Website maintenance that does not rely on memory

A maintenance plan needs five parts

A useful plan names the asset, the check, the owner, the evidence and the response. “Keep the website updated” is not enough. “Every first Tuesday, the website owner applies supported updates in staging, tests checkout and records the production release” can be followed and audited.

1. AssetDomain, hosting, website, forms, email, analytics or integrations.
2. CheckThe exact customer or technical behaviour to verify.
3. OwnerA named person, not “marketing” or “the vendor”.
4. EvidenceTest submission, screenshot, log, invoice or restore result.
5. ResponseWho fixes it, how quickly and how customers are informed.
6. Review dateThe next scheduled check and the last completed date.

Singapore's Personal Data Protection Commission, which administers and enforces the Personal Data Protection Act, advises SMEs to consider security, maintenance, resilience, outsourcing and personal-data handling when building and operating websites.[1] Those concerns belong in the operating plan, not in a folder forgotten after launch.

What to check, and how often

Every week: complete the real customer path

• Send a genuine enquiry through every important form and confirm it reaches the right person
• Complete a test booking or checkout without charging a real customer
• Open the website on a phone and follow the main action from the home page
• Check opening hours, prices, stock, notices and time-sensitive offers
• Review outage and error alerts instead of assuming silence means success

A visual check is insufficient. A form can look perfect while mail authentication, a spam filter or an integration prevents delivery. Keep a test record with the page, time, receiving inbox and result.

Every month: update and prove recovery

Apply supported software, theme and plugin updates through a controlled process. WordPress's official guidance recommends backing up before updating and keeping the platform current.[2] The principle also applies outside WordPress: know what changed, test the customer path and retain a route back.

Confirm that a recent backup includes both files and data, is stored away from the live site and is usable. The United Kingdom's National Cyber Security Centre explains that backups should be tested, separated and protected from destructive access.[3] A dashboard saying “backup complete” is evidence of a job, not evidence of a successful restoration.

Review important pages in Search Console, broken links, large new media and Core Web Vitals. Google's web.dev documentation defines Core Web Vitals around loading, responsiveness and visual stability.[4] Use those measurements to find changed templates, then test the page as a person would.

Every quarter: review content, people and permissions

Check the top service, product and location pages against the current business. Remove outdated staff, terms and claims. Review administrator access, delete accounts that no longer need entry and turn on multi-factor authentication where the service supports it.

Sample keyboard navigation, headings, labels, contrast and zoom. The Web Content Accessibility Guidelines 2.2 are the W3C's international accessibility standard.[5] An automated scanner is useful for repeatable signals, but the W3C notes that evaluation combines tools with human judgement.[6]

Every year: verify business ownership

Confirm that the domain, hosting, website, email, analytics, payment and software accounts are controlled by the business. Record renewal dates, billing owners, recovery channels and critical licences. Test the continuity plan before the only administrator leaves or a supplier becomes unavailable.

Decide what happens when a check fails

Not every problem needs the same urgency. Define severity from customer and business effect, not from how technical the error sounds.

Keep control when suppliers change

A supplier can manage an account without owning it. The business should remain the registrant or primary administrator wherever possible, with suppliers invited through appropriate roles. Keep a handover list covering domain registrar, DNS, hosting, source files, content system, email, analytics, advertising, consent tools, payment providers and licences.

When a staff member or supplier leaves, remove access promptly, rotate shared credentials that cannot yet be eliminated, change recovery contacts and confirm scheduled jobs still run. For sites that process personal data, review what the supplier can access and whether that access remains necessary.

Use a maintenance record that proves the work

A spreadsheet or ticket system is enough. Include the date, asset, check, result, evidence link, action, owner and due date. Keep release notes for significant changes. The record makes repeated failures visible and stops the business paying several times for the same symptom.

What a paid website care plan should say

Compare plans by tasks and response, not by the word “maintenance.” Ask which pages and systems are covered, how often customer paths are tested, whether backups are restored, where changes are tested, who approves content, what happens outside office hours and how the supplier reports completed work.

• Scope: exact websites, forms, integrations and environments covered
• Cadence: scheduled checks and update windows
• Response: severity definitions and target acknowledgement times
• Recovery: backup location, retention and restoration testing
• Change allowance: what content work is included and what costs extra
• Ownership: who controls accounts, licences, code and handover material
• Evidence: report format, test records and release notes

If the same structural problems keep returning, maintenance may be preserving the wrong foundation. Use the repair, redesign or rebuild guide to choose the next intervention.