The Small Business Website Maintenance Checklist

You paid for a website. It's live and it looks good.

Now someone says you need to pay for "website maintenance" every month, and you're wondering if that's real or just a way to keep billing you. Here's my straight answer.

Website maintenance is real, and it matters.

But a lot of what gets sold as maintenance is vague. Some plans amount to checking that the site is still online. Some builders charge nothing and leave you on your own when something breaks.

Start with this website maintenance checklist. Then read the breakdown below for why each item matters, what you can skip, and how my monthly plans handle it.

Weekly website maintenance checklist

• Confirm the site loads on a phone and on a computer
• Tap the main call and contact links once
• Check that form submissions are still coming in
• Check that the padlock still shows in the address bar (no browser warnings)
• Glance at uptime or hosting alerts if you have them

Monthly website maintenance checklist

• Run a speed test and fix anything that slowed down
• Resize and compress new images before they go live
• Test forms, buttons and key links on a phone and a computer
• Review Core Web Vitals if rankings or traffic dipped
• Review security alerts, and scan for malware if you run WordPress
• Apply core, theme and plugin updates if you run WordPress
• Add fresh photos, reviews or a small content update when you have them

Quarterly website maintenance checklist

• Check your phone number, address, hours and prices for accuracy
• Update service lists, service areas and team info
• Confirm the domain renewal date and that DNS still points to the right place
• Restore a backup as a test, so you know recovery actually works
• Remove old third-party scripts that were added and forgotten

Yearly website maintenance checklist

• Renew the domain and confirm who owns the registrar account
• Review your hosting plan, SSL auto-renewal and how long backups are kept
• Ask whether the design still fits the business (most solid sites last 3 to 5 years before a redesign)
• Cut any "maintenance" you pay for but never use
• Decide whether the WordPress update load still makes sense, or whether a simpler build would cost less to keep

What Website Maintenance and Management Actually Means

Website maintenance covers everything that keeps your site working after launch: security, backups, hosting, content updates and speed. Treat it like any other business asset. You don't buy it and then ignore it forever.

Browsers update. Security threats change. Your hours, services and prices change.

Your website has to keep up. Real website maintenance includes:

• Hosting: Your website lives on a server. That server costs money to run and needs someone watching it.
• Security: SSL certificates, updates and protection against attacks.
• Backups: Regular copies of your site, so you can recover when something goes wrong.
• Software updates: Keeping the site's technology current and patched.
• Performance: Making sure the site stays fast and stays up.
• Content updates: Changing your hours, adding a service, updating prices.
• Domain management: Keeping your domain name registered and pointed at the right place.

Not every site needs all of these at the same level. A simple five-page business site needs less than an online store with hundreds of products.

The Hat Doctor catalog work shows why regular checks matter when products live on more than one platform. Her hats sell on Etsy and on her own site, so one hat has to mean one count in both places.

Security: The Non-Negotiable Part

If there's one thing you don't skip, it's security. I'm not trying to scare you into paying more. It's just what comes with having anything on the internet.

Your website is a target whether you think so or not. Attackers use bots that scan huge numbers of sites for known holes. A small business site running an old plugin is an easy one to find.

A hacked site can send your visitors to spam, get flagged with a browser warning, and take real time to clean up. Updates and backups are the cheap insurance.

Here's what security maintenance looks like:

• SSL certificate: The padlock in the address bar. It encrypts traffic between your site and your visitors. Browsers flag sites without it as not secure, and Google lists secure pages as part of page experience. It has to stay active and renewed.
• Software updates: On WordPress, the core software, the theme and every plugin need regular updates. Plugins are where most of the risk sits. Patchstack found that 91% of the new WordPress vulnerabilities reported in 2025 were in plugins (Patchstack, State of WordPress Security in 2026).
• Malware scanning: Regular scans for malicious code that got into the site.
• Firewall: Tools that block suspicious traffic before it reaches the site.

This is one reason I don't build on WordPress for most small business clients. The small business sites I build are static HTML: no plugins, no database, no login page for anyone to attack.

That removes most of the usual maintenance headaches. Static sites still need SSL, secure hosting and someone paying attention.

Backups: Your Safety Net

Back up your site on a schedule. Weekly at minimum, daily if it changes often. Keep at least one copy somewhere separate from your hosting, so a problem with the server doesn't take the backup down with it.

Backups are boring until you need one. Then they're the most important thing you have. Here's what can go wrong without one:

• An update breaks something and you can't undo it
• The site gets hacked and you need a clean copy to restore
• Someone deletes something important by accident
• Your hosting provider has a server failure (it happens)

A good backup lets you put the whole site back the way it was yesterday or last week. Without one, you're rebuilding from scratch, and the site is down while you do it.

Test a restore now and then, so you know the backup works before the day you need it. On my Care plan, sites get backed up every night and stored separately from the hosting.

Hosting: Where Your Site Lives

Hosting is the foundation. Your website files live on a server, and that server affects how fast your site loads, how often it goes down and how secure it is.

Cheap hosting is cheap for a reason. Bargain shared hosting often packs a lot of websites onto one server.

When one of them gets a traffic spike, everyone else on that server can slow down. It's like an apartment building where one loud neighbor affects everyone.

