What Is Website Maintenance? 9 Tasks Every Small Business Site Needs Monthly

What Is Website Maintenance? A Straight Answer

Website maintenance is the routine work of keeping a live website secure, fast, functional and up to date. It covers software and plugin updates, security scanning, backups, broken link checks, performance testing, form testing, uptime monitoring, content freshness and analytics review. Think of it as the difference between owning a van and servicing a van: the site still runs without it, right up until the day it doesn’t.

Here is the part nobody says out loud. Website maintenance is an invisible service. When it is done well, nothing happens. No hack, no white screen, no “your site is not secure” warning in Chrome, no contact form quietly swallowing leads for six weeks. Because the result of good maintenance is an absence of problems, it is the first line small business owners cut from the budget, and the first thing they regret cutting.

This guide breaks down exactly what the work involves, how often each task should happen, what neglect actually costs, and how to decide whether to do it yourself or hand it to someone else.

What Website Maintenance Actually Includes (and What It Doesn’t)

There is constant confusion between three different things. Clearing it up helps you buy the right service and avoid paying twice.

Service	What it covers	Typical rhythm
Website maintenance	Technical upkeep: updates, patches, backups, security scans, uptime, speed, bug fixes	Monthly (some tasks weekly or daily)
Website management	Content edits, new pages, images, price changes, blog publishing	On demand
Web development / redesign	New features, new templates, rebuilds, integrations	Project based

Maintenance is the boring middle column of your website’s life. It is not marketing, it is not design, and it will never win you an award. It simply keeps everything else you paid for from decaying.

The Real Cost of Skipping Website Maintenance

Before the task list, here is why it matters in money terms rather than technical terms. redevolution.com walks through the specifics.

Hacked sites are expensive to clean. Emergency malware removal and reputation cleanup routinely costs more than two or three years of a basic maintenance plan. The vast majority of compromised small business sites were running outdated plugins, themes or CMS core.
Broken forms are silent revenue leaks. A contact form that stops delivering after a plugin or hosting change can go unnoticed for months. You do not get an alert when leads do not arrive.
Slow sites lose visitors. Every extra second of load time increases bounce rate, and Core Web Vitals feed into how Google ranks and reports on your pages.
Broken links hurt trust and crawling. Dead pages and 404s waste crawl budget and make a business look abandoned.
Backup-less disasters are fatal. A failed update with no restore point can mean rebuilding the site from scratch, which costs thousands and weeks of downtime.
Browser warnings kill conversions. An expired SSL certificate triggers a full-screen red warning. Almost nobody clicks through it.

The pattern is always the same: maintenance is cheap and predictable, neglect is expensive and sudden.

The 9 Website Maintenance Tasks Every Small Business Site Needs Monthly

This is the practical core. Each task below includes what it is, why it matters, and roughly how long it takes on a typical small business site of 10 to 40 pages.

1. Update the CMS core, plugins and themes

WordPress, WooCommerce, Shopify apps, page builders and every plugin release updates that patch security holes and fix bugs. Outdated plugins are the single most common entry point for automated attacks.

How to do it properly:

Take a full backup first (site files plus database).
Run updates on a staging copy if the site is business critical.
Update one batch at a time, not all at once, so you can identify what broke.
Visually check the homepage, a service page, the checkout or contact form, and the mobile view.
Remove plugins you no longer use instead of leaving them deactivated.

Rhythm: security patches within days of release, everything else monthly. Time: 20 to 45 minutes.

2. Verify backups (not just run them)

Most owners assume a backup plugin or a host’s “daily backup” has them covered. Two common traps: backups stored on the same server that gets compromised, and backups that have silently failed for months.

Confirm the latest backup exists and has a realistic file size.
Make sure at least one copy is stored off-site (cloud storage, not the web server).
Test a restore at least once or twice a year. An untested backup is a guess.

Rhythm: automated daily, verified monthly, restore-tested every 6 months. Time: 10 minutes monthly.

3. Run a security scan and review the firewall

A monthly malware and file integrity scan catches injected code, rogue admin accounts and modified core files before Google flags your domain.

Scan for malware and changed core files.
Review the user list and delete accounts for people who left.
Check failed login attempts and block abusive IP ranges.
Confirm two-factor authentication is on for every admin.
Check your domain is not flagged in Google Search Console security issues.

Rhythm: automated daily scanning, human review monthly. Time: 15 to 20 minutes.

