Website Maintenance Checklist: The Monthly Tasks That Stop Small Problems Becoming Big Ones

What this checklist covers and why it matters

A website doesn't stay finished. Plugins go out of date, certificates expire, forms stop sending, and nobody notices until a customer does. The good news is that most of the risk is handled by a short monthly routine: check your backups, update your platform, test your forms, and keep an eye on your certificate and uptime.

This isn't scaremongering. The NCSC says 1 in 2 UK small businesses suffer a cyber incident every year, and that small organisations, of which there are 5.5 million in the UK with 0 to 49 employees, are just as likely to be targeted as big ones. Nobody is too small to bother with. The flip side is reassuring too: the NCSC also notes that many of its recommended actions take as little as 5 minutes and need no technical skill. So below, we've split this into two honest piles: the stuff you can do yourself over a coffee, and the stuff that's genuinely worth paying a developer to handle, because getting it wrong costs more than the fee ever would. If you'd rather hand the whole lot over, that's exactly what our website care plans are for.

The ten minute monthly check anyone can do

Set a reminder for the first Monday of the month. None of this needs a developer.

• Confirm a backup actually exists. The NCSC advises backing up all the data your business needs to operate, including your website, emails, invoicing, documents and customer information. Log in to your hosting or backup plugin and check a recent backup is sitting there with today's or last week's date on it.
• Click through your own site. Visit your homepage, your main service or product pages, and anything with a link to a PDF or a downloadable file. Broken links frustrate visitors and look careless, and they're the easiest thing in the world to spot if you just look.
• Submit every form. Contact forms, booking forms, newsletter signups: fill each one in yourself and check the email or notification actually lands. Forms fail silently more often than you'd think, usually after a plugin update or a hosting change, and you won't know unless you test it.
• Glance at the padlock. Open your site and check the browser still shows it as secure, with no warning about an expired certificate.
• Check for an update notice. If you're on WordPress, log in and look at the dashboard. WordPress flags available plugin and theme updates with an alert bubble in the admin menu, so you'll see at a glance if something needs attention. Don't click update yet, just note it.

That's the whole list. Ten minutes, no jargon, and it catches the problems that are cheap to fix today and expensive to fix in three months.

What to leave to a developer before it becomes a costly fix

Some jobs look simple but carry real risk if they go wrong, and they're the ones most owners quietly put off, which is exactly how small problems turn into big ones.

• Running the actual updates. Updating is essential, WordPress.org's own documentation says to always update plugins and themes to the latest version to keep a site secure, with everything manageable from Dashboard > Updates or the individual plugin and theme screens. But updates can clash with each other and break a site outright. WordPress's own upgrading guidance is blunt about the first step: make a backup copy before any upgrade. A developer will do that properly, update on a test copy first if the site is complex, and fix anything that breaks before it's public.
• Making backups actually reliable. Having a backup isn't the same as having a backup you can use. The NCSC recommends keeping both an online copy and a physical storage device, in case one is lost, stolen, or fails, with online backups protected by 2-step verification. It also warns that ransomware or another virus may lock your data so it can't be accessed, which is precisely when you'll need that second copy. Crucially, the NCSC stresses that you should know how to restore a backup and check it actually contains everything important, not just assume it does. Setting this up properly, and testing a real restore, is a job worth paying for once rather than discovering the gaps during an actual emergency.
• SSL certificate renewal and monitoring. Certificates expire, and the rules around them are getting stricter, not looser. Public SSL/TLS certificates currently max out at 398 days validity, but the CA/Browser Forum has approved a phased change that will cut that down to just 47 days by March 2029. That means certificates will need renewing far more often than once a year, and manually tracking that across multiple sites is a recipe for an embarrassing

We're here to help

Sources

• National Cyber Security Centre (NCSC), Small organisations guide to cyber security, 9 April 2026
• National Cyber Security Centre (NCSC), Backing up your data, 9 April 2026
• WordPress.org, Plugin and themes auto-updates
• WordPress.org (Developer Resources), Upgrading WordPress
• Sectigo, CA/Browser Forum passes ballot to reduce SSL/TLS certificates to 47 day maximum term, endorsed by Sectigo, 14 April 2025
• GlobalSign, A Complete 47-day SSL/TLS Certificate Validity Q&A, 17 July 2026
• SwissSign, 47 days TLS / SSL & 10 days DV
• BrandShelter, Shorter SSL/TLS Certificate Lifetimes 2026