Web Development

Website maintenance plan: what to check monthly, quarterly, yearly

7 min readBy Sandeep Mahajan

A wall calendar with marked days above a shelf of tools

A website needs a light monthly routine (updates, backups checked, forms tested, errors reviewed), a deeper quarterly check (a test restore, speed and Core Web Vitals, users and plugins, broken links) and a yearly review (software versions, privacy policy, accessibility, content and whether the site still fits the business). Put each task on a calendar with a named owner, because a task nobody owns is a task nobody does.

Key takeaways

  • Monthly: apply updates after a backup, confirm backups ran, submit every form, and read Search Console and uptime alerts.
  • Quarterly: restore a backup to staging, check Core Web Vitals (LCP 2.5 s, INP 200 ms, CLS 0.1 at the 75th percentile), remove unused plugins and accounts, fix broken links.
  • Yearly: check your PHP and CMS versions against their support dates, review the privacy policy and consent setup, audit content and accessibility, renew domains.
  • Server software has firm end dates: as of October 2026, PHP 8.2 gets security fixes only until 31 December 2026.
  • Write the plan down with owners; a checklist nobody owns does not run.

Why does a website need a maintenance plan?

Because software, rules and your business all change while the site stands still. Plugins and frameworks publish security fixes, server software reaches end of life, browsers and search engines change what they measure, and your services, prices and team change too. The original version of this post focused on keeping the site in step with your brand and checking speed; both still matter, and they belong in a routine rather than a once-every-few-years redesign.

What should you check every month?

Task How Owner
Updates Take a backup, update CMS core, plugins and themes (or dependencies), then click through key pages Developer or agency
Backups Confirm the last backups completed and a copy exists offsite Developer
Forms Submit every form; check the notification arrives and the entry is stored Marketing
Search Console Read new indexing, security and manual-action messages Marketing or SEO
Uptime and errors Review alerts and server error logs for repeated failures Developer
Analytics Check key events still fire and look for sudden drops Marketing
Content Update anything time-sensitive: prices, offers, opening hours, team Content owner

On WordPress, you can switch on automatic updates per plugin and per theme (available since WordPress 5.5); WordPress then runs them twice a day and emails the site owner about each attempt. WordPress's own documentation suggests making sure you can roll back before you enable them. For business-critical plugins such as payments or forms, you may prefer to update manually after a backup and test straight away. Our WordPress security guide covers the habits that prevent most problems.

What should you check every quarter?

  1. Restore a backup to staging. A backup you have never restored is untested. The US-CERT "Data Backup Options" paper recommends the 3-2-1 rule: three copies, on two types of storage, one offsite. Time the restore and write down the steps.
  2. Check Core Web Vitals. Google's thresholds for a good experience are LCP within 2.5 seconds, INP of 200 milliseconds or less and CLS of 0.1 or less, measured at the 75th percentile of page loads. Use field data from Search Console or PageSpeed Insights where your site has enough traffic; lab tests alone do not tell you what visitors experience. Our WordPress speed guide covers the usual fixes.
  3. Audit plugins, integrations and scripts. Remove anything unused, abandoned by its developer, or duplicated by another tool. Each one is code to patch and a script to load.
  4. Review user accounts. Remove former staff and agencies, reduce administrator accounts to the people who need them, and require two-factor authentication where the platform supports it.
  5. Fix broken links and redirects. Crawl the site, fix 404s that have links pointing at them, and collapse redirect chains.
  6. Check mobile and key journeys. Walk through the enquiry or checkout path on a real phone.
  7. Look at search performance. Compare clicks and top pages with the previous quarter in Search Console; our Search Console guide explains the reports.

What should you review every year?

Review What to look for
Server software PHP, database and CMS versions against their support dates; plan upgrades before end of life
HTTPS certificates Renewal is automated; maximum certificate lifetimes fell to 200 days in March 2026 and drop to 100 days in March 2027
Domains and DNS Renewal dates, auto-renew on, registrar account access, SPF and DKIM records for email
Privacy and consent Policy matches the tools you now use; consent banner matches current guidance in your visitors' regions
Accessibility Headings, alt text, contrast, keyboard use against WCAG 2.2
Content Retire, merge or refresh old pages; check every service page is still accurate
Brand and positioning Photos, tone and offers still match the business
Fit Does the platform still suit how you work, or is a rebuild cheaper than more patching?

Server software is the item most often missed. PHP's own support schedule, as of October 2026:

PHP branch Active support until Security fixes until
8.2 31 December 2024 31 December 2026
8.3 31 December 2025 31 December 2027
8.4 31 December 2026 31 December 2028
8.5 31 December 2027 31 December 2029

WordPress currently recommends PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer, and notes that older versions may still run but have reached end of life. A site on PHP 8.2 should plan its upgrade now.

Who should own each task?

Give every row a name, not a department. A workable split for a small business:

  • Developer or agency: updates, backups, restores, server software, security, performance fixes.
  • Marketing: forms, analytics, Search Console, search performance, campaign landing pages.
  • Content owner: prices, offers, team, service pages, the yearly content review.
  • Business owner: the yearly fit review and budget.

Keep a short log: date, what was checked, what was changed, what is pending. It makes handovers easy and shows what changed when something breaks.

How do you know when maintenance is no longer enough?

Signs that a rebuild or migration is cheaper than more patching: the theme or framework is no longer maintained, updates regularly break things, the hosting stack cannot move to a supported PHP version, every small change needs a developer, or speed problems are built into the platform. At that point, a planned redesign or migration costs less than years of workarounds. A one-off check can help you decide; our free website audit explains what an automated check can and cannot tell you.

If you would rather hand the routine to a team, our website solutions cover ongoing maintenance as well as builds.

FAQ

How often should a website be updated?

Check for software updates at least monthly, and apply security fixes as soon as they are released for anything you run. Content that changes (prices, offers, team) should be updated when it changes, not on a schedule.

Should I turn on automatic updates?

For most plugins and themes, automatic updates reduce the time a known vulnerability stays open. Make sure you have working backups first, and consider updating critical plugins such as payments manually so you can test immediately.

How do I know backups work?

Restore one to a staging site at least once a quarter and check that pages, forms and logins work. A completed backup job only proves that a file was written.

What happens when PHP reaches end of life?

It stops receiving security fixes from the PHP project. Your site may keep running, but new vulnerabilities in that version will not be fixed, so plan the upgrade before the end date.

Is a maintenance plan only for WordPress sites?

No. Static sites and custom applications have fewer moving parts, but they still have dependencies, certificates, domains, forms, analytics and content that need the same routine.

Sources (8 links)
Share this article