Keeping a business website alive: the monthly checklist
A website does not stay healthy on its own. Eighteen checks worth running monthly, grouped by what they protect, and the three that get skipped.
The short answer
A website does not stay healthy by itself. Certificates expire, dependencies age, forms silently stop delivering, access lists grow, backups quietly fail. The checklist below is the monthly round, in five groups. Most items take minutes when done monthly and days when discovered after a year. The three items that get skipped are marked; start there.
The checklist
| Group | Check | Why |
|---|---|---|
| Availability | Uptime monitor alerts reviewed; any downtime explained | Know what happened and why |
| Certificate expiry dates checked on every domain and subdomain | Expired certificates block visitors | |
| Domain renewal dates confirmed, auto-renew on, payment method valid | Expired domains take the site and email down | |
| DNS records reviewed for changes and leftovers | Stale records become security risks | |
| Security | Framework, dependency and platform updates applied through preview | Known vulnerabilities closed |
| Security headers and HTTPS configuration re-tested | Regressions after changes are common | |
| Access review: who can log in to hosting, domain, site, analytics | Former staff and agencies linger for years | |
| Two-factor confirmed on every account that supports it | Account takeovers start with a password alone | |
| Data | Backup restore actually performed on one site | An untested backup is a hope |
| Backup coverage confirmed: content, configuration, media, database if any | Partial backups are discovered during restores | |
| Every form submitted as a test, delivery confirmed to the right inbox or CRM | Forms fail silently and cost leads for months | |
| Performance and search | Real-user speed metrics compared with last month | Regressions after content or script changes |
| Search console errors, coverage and security issues reviewed | Indexing problems and hacks show up here first | |
| Broken links and 404 reports checked | Lost visitors and lost rankings | |
| Sitemap and structured data validated | Search visibility depends on them | |
| Continuity | Documentation of the setup updated with any change | The next person can take over |
| Third-party services reviewed: still used, still paid, still in your name | Zombie subscriptions and unowned accounts | |
| Report written: what was checked, dates, results, actions | Proof, not promises |
The three that get skipped
- Restore a backup. Not check that one exists; restore it somewhere and open the result. Skip it and you discover, on the day you need it, that the backup was incomplete or unreadable.
- Test every form end to end. Submit each one, confirm the message arrived where it should, confirm the auto-reply went out. Forms break when email providers change policies, when spam filters tighten, when a plugin updates.
- Review access. List every person and service with access to hosting, domain, website admin and analytics. Remove everyone who should not be there. Turn on two-factor for the rest.
What this means for you
Ask your partner for their monthly checklist and last month’s completed run. If you maintain your own site, run the three items above this week; they take an hour and find most of the expensive problems. Then put the whole list on the first Monday of each month, with an owner, and keep the reports. A website that is checked monthly rarely surprises anyone.
Frequently asked questions
Do static websites need this too?
Less of some items, all of others. No plugin updates and no database, so the security and update work shrinks. Monitoring, backups of content and configuration, form delivery, DNS, certificates, access reviews and renewals apply to every site regardless of how it is built.
Can we run this checklist ourselves?
Parts of it, if someone owns it and has the access and the habit. The failure mode is not ability; it is the month it gets skipped, then the next. If nobody in the business will do it on the first Monday of every month for years, it belongs with a partner.
How long does the monthly run take?
For a well-built site with monitoring in place, a couple of hours including the report. For a neglected site, the first run takes days, because every item finds something. After that it settles.