Keep your live website healthy with continuous availability alerts, weekly enquiry tests, monthly information reviews and quarterly recovery drills. Assign an owner to each check and keep evidence of the result. A useful website maintenance checklist records what failed, who corrected it and how the repair was verified—not simply that someone visited the homepage.
Start with a schedule your team can own
| Check | Suggested timing | Responsible person | Completion evidence |
|---|---|---|---|
| Public website availability | Continuous alerts | Provider or technical owner | Alert history and incident record |
| Website and backup alerts | Each working day | Operations or provider | Reviewed alerts with actions assigned |
| Enquiry receipt | Weekly and after relevant changes | Sales coordinator with provider | Marked test received and acknowledged |
| Routine software updates | Weekly review | Provider or technical owner | Update record and successful retests |
| Content, links and Search Console | Monthly | Page owners with provider | Review register and corrected issues |
| Backup restoration and account access | Quarterly | Provider with business approver | Restoration results and access review |
These frequencies are suggested operating choices, not platform requirements. Increase them where enquiries, transactions or frequent changes create greater risk. Security notices, outages, failed forms and changed business details need prompt attention rather than waiting for the next review. This routine follows launch approval; the separate guides A website launch checklist built around what must work and Keep control of the website after launch cover approval and handover.
Review the information customers rely on
Start with services, contact details, opening hours, offers, downloadable brochures and enquiry instructions. Give important pages a business owner who can approve their accuracy. Review every relevant language version, including linked documents. A developer can publish a correction, but should not guess whether your delivery area or service promise has changed.
Keep an internal register containing the page address, owner, review date, decision and next review. “Checked; no change needed” is a valid result when supported by an owner’s approval. Do not change public dates merely to suggest freshness: Google’s people-first guidance specifically cautions against this practice. Accurate information matters more than an artificially recent timestamp. [1]
Fix broken links without hiding missing content
Run a link checker monthly and after navigation changes or bulk edits. Include internal pages, external references, images and downloads. Manually open important destinations: a successful response cannot tell you whether a brochure is current. Record the affected address and the chosen repair rather than just saving a scan report.
| Finding | Action |
|---|---|
| Mistyped address | Correct the link where it appears. |
| Content moved to an equivalent replacement | Add a permanent redirect and update internal links. |
| Content removed without a replacement | Remove misleading links; keep a useful missing-page response. |
| External reference fails | Inspect manually, then replace or remove it. |
| Destination loads but contains wrong information | Correct the content or link; do not mark it healthy. |
A genuinely missing page should return the proper 404 response, which tells browsers and search engines it was not found. A page reporting success while showing an error can become a “soft 404”. Google distinguishes these cases. Sending every missing address to the homepage hides the problem and rarely gives visitors an equivalent replacement. [2]
Test enquiry forms through to the receiving team
Test important forms weekly and after changes affecting forms, email delivery or spam protection. Use clearly marked fictional details and a unique test identifier. Agree the expected destination and receipt time before testing. Success means an enquiry is received and actionable—not merely that a thank-you message appears.
- Submit on mobile: Check that fields and controls remain usable.
- Use a keyboard: Move through the form and submit without a mouse.
- Check validation: Try missing details and legitimate Indian and international input formats.
- Read the result: Confirm that errors explain corrections and success explains what happens next.
- Verify receipt: Find the marked enquiry in the intended inbox or destination.
- Confirm ownership: Ask the responsible employee to acknowledge it and confirm they can respond.
- Record evidence: Save the identifier, submission time, receipt time and result without customer data.
Browser validation helps visitors correct mistakes, but it can be bypassed. MDN explains that submitted information also needs checks on the receiving server. Ask your provider to confirm those protections; passing a manual submission test does not prove them. If delivery fails, keep the issue open and provide visitors with a working alternative contact route. [3]
Apply security updates with a recovery plan
List the website software, connected services and responsible parties. Separate provider-managed updates from work your business must arrange. Review routine updates weekly, but assess security notices when received. WordPress recommends updating and backing up beforehand; its automatic update behaviour depends on the installation. Do not assume another platform follows the same rules. [4]
Before a material change, confirm a usable recovery point and someone authorised to restore it. Test on a separate staging copy where practical, deploy, then retest key pages and enquiry delivery. Balance security urgency against disruption risk: neither indefinite delay nor blind updating is sensible. Keep failed updates and unsupported software visible, with an owner and next action.
Prove that a backup restores a usable website
First decide how much recent information you could afford to lose and how long the website could remain unavailable. Use those business limits to choose backup frequency and retention. Daily backups may suit slowly changing content but leave unacceptable gaps for frequent transactions. Keep protected copies separate from production hosting, and confirm exactly what they contain.
A typical complete WordPress recovery needs both files and database; copying files alone is insufficient. [5] Quarterly, restore into an isolated environment with customer emails and other outward communications disabled. Check pages, media, administrator access and forms using safe test destinations. Record elapsed recovery time, recovered data age and missing dependencies. Compare results with your targets. Before a live rollback, preserve or reconcile enquiries and transactions created since the backup.
Route meaningful alerts to someone who can act
Monitor public availability, enquiry delivery, backup failures and overdue restoration evidence separately. A server health check does not prove the whole customer journey works. Review Search Console for unexpected search or indexing changes, but do not use it as an immediate outage alarm; Google suggests checking around monthly and after content changes. [6] Track important mobile journeys too: one speed score is not a complete experience assessment.
Give every alert a primary owner, backup contact, expected response window and escalation route. Include brief investigation instructions and test notification delivery. For international teams, specify time zones and out-of-hours coverage. Treat site-wide outages, suspected compromise and failed enquiry delivery as urgent; assign less critical content corrections a deadline based on customer impact.
Close issues with evidence, not ticks
| Check and date | Owner | Failure found | Corrective action | Retest evidence | Next review |
|---|---|---|---|---|---|
| [Task, address, date] | [Named person] | [Observed result or none] | [Action, approver and status] | [Test ID, time and result] | [Date] |
Should every website follow the same maintenance frequency?
No. Use the schedule as a starting point. Increase checks when changes, enquiry volumes or potential losses justify them. Act on significant failures and security notices without waiting for a scheduled review.
Does a successful backup notification prove recovery will work?
No. It confirms a job reported completion. An isolated restoration drill supplies stronger evidence that the saved information can produce a usable website within your recovery targets.
What should stay internal if maintenance is outsourced?
Keep business accuracy, content approval and sales receipt confirmation with named internal owners. A provider can handle technical checks and repairs, but both sides should use the same evidence log.
Start this week: copy the schedule, name a primary and backup owner, and complete one end-to-end enquiry test. Use the results to agree responsibilities internally or with a provider. Softglimmer Services’ Website maintenance and support page can help frame that support discussion; keep ownership, evidence and escalation explicit whichever arrangement you choose.
Sources & further reading
Use the original guidance when checking details or planning implementation.
This research-assisted guide uses the primary sources linked above. Examples are illustrative unless explicitly identified otherwise. Check original documentation when implementing changes.
