Websites are treated as projects that end. They are closer to vehicles: mostly fine, until the one thing you never checked fails at the worst moment. This is the schedule we recommend to clients, organised by how often each task genuinely needs doing.
Monthly
Thirty minutes, once a month, prevents most of what goes wrong.
- Apply security updates — CMS core, plugins, themes, and server packages. Test on staging first if the site earns money.
- Verify backups actually restore — a backup you have never restored is a hope, not a backup.
- Check every form works — submit your own contact form and confirm the email arrives. Silent form failures are the most expensive common website fault.
- Review uptime reports — repeated short outages usually signal a hosting problem worth escalating.
- Scan for broken links — especially after content edits.
- Glance at analytics — a sudden traffic drop is easier to fix in week one than in month six.
Test your contact form every single month. We have seen businesses lose months of enquiries because an SMTP password changed or a spam filter started silently swallowing submissions. Nothing on the site looks broken — the leads simply stop arriving.
Quarterly
- Run PageSpeed Insights on your top pages and compare against last quarter. Performance drifts downward as content is added.
- Review Search Console for crawl errors, coverage issues, and Core Web Vitals warnings.
- Check the site on real devices — a current Android phone, an iPhone, and a tablet.
- Audit your plugins — remove anything unused. Every plugin is maintenance burden and attack surface.
- Update stale content — pricing, team members, year references, and anything describing "2024".
- Verify SSL certificate renewal is genuinely automatic.
- Review user accounts and remove access for people who have left.
Annually
- Renew domain and hosting — and enable auto-renewal on the domain. Expired domains are recoverable but expensive and stressful.
- Full security review — dependency audit, permission check, admin password rotation.
- Content and structure audit — which pages get no traffic? Which questions do customers ask that the site does not answer?
- Competitor comparison — has your sector's baseline moved?
- Review legal pages — privacy policy and terms still accurate?
- Test disaster recovery — could you rebuild from backups if the host disappeared tomorrow?
Maintenance load by site type
| Site type | Effort | Realistic monthly cost | Main risk if ignored |
|---|---|---|---|
| Static hand-coded | Very low | ₹0 – ₹2,000 | Content goes stale |
| WordPress | Moderate | ₹2,000 – ₹8,000 | Plugin compromise |
| E-commerce | High | ₹5,000 – ₹25,000 | Payment failures, breaches |
| Web application | High | ₹10,000 – ₹50,000 | Data loss, downtime |
The cheapest maintenance strategy is building something that needs little maintenance. That is a decision made at build time, not afterwards.
Things worth automating
- Uptime monitoring Free tools will alert you within minutes of the site going down. There is no excuse for learning about downtime from a customer.
- Automated daily backups Stored somewhere other than the same server. A backup on the machine that failed is not a backup.
- SSL auto-renewal Let's Encrypt renews automatically and costs nothing.
- Form submission copies Send every enquiry to a second address so a mail failure cannot silently lose leads.
- Search Console email alerts Google will tell you about serious problems if you let it.
What to keep in one place
Whoever maintains your site — you, staff, or an agency — should be able to find all of this in one document:
- Domain registrar login and renewal date
- Hosting control panel access
- CMS or admin credentials
- Code repository location
- Analytics and Search Console access
- Email/SMTP configuration for forms
- Who to contact when something breaks
Own your accounts. Domain and hosting should be registered in your company's name with your email, not your developer's. Agencies come and go; losing control of your own domain is a genuinely serious problem that is trivially avoided.
Want maintenance handled for you, or a one-off health check on a site nobody has touched in two years? Get in touch. See also our performance guide.