What website maintenance should include

Most site owners hear “maintenance” and picture someone clicking Update Plugins once a month. That is one task — not a program. Real maintenance is a set of recurring jobs that keep the site online, recoverable, and safe enough that a small change does not become an emergency.

This checklist is what we use when a client asks what should be covered. It applies to WordPress and most small-business stacks. Adjust the details for your host, but do not skip the categories.

Updates — supervised, not automatic roulette

Core, plugins, themes, and PHP runtime all move forward whether you plan for it or not. Maintenance should include:

• A schedule (weekly or monthly, not “when someone remembers”).
• Staging or a safe rollback path before bulk updates on production.
• A quick smoke test after changes: home page, a key form, admin login, and anything revenue-critical.
• A log of what changed and when, so the next person is not guessing.

Automatic updates without supervision are how you get a white screen at 2 a.m. from a plugin you forgot was installed. Plugin updates alone are not a care plan — they are one line on a longer checklist.

Who owns it

Name one person or vendor responsible for applying updates and confirming the site still works. “The host does it” is only true if you can point to a ticket or dashboard that proves it.

Backups — and restore verification

A backup plugin icon in wp-admin does not mean you can recover. Maintenance must include:

• Daily or weekly backups of files and database, stored off-server (S3, remote vault, host backup tier — not only inside the same account that might fail).
• Retention that matches your risk: at least a few rolling copies, not just “last night.”
• Restore verification on a schedule: actually bring a copy up on a staging URL or local environment and log in.

Having a .zip in a folder is storage. Knowing you can rebuild the site is maintenance. Read how restore verification differs from having a backup for what a real check should prove.

Who owns it

Someone must confirm backups completed, test restores at least quarterly, and know where credentials live. If that person leaves, the next owner inherits the same duty — document it.

Monitoring — beyond “is it up?”

Uptime pings tell you the home page returned HTTP 200. They do not tell you checkout is broken, forms stopped sending, or SSL expires tomorrow.

Baseline monitoring should cover:

• HTTP uptime on the public site and /wp-admin/ (or your CMS login).
• SSL certificate expiry with lead time to renew.
• Domain expiry if DNS is not locked at the registrar.
• Form or email delivery if leads are how you make money.
• Disk and resource alerts on shared or VPS hosting before the site hangs.

For WooCommerce or other stores, generic uptime is especially misleading. What should be monitored on an ecommerce website covers checkout, payments, cron, and stock signals that protect revenue.

Who owns it

Alerts need a human destination — email, SMS, or a ticketing system — and a runbook for “site down” vs “checkout broken.” Monitoring without response is noise.

Security hygiene

Maintenance is not the same as a one-time security audit, but it should reduce everyday risk:

• Remove unused plugins and themes instead of leaving them installed “just in case.”
• Enforce strong passwords and 2FA on hosting, DNS, WordPress admin, and payment gateways.
• Review admin user list periodically; delete old agency or employee accounts.
• Keep file permissions and directory listing sane on the host.
• Scan for obvious malware or unexpected admin users after any incident.

If the site was compromised before, maintenance includes confirming cleanup held and that backdoors are not returning.

Who owns it

Security tasks often fall between “host” and “developer.” Write down who handles firewall rules, who resets compromised passwords, and who pays for cleanup if needed.

Performance and housekeeping

You do not need a monthly redesign, but you do need periodic housekeeping:

• Clear or rotate bloated logs if they fill disk.
• Review caching after plugin changes so pages are not serving stale checkout or forms.
• Check broken links on high-traffic pages a few times a year.
• Confirm search indexing basics: no accidental noindex on the whole site after a staging mistake.

Large media libraries and abandoned backup files are common silent disk hogs. A ten-minute review prevents “account suspended for overuse” surprises.

Access and ownership

Maintenance fails when nobody can log in. Keep a living inventory:

• Domain registrar, hosting panel, DNS/CDN, WordPress admin, FTP/SFTP, database, email DNS, payment processor.
• Business-owned email on recovery contacts — not a former freelancer’s Gmail.
• Where 2FA backup codes are stored.

When access lives in one person’s inbox, “maintenance” stops the day they leave. That is an ownership problem, not a technical one — but it belongs on the same checklist.

Reporting — so the owner sees reality

At minimum, send or review a short report each cycle:

• Updates applied (and any that were held back, with reason).
• Backup status and date of last restore test.
• Monitoring incidents or SSL/domain warnings.
• Open recommendations (PHP version, abandoned plugin, disk trend).

Owners who only hear from you when something breaks assume nothing was happening in between. A one-page summary prevents that.

What “good enough” looks like

You do not need enterprise tooling on a five-page brochure site. You do need named owners, verified backups, supervised updates, and alerts that reach a human. Skip any one of those and you are not maintaining the site — you are hoping.

If your current “maintenance” is a monthly invoice with no restore test and no monitoring, you have billing — not a care plan. The posts linked above go deeper on the pieces most teams get wrong first: updates-only contracts, unverified backups, and store monitoring that stops at uptime.

Build the checklist, assign each row, and run it on a calendar. That is what maintenance actually includes.