Option 1: Do it yourself
Follow the steps in this guide. Free, and typically 30 minutes to a few hours of careful work.
Option 2: Just contact us
Skip every step below. $49/mo and it is sorted, or WhatsApp us right now.
Last updated: August 2026
The weekly checks (15 minutes)
- Verify the backup actually ran, not that it's scheduled; that this week's file exists and has a plausible size. A scheduled backup that silently fails for months is the most common disaster we see.
- Load the site in an incognito window, homepage plus your top landing page. Look for layout breaks, missing images, certificate warnings.
- Submit your own contact form, confirm the email arrives. (If it doesn't, here's the fix.)
- If you sell online: place a test order or at minimum reach the payment step on mobile.
- Skim comments/registrations for spam floods, a sudden spike often signals a bot problem worth stopping early.
The monthly work (2-4 hours)
Updates, in this order, with a backup first: 1. Take a fresh backup (or verify today's exists) 2. Update plugins one or two at a time, checking the site between batches 3. Update the theme (confirm you're on a child theme first, or your customizations vanish) 4. Update WordPress core 5. Click through your key pages after each stage
Security: - Run a malware scan (Wordfence, Sucuri SiteCheck, or your host's scanner) - Review the user list, remove accounts of people who've left, downgrade roles that are too powerful - Check for plugins that haven't been updated by their developer in 12+ months; plan replacements
Performance: - Run PageSpeed Insights on your top 3 pages and log the scores, the trend matters more than any single number - Compress any new images uploaded this month - Clear expired transients/sessions and spam comments from the database
Content & SEO health: - Run a broken-link check and fix or redirect what's dead - Open Google Search Console: any coverage errors, security issues, or manual actions? - Confirm your XML sitemap is current and reachable
The quarterly and yearly items
Quarterly (1 hour): - Test a full backup restore on staging, an untested backup is a hope, not a plan - Review third-party scripts (chat, pixels, embeds) and remove abandoned ones - Check SSL certificate and domain expiry dates; confirm auto-renew and a working payment card on both accounts
Yearly (half a day): - Access audit: who has admin, hosting, domain, and DNS access? Is every credential in a password manager the business controls, not just in the developer's head? - Hosting review: compare renewal price against current market; hosts commonly double the rate after the intro term - Content pruning: delete or update pages that are outdated, thin, or embarrassing, stale content quietly drags trust and rankings - PHP version check: if your host still has you on an end-of-life PHP version, schedule the upgrade - The strategy question: is this website still doing its job, or is it maintenance vs redesign decision time?
Printable version
The one-page PDF version of this checklist is free, no email required: Download the checklist.
If you'd rather never think about this list
Everything above is literally our job description. Our plans run this entire routine, plus 24×7 monitoring between the checks, from $49/mo, with a monthly report showing each item done. The checklist is free either way; some owners run it themselves for years, and some hand it off the first time an update breaks something on a Friday night.
FAQ
How often should a website be updated? Check for updates at least monthly; apply security releases within days of release. Sites left 6+ months behind are the primary pool that hackers' automated scanners feast on.
Can I automate all of this? Backups, uptime monitoring, and some updates, yes. Restore testing, update supervision, form checks, and judgment calls, no. Automation without a human reviewing it is how "backed up for two years" turns out to mean two years of corrupted files.
What's the single most skipped item? Testing the backup restore. Almost everyone schedules backups; almost no one verifies they restore. Do the quarterly test.
Does this apply to Squarespace/Wix sites? Partially. Closed platforms handle updates, hosting, and SSL for you, but forms testing, broken links, content pruning, access audits, and Search Console checks are still yours.
You do not have to do any of this yourself
Skip the steps above. Our engineers handle security, updates, speed, backups and fixes for you, with a 12-minute average response and a 99.99% uptime target.