Good hosting for a small business site should give you:

• Fast pages: The main content shows up in 2.5 seconds or less, which is Google's mark for good (Google PageSpeed Insights documentation).
• High uptime: The site is available 99.9% of the time or better.
• SSL included: Free certificates that renew on their own.
• A CDN (content delivery network): Copies of your site on servers in many places, so it loads fast wherever the visitor is.
• Clean deployments: Updates go live without breaking things.

When I say hosting is included in my Pro plan ($2,500 setup, then $399/month), that's what I mean. Not bargain-bin shared hosting. Modern hosting that keeps the site fast and reliable.

"My Website Is Built: Why Do I Keep Paying?"

This is the question I get most, and it's a fair one. Here's how I explain it.

Building a website is like building a house. Construction is a one-time cost. After that, you still pay for utilities, insurance and upkeep.

The house doesn't take care of itself.

Your monthly website cost usually covers:

• Hosting: Servers cost money to run. Period.
• Domain registration: Your domain name (yourbusiness.com) renews every year.
• SSL certificate: It has to stay active for security.
• Support: Someone to call or text when you need a change or something breaks.
• Content updates: Changing hours, adding photos, updating service descriptions.

Is that real money? Yes.

But think about what the website does for you. If it helps one good customer find you, call you or trust you enough to book, the $250/month Care plan can pay for itself quickly. A contractor, restaurant or salon doesn't need a flood of leads for the site to be worth keeping up.

Performance: Keeping Your Site Fast

A site that was fast at launch can slow down over time.

New images go up without being compressed. Third-party scripts get added and forgotten. Browser updates change how old code behaves.

Regular performance checks catch this before it costs you visitors:

• Run a speed test every month and fix anything that slowed down
• Resize and compress new images before they go on the site
• Check that forms, buttons and links still work
• Test on a phone and a computer
• Watch Core Web Vitals, the speed and stability measures Google uses for page experience

This doesn't have to be a big effort. On a simple small business site, a monthly check takes 15 to 30 minutes, and it catches problems before your customers do. If it's been years since anyone looked under the hood, start with a full website audit instead.

Content Updates: The Overlooked Part

Your business changes. You add a service, change your hours, raise your prices or hire someone new.

Your website has to show those changes.

Outdated content costs you trust. A customer who calls a disconnected number, shows up during hours you already changed, or expects last year's prices isn't a happy customer. And they probably won't give you a second chance.

Here's a simple rhythm for updates:

• Every quarter at minimum: Check all contact info, hours and prices.
• As needed: New services, team changes, seasonal promotions.
• Monthly if you can: Fresh photos, new reviews, a new article.

This is where having a web person you can text makes a big difference. You shouldn't need to learn HTML to change your phone number.

You should be able to text me "We changed our Saturday hours to 9 to 3" and have it updated. Most edits are done within two business days, often sooner.

What You Can Skip

Not everything sold as "maintenance" is worth paying for. Here's what you probably don't need:

• Monthly SEO reports with no action items: A 20-page PDF full of charts nobody reads isn't maintenance. If someone sends you reports, they should say what they did and what they'll do next.
• Standing weekly "optimization" meetings: A simple small business site doesn't need one. A call or text when something comes up works fine.
• Premium security plugins on a static site: If your site has no database, no login and no plugins, you probably don't need a monthly security plugin. That's a WordPress cost.
• A redesign every year: A well-built website should last three to five years before it needs a major redesign. If someone pushes an annual redesign, ask why the first one didn't hold up.

What Fair Pricing Looks Like

Website maintenance pricing is all over the place. Here's a practical way to sort it:

• Do it yourself: You pay for tools and hosting, then handle everything yourself.
• Basic maintenance: Hosting, security, backups and small updates.
• Full-service care: All of the above plus content updates, speed checks, support and reporting.
• Complex sites: Online stores, custom features and bigger support needs get scoped on their own.

For most small businesses in Louisville, my $250/month Care plan covers the basics: hosting, SSL, nightly backups, updates and up to two small content edits a month. If you want someone working on the site every month, Managed is $850/month and adds content and page updates, Google Business Profile management and local SEO.

No hourly billing surprises. If you're pricing a new site too, here's what a small business website costs.

The WordPress Factor

WordPress sites have four parts that all need updates: the core software, a theme, a database and usually a stack of plugins.

Every update can break something. That's just how WordPress works. More moving parts means more maintenance.

A lot of small business sites run on WordPress, so I want to be direct about this. That upkeep is a real, ongoing cost.

It's one of the reasons I build differently. The sites I build are clean HTML and CSS on modern hosting.

No plugins to update. No database to protect. No admin login that needs patching every month.

The result is a site that needs less maintenance, loads faster and has fewer ways to get hacked.

If you have a WordPress site and you're tired of constant updates, moving to a simpler setup might save you money and headaches. If speed is the bigger problem, start with what to check first on a slow WordPress site.

The Bottom Line

Website maintenance is real work, not a scam. But it should be clear, useful and tied to actual work.

At minimum, your website needs reliable hosting, active SSL, regular backups and someone to call when something needs changing. That's the baseline. Everything past that (SEO work, speed work, content planning) depends on your goals and budget.

The worst thing you can do is build a website and forget it. A neglected site tells customers you don't keep up with the details.

If you're paying for maintenance and aren't sure what you get, ask. If the answer is vague, that's a red flag.

If you want one simple monthly price with no surprises, call me at (502) 305-4043. I'll tell you exactly what's included and what it costs.

For the full breakdown of each plan, see my website maintenance service page.