When was the last time someone checked your website's backups? Not "do you have a backup plugin installed" — when did someone actually restore a backup to verify it works? If you don't know, you don't have a maintenance plan. You have a false sense of security.
Most businesses treat their website like a car they never service. It runs fine until it doesn't — and when it doesn't, the repair bill is ten times what the maintenance would have cost.
This is the checklist we use internally at Innovatrix Infotech for every site under our managed services. We're publishing it so you can hold your current provider accountable — or handle it yourself if you have the technical chops.
The Full Maintenance Schedule
Here's the overview before we break each task down:
| Frequency | Tasks | Time Required |
|---|---|---|
| Weekly | Backup verification, uptime monitoring, security scan, comment/spam cleanup | 1–2 hours |
| Monthly | Plugin/theme updates, performance audit, broken link check, content review, analytics report | 3–5 hours |
| Quarterly | Full security audit, SEO health check, dependency updates, emergency plan review | 4–6 hours |
| Annually | SSL renewal, domain renewal, technology review, disaster recovery test, hosting evaluation | 6–10 hours |
Let's go through each one.
Weekly Tasks
1. Backup Verification
Having backups is not the same as having working backups. Every week, someone should:
- Confirm that automated backups completed successfully
- Check that backup files are stored off-server (not just on the same hosting account)
- Verify backup file sizes are consistent (a sudden drop means something broke)
- Once a month, do a full test restore on a staging environment
If your backup plugin says "last backup: 47 days ago" — that's not a backup system. That's a liability.
2. Uptime Monitoring Review
You should be using an external uptime monitor (UptimeRobot, Pingdom, Better Uptime — pick one). Weekly, review:
- Any downtime incidents from the past 7 days
- Response time trends (is your site getting slower?)
- SSL certificate status
- DNS resolution checks
If nobody is watching your uptime, you're relying on customers to tell you your site is down. They won't. They'll just leave.
3. Security Scan
Run a malware and vulnerability scan weekly. This means:
- Server-side malware scanning (not just a frontend scanner)
- File integrity monitoring (detect unauthorized file changes)
- Login attempt review (look for brute force patterns)
- Blocklist checking (is your domain flagged anywhere?)
4. Comment and Spam Cleanup
If your site has comments, contact forms, or user-generated content:
- Clear spam queues
- Review and moderate pending comments
- Check form submission logs for injection attempts
- Clean up any test/spam submissions from the database
Monthly Tasks
5. Plugin and Theme Updates
This is where most "maintenance plans" begin and end. But updates done wrong cause more problems than updates skipped entirely.
The correct process:
- Review changelog for every pending update
- Check plugin compatibility with your current WordPress/PHP version
- Take a full backup before updating
- Update on a staging environment first
- Test critical functionality after staging updates (forms, checkout, login)
- Push updates to production
- Verify production site works correctly post-update
- Document what was updated and any issues encountered
"We updated everything and the site broke" is not bad luck. It's bad process. Staging environments exist for a reason.
Never enable auto-updates for everything. Core security patches — yes. Major plugin version bumps — absolutely not.
6. Performance Audit
Run your site through Google PageSpeed Insights, GTmetrix, or WebPageTest every month. Track these metrics:
- Largest Contentful Paint (LCP) — should be under 2.5 seconds
- First Input Delay (FID) / Interaction to Next Paint (INP) — should be under 200ms
- Cumulative Layout Shift (CLS) — should be under 0.1
- Total page weight (aim for under 3MB on key pages)
- Number of HTTP requests
Compare month-over-month. Performance doesn't degrade overnight — it erodes gradually as content is added, plugins accumulate, and images go unoptimized.
7. Broken Link Check
Broken links hurt SEO and user experience. Monthly:
- Run a crawler (Screaming Frog, Ahrefs, or a plugin like Broken Link Checker)
- Fix or redirect any 404s
- Check external links that may have changed
- Verify all CTA buttons and form submission endpoints work
- Test any embedded content (videos, maps, calendars)
8. Content Review
Content rots faster than most people realize:
- Check pricing pages for accuracy
- Verify team member info is current
- Review any date-specific content ("in 2024" on a page in 2026)
- Confirm all phone numbers, emails, and addresses are correct
- Check that portfolio/case study links still work
9. Analytics Report
A maintenance plan without analytics is maintenance in the dark. Monthly, review:
- Traffic trends (organic, direct, referral, social)
- Top landing pages and their bounce rates
- Conversion funnel performance
- Core Web Vitals from Google Search Console
- Any crawl errors or indexing issues
- 404 error trends
This doesn't need to be a 30-page report. A one-page summary with the 5 most important numbers and any action items is more useful than a PDF nobody reads.
Quarterly Tasks
10. Full Security Audit
Beyond weekly scans, a quarterly deep-dive should cover:
- Review all user accounts (remove inactive accounts, verify admin access)
- Check file permissions on the server
- Review and update security plugin settings
- Test firewall rules
- Verify two-factor authentication is enabled for all admin users
- Check PHP version (are you on a supported version?)
- Review error logs for suspicious patterns
- Test that your security incident response plan still works
11. SEO Health Check
Quarterly SEO maintenance prevents the slow decline that's hard to reverse:
- Full site crawl (check for indexation issues, duplicate content, thin pages)
- Review and update XML sitemap
- Check robots.txt for any misconfigurations
- Review structured data for errors (Google Rich Results Test)
- Analyze keyword ranking trends
- Check Google Search Console for manual actions or security issues
- Review and update meta descriptions for key pages
- Check internal linking structure
12. Dependency Updates
Beyond plugins, your site has deeper dependencies:
- PHP version (update to latest stable release)
- MySQL/MariaDB version
- Server OS security patches
- Any custom code library updates
- CDN configuration review
- Caching layer verification
13. Emergency Plan Review
Does your team know what to do if:
- The site gets hacked?
