, you must keep your payment information current. See what happens if a domain expires.
- Domain contact details. ICANN requires registrants to keep contact details accurate and updated. If the contact email is an old employee’s, renewal notices go nowhere.
- Hosting and paid plugins or themes. A lapsed license can mean no more security updates.
- Email accounts. Remove mailboxes for people who’ve left and check storage limits. See what to do when a mailbox is full.
Access and ownership
- List everyone with access to the site, domain, hosting, email admin, Google profile, analytics and social pages.
- Remove former staff and vendors.
- Confirm the owner holds top-level access everywhere.
- Store two-step login recovery codes somewhere safe.
The bigger picture
- Does the site still fit the business? Our answer on whether to redesign or fix helps you decide.
- Are there questions customers keep asking that the site doesn’t answer?
- Is the theme or page builder still supported and updated?
- Take an archive copy of the whole site and store it apart from regular backups.
What do I do when a check fails?
Decide in advance, so a failed check leads somewhere:
| What failed | When to act |
|---|---|
| Site down or a form broken | Today. These cost customers directly |
| An update or backup failed | This week, before the next update runs |
| Speed, content or search issues | Add to a list and work through monthly |
| Anything that looks like a hack | Stop, don’t delete things in a panic, and get help |
For a suspected hack, read what to do if your site was hacked. For a white screen after an update, see critical errors and white screens.
What are the most common mistakes?
- Assuming automatic means checked. Auto-updates and auto-backups can fail quietly.
- Testing forms on a computer only. Many leads come from phones.
- Backups kept only on the same server as the site.
- Nobody named for each job. “Someone should check the forms” means nobody does.
- Old admin accounts for staff and vendors who left years ago.
- Letting the card on the domain expire.
How do I make the routine stick?
- Put the weekly check on your calendar as a recurring 15-minute appointment.
- Keep a simple log: date, what you checked, what you fixed. A shared spreadsheet is fine.
- Give each item a named owner.
- When something breaks, add a check for it so it doesn’t happen twice.
How long does it take, and when should I hand it off?
About 15 minutes a week, an hour a month, a little more each quarter and an afternoon once a year. Many owners do the weekly checks themselves and hand off the rest. If you’re comparing providers, ask which items on this list they actually do, how they report to you, and what happens when an update breaks something. Our article on what to ask a web company has more questions like that.
How does E-3 handle this?
“Do you keep my WordPress site and plugins updated?” is one of the most frequent questions in our support records, with about 155 requests since 2019. Our website care service covers uptime monitoring, updates tested on a staging copy first, daily backups and security alerts, and our managed hosting includes SSL. Ask for a change and we make it.
Related questions
Common questions
- How long does website care take each week?
- For a typical small-business site, the weekly checks take about 10 to 15 minutes once you have a routine. The monthly check takes about an hour, which is why many owners hand that part to someone else.
- Can I turn on automatic updates and skip the rest?
- Automatic updates help, but they don't replace checking. An update can break a form or a layout without anyone noticing. Backups, form tests and access reviews still need a person.
- What's the single most important item on the list?
- A recent backup, stored away from your web server, that you've proved you can restore. Almost every other problem is fixable if you have one.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.