Website Maintenance Checklist: Monthly, Quarterly, Yearly

Short answer: website maintenance is a short list of checks on a calendar. Monthly: form, backup, updates, errors, content. Quarterly: restore test, access review, speed, redirects, data retention. Yearly: domain, contracts, content audit, legal pages. Most items take minutes. The one that is skipped most, the restore test, is the one that matters when something breaks.

What should be checked every month?

Each item below has a pass or fail answer. Record the date and result in a shared sheet.

• Contact form. Submit a test enquiry from a phone. It must reach the inbox and the stored record. Delete the test record after.
• Backup exists. Open the backup location and confirm a file dated within the last 7 days, and that its size is close to last month's.
• Software updates. On WordPress, apply core, theme and plugin updates after the backup. WordPress published 10 releases in the 12 months to October 2026, 7 of them security releases. On a Next.js or static site there are no plugins; update dependencies on a quarterly schedule instead.
• Uptime. Read the month's uptime report. UptimeRobot's free plan checks 50 monitors every 5 minutes, which is enough for a business site.
• Search Console. Open Pages and Core Web Vitals. Count new errors and URLs marked Poor on mobile.
• Analytics. Confirm GA4 recorded sessions and the enquiry event every day of the month. A gap means a broken tag.
• Broken links. Crawl the site with a free link checker and fix 404s or redirect them.
• Content. Prices, opening hours, address, phone, WhatsApp number, team page. Compare against the Google Business Profile.
• Security scan. Run a malware scan on plugin-based sites. On any site, confirm the security headers are still present with a header checker.

Time: 30 to 60 minutes a month for a small business site. Longer if the updates break a page, which is why the backup comes first.

What should be checked every quarter?

Quarterly items are the ones that fail silently.

• Backup restore test. Steps in the section below.
• Access review. List every person and agency with access to the domain, DNS, hosting, Search Console, GA4, Business Profile, repository and form data. Remove anyone who has left.
• Core Web Vitals. PageSpeed Insights on the home page, a service page and the contact page, mobile. Google's thresholds are LCP under 2.5 seconds, INP under 200 milliseconds and CLS under 0.1 at the 75th percentile.
• Redirects. Open 10 URLs from the launch redirect map and confirm each still lands on the right page. Google recommends keeping redirects at least 1 year.
• Certificate check. Confirm HTTPS renews automatically. Let's Encrypt certificates last 90 days and renew every 60. Under the CA/Browser Forum schedule summarised by DNSimple, the maximum validity for any public certificate is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Manual renewal is on its way out.
• Data retention. Delete enquiries, applications and uploads past your stated retention period. The PDPA's retention limitation obligation requires personal data to be disposed of once it is no longer needed for a business or legal purpose.
• Dependency updates. On framework sites, update packages, rebuild on a preview URL, test the forms, then deploy.
• Search performance. Compare clicks and impressions with the same quarter last year. Note the five pages that fell most.
• Email authentication. Check SPF, DKIM and DMARC records still pass, since a change at the email provider can break form notifications.

Time: 2 to 3 hours a quarter, most of it the restore test.

What should be done once a year?

• Domain renewal. Check the expiry date and the registrant email. ICANN's Expired Registration Recovery Policy requires registrars to send reminders about one month and one week before expiry, and gives a 30-day redemption period after deletion, during which DNS stops resolving. Set auto-renew and a card that will not expire first.
• Contracts and licences. Hosting plan, paid plugins or services, stock image licences, font licences. Cancel what the site no longer uses.
• Content audit. List every page with its visits for the year. Rewrite the pages that matter, redirect the pages that no visitor opened.
• Legal pages. Privacy notice, terms, PDPA contact, cookie statement. Confirm they describe what the site does now.
• Accounts in the company's name. Domain, hosting, Search Console owner, GA4 administrator, Business Profile primary owner. Confirm each is held by the company, not an agency.
• Full audit. Run the website audit checklist once a year, including accessibility and structured data.
• Cost review. Add up hosting, domain, services and maintenance for the year. Compare against the figures in website maintenance cost in Singapore.
• Disaster plan. One page: who to call, where the backups are, how to restore, how to point the domain at a holding page.

How do I test that a backup restores?

A backup proves nothing until it has been restored. The test takes an hour a quarter.

1. Pick the latest backup. Note its date and size.
2. Restore to a staging address, not the live site. On WordPress hosting that is a staging copy; on a framework site it is a preview deployment pointed at a restored database.
3. Open 5 pages including the home page, a service page and the contact page. Check images load and layout holds.
4. Check the newest records. Find the most recent enquiry or order in the restored data. If it is older than the backup date claims, the backup is incomplete.
5. Submit a test form on the staging copy and confirm it writes a record.
6. Time it. Write down how long the restore took. That is your real recovery time.
7. Delete the staging copy and the test records.
8. Record the result with the date, backup file name, time to restore and any faults.

If any step fails, the next action is to fix the backup, not to file the report. Common faults: the database is backed up but uploads are not, the backup runs but the storage filled up months ago, or the only person who knows the restore steps has left.

Monthly retainer or ad hoc: which fits?

The answer depends on how much of the list above the platform forces on you.

A retainer buys someone to run the monthly list and fix what updates break. On a site with nothing to patch, the monthly list is 30 minutes of checks a staff member can do, and a developer is needed only for changes. Published Singapore retainer prices and what they cover are in website maintenance cost in Singapore, and the website maintenance page states what cense sites need.

What cense does

cense sites are built in Next.js on Vercel or Google Cloud with no plugins, HTTPS and security headers, so there is no monthly patching and S$0 monthly maintenance. The client owns the domain, code, hosting and data and can run this checklist in-house. See website maintenance Singapore.