Website Maintenance Checklist: What to Do Monthly, Quarterly, Yearly

Why does your website need regular maintenance?

A website is not a brochure you print once and forget. It runs on software that needs updating, sits on a server that can have issues, and contains content that goes stale. Without maintenance, sites get slow, get hacked, break, or fall in search rankings. Usually a combination of all four.

Structured maintenance organized by frequency prevents the “I forgot about my website for a year and now everything is broken” scenario. The tasks below are organized from most frequent to least frequent, with clear guidance on what each one involves and how long it takes.

Think of it like car maintenance: oil changes monthly, tire rotations quarterly, full inspection annually. Skip any of them long enough and you end up with an expensive repair bill.

Weekly tasks (15-20 minutes)

These prevent small problems from becoming big ones. They take almost no time individually but compound in value.

If you use a managed WordPress host or security plugin with automated scanning, most of these become “check for notifications” rather than active tasks. The point is: someone or something should be watching weekly.

Monthly tasks (1-2 hours)

Monthly maintenance is the core routine. This is where most of the tangible protection and improvement happens.

Update WordPress core, plugins, and themes

Outdated software is the primary attack vector for WordPress hacks. Plugin vulnerabilities account for roughly 90% of WordPress security incidents. Monthly updates keep you patched against known exploits.

Process:

1. Check that your backup is current (never update without a recent backup)
2. Update plugins one at a time, checking the site after each
3. Update WordPress core
4. Update your theme
5. Test key pages: homepage, contact form, service pages, checkout (if applicable)
6. Clear your cache after updates

Important: Read changelogs before updating, especially for major version jumps. If an update mentions breaking changes, test on a staging site first if available.

Check site speed

Page speed degrades gradually. New content, additional plugins, unoptimized images added by team members, or hosting degradation all contribute. A monthly speed check catches issues before they become significant.

• Run PageSpeed Insights on your homepage and one key service page
• Compare to last month’s scores
• If scores dropped more than 5 points, investigate what changed

Review Google Search Console

Check for new crawl errors, security issues, or indexing problems. Look at:

• Coverage report (any new errors or pages dropped from index?)
• Security issues (any warnings?)
• Performance trends (significant traffic changes?)

Fix broken links

Broken links hurt user experience and waste crawl budget. Internal links break when you rename or delete pages. External links break when other sites change their URLs.

Use a broken link checker (plugin or online tool like brokenlinkcheck.com) monthly. Fix internal broken links immediately. Remove or replace external broken links.

Review and moderate comments (if enabled)

Delete spam, respond to legitimate comments, and check that your spam filter is working. If you receive no legitimate comments, consider disabling comments entirely to remove one maintenance burden and one potential security surface.

Quarterly tasks (2-3 hours, four times per year)

Quarterly reviews catch medium-term drift that weekly and monthly checks miss.

Full security audit

Go beyond automated scanning:

• Change WordPress admin password and any shared passwords
• Review user accounts (remove any you do not recognize or no longer need)
• Check file permissions on the server (wp-config.php should be 400 or 440)
• Verify two-factor authentication is active on admin accounts
• Review login attempts log for brute force patterns
• Confirm your security plugin’s settings have not been changed

Performance deep dive

Monthly speed checks catch regressions. Quarterly, dig deeper:

• Test all major page types (not just the homepage)
• Check Core Web Vitals in Search Console (aggregate real-user data)
• Review database size (growing faster than content justifies?)
• Check server error logs for recurring issues
• Audit plugin count: any that can be removed or consolidated?

Content freshness review

Search engines reward content that stays current. Quarterly, review your highest-traffic pages:

• Are pricing references still accurate?
• Are statistics and data points still current?
• Do service descriptions match what you actually offer today?
• Are there new questions your customers ask that your content does not address?
• Update published dates on pages you significantly revise (shows freshness to Google)

Review analytics and conversion data

Look at 3-month trends rather than daily noise:

• Which pages drive the most form submissions or calls?
• Which pages have high traffic but no conversions (opportunity to add CTAs)?
• Which traffic sources are growing or declining?
• Are any pages ranking for unexpected keywords (opportunity to optimize further)?

Test functionality across devices

Load your site on your phone, a tablet if available, and different browsers. Test:

• Navigation menus (do they work on all screen sizes?)
• Contact forms (do they submit successfully?)
• Image loading (do all images appear correctly?)
• Button links (do they go to the right pages?)
• Search function (if your site has one)

Annual tasks (4-6 hours, once per year)

The annual review looks at the big picture: does your site still serve your business goals? Is the underlying technology still supported?

Full site audit

Update legal documents

Privacy policies need updating when you add new tools (analytics, email marketing, chat widgets) that collect user data. Terms of service need updating when your business model changes. In Canada, PIPEDA compliance requires keeping your privacy practices current.

Evaluate hosting and domain renewal

Check your hosting renewal price (many hosts increase prices significantly after the first term). Compare with current market options. If your site has grown or your needs have changed, this is the time to consider upgrading.

Confirm your domain is set to auto-renew with current payment info. Losing a domain to expiration is a preventable disaster.

Plan content strategy for the next year

Review which content drove the most traffic and leads over the past year. Identify gaps. Plan new content targeting keywords you want to rank for. Update your content calendar for the coming year.

Tools that make maintenance easier

What to do when things go wrong

Even with maintenance, things break. Here is the quick-response playbook:

Site is down (completely inaccessible):

1. Check if it is just you (use isitdown.com or similar)
2. Contact your hosting provider
3. Check for scheduled maintenance notifications you may have missed

Site is hacked (showing strange content, redirecting):

1. Do not panic, but act quickly
2. Restore from your last known-good backup
3. Change all passwords (WordPress admin, hosting, FTP, database)
4. Update all plugins, themes, and core
5. Run a security scan and remove any malicious files
6. Contact hosting if you need help identifying the vulnerability

Site is suddenly slow:

1. Check if your hosting is having issues (provider status page)
2. Check if a recent plugin update caused the problem (deactivate recent updates)
3. Run PageSpeed Insights to identify what changed
4. Check server error logs for clues

Contact form stopped working:

1. Test submission yourself
2. Check your email spam folder
3. Verify SMTP configuration (if using one)
4. Check the form plugin for errors or broken integrations

The cost of neglecting maintenance vs. doing it

The math is clear: 2-4 hours of monthly maintenance prevents problems that cost days or weeks to fix. Whether you do it yourself or hire a professional, consistent maintenance is dramatically cheaper than crisis recovery.