- The server goes down at 2 AM?
- A critical plugin is abandoned by its developer?
- Your hosting provider has a major outage?
Quarterly, review your emergency contacts, escalation procedures, and recovery runbooks. If they only exist in someone's head, they don't exist.
Annual Tasks
14. SSL Certificate Renewal
Most SSL certificates auto-renew, but "most" isn't "all." Annually:
- Verify SSL certificate expiration date
- Confirm auto-renewal is configured
- Test SSL configuration (SSL Labs test)
- Check for mixed content issues
An expired SSL certificate will immediately tank your traffic. Browsers will show a full-page warning that scares away every visitor.
15. Domain Renewal
This sounds obvious until it isn't:
- Verify domain auto-renewal is on
- Confirm the payment method on file is current
- Check domain registrar account access (do you have the login?)
- Review DNS settings
- Consider multi-year renewal for critical domains
16. Technology Review
Once a year, step back and evaluate:
- Is your CMS still the right choice?
- Are there plugins you're paying for but not using?
- Is your hosting plan right-sized?
- Should any custom functionality be rebuilt with better tools?
- Are there new technologies that could meaningfully improve your site?
This isn't about chasing trends. It's about ensuring your technology stack still matches your business needs.
17. Disaster Recovery Test
Once a year, simulate a complete failure:
- Restore your site from backup to a clean server
- Time how long the full recovery takes
- Document any gaps in your backup (missing files, database issues)
- Update your recovery procedures based on findings
If you've never done this, your first disaster recovery test will be humbling. Better to be humbled in a test than during an actual crisis.
What a Good Maintenance Plan Costs
Let's talk money. Here's what the market looks like:
| Plan Tier | What's Included | Typical Price Range |
|---|---|---|
| Basic | Weekly backups, uptime monitoring, monthly plugin updates, basic security scan | ₹5,000–₹10,000/month |
| Standard | Everything in Basic + monthly performance audit, broken link fixes, analytics report, staging environment updates | ₹10,000–₹20,000/month |
| Premium | Everything in Standard + quarterly SEO audit, priority support, same-day emergency response, content updates (up to X hours) | ₹20,000–₹40,000/month |
| Enterprise | Custom SLA, dedicated account manager, 24/7 monitoring, unlimited content updates, annual technology review | ₹40,000+/month |
If someone is charging ₹2,000/month for "website maintenance," they're running auto-updates and calling it a service. That's not maintenance. That's a cron job.
Red Flags Your Provider Isn't Actually Maintaining Your Site
Watch for these signs:
- No monthly report. If they can't show you what they did, they probably didn't do anything.
- You discover your own outages. You should never learn your site is down from a customer.
- "We updated everything" with no details. Which plugins? What versions? Any issues? What was tested?
- No staging environment. Updates going straight to production is reckless, not efficient.
- They can't tell you when the last backup was restored and tested. This is the single most important question.
- Your site speed is getting worse over time. If nobody is monitoring performance, nobody is maintaining performance.
- Security incidents surprise everyone. A maintained site catches threats before they become breaches.
- They push back on giving you access. You own your website. Your maintenance provider should never gatekeep your own property.
FAQ
Can I maintain my own website instead of hiring someone?
Yes, if you have the technical knowledge and — critically — the discipline to do it consistently. Most business owners start strong and trail off after month two. The value of a maintenance provider isn't just expertise; it's consistency. The tasks listed above need to happen whether you're busy, on vacation, or dealing with a crisis.
How often should WordPress plugins be updated?
Security patches should be applied within 24–48 hours of release. Feature updates and major version bumps should be tested on staging first, which typically means monthly. Never enable auto-updates for all plugins unless you have automated testing that catches breakage.
Is managed hosting the same as website maintenance?
No. Managed hosting (WP Engine, Kinsta, Flywheel) handles server-level concerns — PHP updates, server security, caching infrastructure. They don't update your plugins, test your forms, audit your SEO, review your analytics, or fix your broken links. You still need application-level maintenance on top of managed hosting.
What happens if I skip maintenance for six months?
Typically: outdated plugins with known vulnerabilities get exploited, your PHP version falls behind and your host force-upgrades (breaking things), your search rankings slowly decline, your site speed degrades, and broken links accumulate. The longer you wait, the more expensive the catch-up becomes. A site that hasn't been maintained in 6+ months often needs a recovery project, not just a maintenance restart.
Should I pay for a maintenance plan if my site is simple (5–10 pages, no ecommerce)?
A simple site needs less maintenance, but it still needs maintenance. At minimum: monthly backups with verification, quarterly plugin updates, SSL monitoring, and annual domain renewal. A basic plan at ₹5,000/month is reasonable. What you're really paying for is someone who notices when things break — before your customers do.
What's the first thing I should check right now?
Go verify your backups. Log into whatever backup solution you use and confirm: (1) backups are running, (2) the most recent backup is from this week, and (3) you know how to restore it. If any of those three fail, fix that before anything else on this list.
Stop Hoping Your Website Is Fine
Hope is not a maintenance strategy. Every task on this checklist exists because we've seen what happens when it gets skipped — hacked sites, lost data, tanked rankings, broken checkouts discovered weeks after they stopped working.
You have two options: build the internal discipline to do this yourself, or hand it to someone who will.
Hand off your website maintenance to a team that actually does the work. Our managed services plans start at ₹5,000/month. Get in touch →