4. Check uptime and hosting health

Uptime monitoring should be automated and free. What needs human attention monthly is the pattern: repeated short outages usually mean your hosting plan is undersized or a plugin is hammering the server.

Review the uptime log for the past 30 days.
Check disk space and PHP version (an unsupported PHP version is both a security and a speed problem).
Confirm your SSL certificate renewal date and domain expiry date.

Rhythm: monitoring continuous, review monthly. Time: 10 minutes.

5. Hunt down broken links and 404 errors

Links rot. External sites move pages, you delete an old service, an image gets renamed. Broken links frustrate visitors and scatter dead ends across your site.

Run a crawl with a link checker or use Google Search Console’s page indexing report.
Fix or redirect internal broken links with a 301.
Replace or remove dead external links.
Check for missing images and broken PDF downloads too.

Rhythm: monthly. Time: 20 to 30 minutes.

6. Test every form, button and conversion path

This is the task most maintenance plans skip and the one with the most direct impact on revenue. Do it manually, like a customer would.

Submit the contact form and confirm the email arrives (check spam folders too).
Test the quote form, booking calendar and newsletter signup.
On an ecommerce site, run a test order end to end including payment confirmation emails.
Click the phone number and email link on a mobile device.
Check that autoresponders and CRM integrations still fire.

Rhythm: monthly, and immediately after any plugin or hosting change. Time: 15 minutes.

7. Review speed and Core Web Vitals

Sites get slower over time as images pile up, plugins accumulate and caches misconfigure themselves after updates.

Run the homepage and one key landing page through PageSpeed Insights, on mobile first.
Compress or convert oversized images to WebP.
Confirm caching and a CDN are still active after updates.
Look at Core Web Vitals in Search Console for pages slipping into “needs improvement”.

Rhythm: monthly. Time: 20 minutes, more if fixes are needed.

8. Check SEO and indexing health

Maintenance overlaps with SEO at the technical level. You are not doing keyword research here, you are making sure Google can still read the site.

Review Search Console for crawl errors, coverage drops and manual actions.
Confirm the XML sitemap is current and submitted.
Check robots.txt has not been changed to block anything important (a classic post-redesign disaster).
Verify no important pages have accidentally been set to noindex.
Watch for sudden traffic drops that signal a technical problem rather than a ranking one.

Rhythm: monthly. Time: 20 minutes.

9. Refresh outdated content and legal pages

The cheapest credibility fix there is. Old content makes a business look closed.

Update copyright year, opening hours, pricing, staff names and service lists.
Remove expired promotions and events.
Check privacy policy, cookie notice and terms are still accurate for the tools you use.
Refresh one older blog post or service page with current information.
Confirm your business details match your Google Business Profile exactly.

Rhythm: monthly light pass, deeper audit quarterly. Time: 30 minutes.

A Suggested Website Maintenance Schedule

Not everything belongs on a monthly cycle. Here is a realistic rhythm for a small business site.

Frequency	Tasks
Daily (automated)	Backups, malware scanning, uptime monitoring, firewall blocking
Weekly	Security-critical plugin updates, spam comment cleanup, quick visual check of the homepage
Monthly	All 9 tasks above: full updates, backup verification, security review, broken links, form testing, speed, SEO health, content refresh
Quarterly	Database cleanup, plugin audit and removal, full mobile and cross-browser test, accessibility check, restore test
Annually	Domain and SSL renewal, hosting plan review, design and conversion audit, full content inventory, legal page review

Total realistic time for the monthly pass on a small site: two to three hours, assuming nothing is broken. When something is broken, it can be a full day.

Should You Handle Website Maintenance In-House or Outsource It?

There is no universal answer, but there is a clear way to decide. Score your situation honestly against these factors.

Factor	Do it in-house if…	Outsource if…
Revenue dependency	The site is a brochure and leads come from elsewhere	The site generates bookings, orders or most of your leads
Technical comfort	You can use staging, FTP and a database without panic	“Fatal error on line 247” would ruin your week
Time value	Three hours a month is genuinely spare	Three hours of your billable time costs more than a plan
Complexity	Fewer than 10 plugins, no ecommerce, no custom code	WooCommerce, memberships, custom themes, integrations
Consistency	You reliably do recurring admin tasks	You know the checklist would slip by month three
Recovery ability	You could restore a backup under pressure	You would be googling “how to restore WordPress” at 11pm

The honest middle ground: many small businesses handle content updates themselves and outsource only the technical layer (updates, backups, security, monitoring). That is usually the best value split, because content changes are frequent and easy, while technical failures are rare and expensive.

