Website maintenance checklist for small businesses

A small-business website rarely fails in a dramatic way. It fails quietly: an expired certificate, a contact form that stops sending, a plugin hole, last year’s opening hours, a privacy policy that no longer matches how you collect enquiries.

This checklist is a repeatable cadence — not a redesign checklist. If you want someone else to own technical risk, that is website maintenance. If the shopfront is confused, maintenance will not fix it.

Set a cadence (or nothing gets done)

Put these on a calendar. “When we remember” is not a plan.

• Weekly: forms, obvious broken pages, urgent content (hours, outages, seasonal offers)
• Monthly: CMS/plugin/theme updates (on a copy or staging site first), backup confirmation, new content accuracy
• Quarterly: performance on a phone, search appearance of key pages, legal pages, user accounts, domain and hosting renewals
• Yearly: hosting fit, SSL and DNS review, “does this site still match the business?”, photo and bio refresh

WordPress sites usually need the monthly technical pass more than a static brochure site. Shopify stores need theme, app and product hygiene. The cadence stays; the tasks shift with the stack.

Security and updates

Checklist

• CMS core, themes and plugins (or apps) are on a controlled update schedule — not blind auto-update on production the night before a campaign
• Unused plugins, apps and admin users are removed
• Admin logins use unique passwords and, where the platform allows, two-factor authentication
• The public site is served over HTTPS; mixed-content warnings are gone
• You know who has access (staff, previous freelancer, intern from 2023)

After every update batch: click the homepage, a service or product page, the contact form, and the cart or booking path if you have one. Updates that are “done” but untested are how quiet breakage starts.

If you are on WordPress and the install has years of neglected plugins, a care plan may need a cleanup first. We will say so rather than collect a retainer on a ticking bomb — see WordPress development when the foundation itself is the problem.

Backups and restore

A backup you have never tested is a hope.

Checklist

• You know where backups live (host, plugin, Shopify, or both)
• You know how far back they go
• You know who can restore, and roughly how long it takes
• Off-site copies exist if the same host holds the only backup
• Restore is not “we would figure it out”

Write the restore path in one paragraph in your operations notes. If only a previous developer knows, you do not have a backup strategy.

Forms, bookings and integrations

This is the commercial heart of most Perth service sites. Design can look fine while leads vanish.

Weekly or after any plugin/app change

• Submit a test enquiry on mobile and desktop
• Confirm it arrives in the correct inbox (and spam is not swallowing it)
• Confirm the thank-you or confirmation behaviour still makes sense
• If you use a booking tool, CRM or newsletter connect, submit one real-shaped test

Also check

• Click-to-call numbers still match the number you answer
• Chat widgets, if you use them, are staffed or turned off — an abandoned chat is worse than none
• Payment or deposit flows still complete if you take money on the site

When something fails, treat it as an incident, not a “we will mention it next month” note.

Content that goes stale

Small businesses change faster than their websites.

Keep current

• Opening hours, holiday closures, and “we’re fully booked until…” notices
• Service area: suburbs you actually cover, without pretending you are everywhere
• Prices or “from” figures if you publish them — outdated prices create angry first calls
• Team page: people who left still smiling on the internet
• Case studies and photos of work you no longer do
• PDF menus, price lists and brochures (hospitality and clinics especially)

For hospitality, menus and booking links go stale fast. For medical, practitioner lists and appointment paths must match reality. For tradies, service lists and licence mentions should stay accurate.

Local pages should stay honest. If you genuinely serve Mandurah or Rockingham, say so on the site and on Google Business Profile the same way. Do not let the website claim a different area from the profile.

Performance, accessibility and “does it still work on a phone?”

You do not need a lab. You need a quarterly pass on a real phone, preferably on cellular data.

Checklist

• Homepage and a key service page load without a long blank wait
• Text is readable; buttons are tappable; the menu works
• Images are not huge uncropped dumps from a phone camera
• Embedded maps, videos and trackers have not piled up until the page crawls
• Keyboard users can reach the form (tab through and see focus)
• Alt text exists on meaningful images; decorative images are empty or skipped

If Core Web Vitals or Search Console show a problem, fix the cause (bloated theme, giant images, third-party scripts). Do not buy a new design to avoid a plugin diet — unless the theme itself is the constraint, in which case you are in redesign or rebuild territory.

Legal, trust and Australian basics

Not legal advice — a practical reminder to keep the site aligned with how you operate.

Checklist

• Privacy policy matches the forms and tools you actually use (analytics, ads, booking, CRM)
• Enquiry forms include working consent, not a pre-ticked mystery
• ABN and business name are consistent with invoices and Google Business Profile where you publish them
• Claims you would not put in a proposal do not sit on the homepage (“#1 in Perth”, guaranteed rankings, invented results)
• Copyright year and company details in the footer are not from a previous owner

If you run ads to landing pages, those pages need the same accuracy as the main site.

Search health (light, on a schedule)

Maintenance is not an SEO retainer. A quarterly glance still catches rot.

• Google Search Console (or equivalent) for coverage errors and obvious 404 spikes
• Key service pages still index; you have not noindexed the site after a staging mistake
• Title tags still match the offer
• New blog or service URLs are in the sitemap

Deeper local work belongs on the local SEO website checklist. Ongoing optimisation is SEO services, not a plugin that “does SEO” overnight.

When DIY is enough vs a care plan

DIY can work when the site is simple, you have a competent person on staff, staging exists, and you will actually keep the cadence.

A care plan is worth it when:

• The stack is WordPress or WooCommerce with enough plugins to be a liability
• Nobody on the team wants to own updates
• An outage during a campaign would hurt
• You inherited a site and do not know what is on it

Care plans should spell out what is included (updates, backups, monitoring, a small content allowance) and what is quoted separately (new sections, redesigns, major integrations). That boundary keeps the plan honest.

Maintenance will not rescue a site that never explained the offer. Pair care with growth work only when the shopfront is already clear. See how to choose a web developer if the original build is the real problem.

Put the checklist in writing

Copy the cadence table into your operations doc, add account owners (domain, hosting, CMS, analytics), and name a deputy. Then run it, or ask us for a maintenance quote with your platform and hosting. We will match the plan to risk — and say if the site needs cleanup first.