What to look for in a maintenance provider

A written list of what is included and, just as importantly, what is not
Off-site backups with a stated retention period and restore guarantee
Staging environment for testing updates before they touch the live site
A monthly report you can actually read, not a raw plugin log
Defined response time for emergencies and who to contact
Included support time for small edits, with a clear hourly rate beyond it
No lock-in of your hosting, domain or admin credentials

Red flag: any provider who will not tell you where your backups are stored or refuses to give you full admin access to your own site.

How Much Does Website Maintenance Cost?

Pricing varies by site complexity and how much human attention is included. Broad ranges you will encounter:

Level	Typical monthly cost	What you usually get
DIY	Tool costs only, plus 2 to 3 hours of your time	Backup, security and monitoring plugins or services
Basic plan	Entry level	Automated updates, backups, uptime monitoring, basic security, monthly report
Standard plan	Mid range	Everything above plus staging-tested updates, manual checks, speed monitoring, a set amount of edit time
Ecommerce or custom	Premium	Priority response, checkout testing, integration monitoring, developer time included

Compare any quote against the cost of one emergency: malware cleanup, a rebuild from a missing backup, or a week of downtime during your busiest season. Maintenance is insurance you also get performance benefits from.

A Copy-Paste Monthly Website Maintenance Checklist

Take a full backup and confirm it is stored off-site
Update CMS core, plugins and themes, then visually test key pages
Run a malware and file integrity scan
Review user accounts, logins and two-factor authentication
Check uptime log, disk space, PHP version, SSL and domain expiry
Crawl for broken links, 404s and missing images
Manually submit every form and test the full conversion path
Run PageSpeed Insights on mobile and fix oversized images
Review Search Console for crawl, indexing and security issues
Update outdated content, hours, pricing and legal pages
Empty spam comments and clean the database of revisions
Write down what you changed, so next month’s debugging is easier

Print it, calendar it for the same day each month, and treat it like paying a supplier invoice. The businesses that never have website emergencies are simply the ones that do this boring list on schedule.

Frequently Asked Questions About Website Maintenance

How long does website maintenance take?

For a small business site of 10 to 40 pages, the monthly routine takes roughly two to three hours when nothing is wrong. Automated tasks like backups and scanning run in the background. Fixing an actual problem, such as a plugin conflict or a malware cleanup, can take anywhere from an hour to a full day.

How much do people charge for website maintenance?

Plans range from a low monthly fee for automated updates, backups and monitoring, up to premium retainers for ecommerce sites that include developer time and priority support. Hourly rates for ad hoc fixes are common too. The biggest price drivers are site complexity, whether updates are tested on staging, and how much included support time you get each month. Background reading: https://mailchimp.com.

What is a person called who maintains a website?

Commonly a webmaster, though the title is dated. In practice the role is filled by a web developer, a website support specialist, a WordPress maintenance provider or an agency’s support team. For small businesses it is usually an external provider on a monthly plan rather than an in-house hire.

What does “website under maintenance” mean?

It is a temporary holding page shown while work is being done on the site, typically during major updates, a migration or a redesign. It tells visitors the site is not broken, just temporarily unavailable. Well-run maintenance rarely needs it, because updates are tested on a staging copy first and pushed live in minutes.

Is website maintenance the same as web hosting?

No. Hosting is the server space where your site lives. Maintenance is the ongoing work performed on the site itself. Some hosts bundle basic backups and automatic updates, but that is not a substitute for human checks on forms, links, speed and content.

What happens if I never maintain my website?

Typically in this order: plugins fall behind, speed degrades, broken links accumulate, a form silently stops sending, rankings slip, and eventually an outdated component gets exploited. The site keeps looking fine right up until it does not, which is exactly why maintenance feels optional until it is urgent.

How often should I update WordPress plugins?

Apply security releases as soon as they appear, ideally within a few days. Group other updates into a monthly session where you can back up first and test afterwards. Updating everything the instant it appears, with no backup and no testing, is how sites break.

The Takeaway

Website maintenance is not one service, it is nine recurring habits: updates, backups, security, uptime, links, forms, speed, SEO health and content freshness. Done monthly, it takes a couple of hours and prevents almost every website emergency a small business will ever face. Skipped, it saves you a small monthly cost and eventually hands you a bill that is many times larger.

Whether you run the checklist yourself or hand it to a provider matters far less than whether it actually gets run. Pick a date, pick an owner, and make it routine.