Website Maintenance Checklist: What Your Developer Should Be Doing Monthly

The Launch Isn't the Finish Line

We get calls every month from businesses whose sites were built by another agency, launched with fanfare, and then left untouched for 18 months. The symptoms are always the same: broken forms, expired SSL certificates, dependencies with known security vulnerabilities, and search rankings that have quietly eroded to nothing.

Website maintenance isn't glamorous. It doesn't make for exciting case studies. But it's the difference between a site that compounds value over time and one that slowly rots into a liability.

Here's what should be happening every single month — and what it costs when it doesn't.

Security Updates and Patches

This is the non-negotiable. Security vulnerabilities in frameworks, libraries, and CMSs are discovered weekly. Leaving them unpatched is how businesses get breached.

• Framework updates — Next.js, React, Node.js — check for security patches and apply them. Not every update is urgent, but security releases always are
• Dependency audit — Run npm audit or equivalent. Review every high and critical vulnerability. Fix or mitigate — don't just ignore the warnings
• CMS patches — If you're on WordPress, Drupal, or any CMS, apply core and plugin security updates within 48 hours of release. Unpatched WordPress installations are the most exploited attack vector on the web
• SSL certificate monitoring — Certificates expire. When they do, browsers show scary warnings and users leave. Set up automated renewal or manual calendar reminders 30 days before expiry

The cost of skipping this: a breached site costs $5,000–$50,000 to recover, depending on the damage. Monthly security maintenance costs a fraction of that.

Performance Monitoring

Site speed degrades over time. New content, additional scripts, third-party widgets, analytics tags — each one adds milliseconds. Individually negligible; collectively devastating.

• Core Web Vitals check — Review LCP, FID/INP, and CLS in Google Search Console and PageSpeed Insights. Compare to the previous month. Any regression needs investigation
• Page load time audit — Test your five highest-traffic pages monthly. Tools: WebPageTest, Lighthouse CI, or your own monitoring stack
• Third-party script review — Every chat widget, analytics pixel, and A/B testing script adds latency. Audit quarterly: is each one still needed? Is there a lighter alternative?
• Image optimization — New content often includes unoptimized images. Review any pages updated in the last month for oversized images or missing lazy loading

Our web development clients get performance monitoring built into their maintenance plan. But even if you manage it yourself, this check takes 30 minutes monthly and prevents the slow decline that kills conversion rates.

Backup Verification

Backups exist to save you when everything else fails. But a backup you've never tested is a backup that might not work.

• Database backups — Verify your automated backup is running. Check the most recent backup date. Once per quarter, restore a backup to a staging environment to confirm it actually works
• Code backups — If your code is in Git (it should be), verify the main branch is deployable. If you use CI/CD, run a test deployment to staging monthly
• Media backups — Images, PDFs, user uploads — these often live outside version control. Make sure they're included in your backup strategy
• Backup retention policy — Keep at least 30 days of daily backups and 6 months of weekly backups. Storage is cheap. Lost data is not

Content and SEO Health

Search rankings don't maintain themselves. Content goes stale, links break, and competitors publish new material. Monthly maintenance should include:

• Broken link check — Internal and external links break as pages move or sites go down. Crawl your site monthly with Screaming Frog or a similar tool. Fix broken links immediately — they hurt user experience and SEO
• Search Console review — Check for crawl errors, manual actions, and coverage drops. Look at your top queries and pages — any unexpected drops need investigation
• Content freshness audit — Pages with outdated information (old dates, discontinued products, changed pricing) damage trust. Review your top 20 pages quarterly for accuracy
• 404 monitoring — New 404 errors appear when URLs change, products are removed, or external sites link to pages that no longer exist. Redirect them or create the missing content

Uptime and Error Monitoring

If your site goes down at 2 AM, how long until you notice? The answer should be "within 5 minutes" — not "when a customer emails."

• Uptime monitoring — UptimeRobot, Better Stack, or Pingdom. Check every 60 seconds. Alert via SMS and email for downtime events
• Error tracking — Sentry or equivalent. Monitor for new errors, especially after deployments. A 500 error on your checkout page costs you money every minute it persists
• Log review — Monthly review of server logs for unusual patterns: traffic spikes from unexpected regions (bot attacks), repeated auth failures (brute force attempts), or resource exhaustion warnings

What Monthly Maintenance Actually Costs

Honest ranges based on site complexity:

• Simple marketing site (5–15 pages, no CMS): $200–$500/month
• CMS-based site (WordPress, headless CMS, blog): $500–$1,000/month
• E-commerce site: $1,000–$2,500/month
• SaaS application: $2,000–$5,000/month

These cover security patches, performance monitoring, backup verification, SEO health checks, and uptime monitoring. They don't cover feature development or major redesigns — those are separate engagements.

Our website maintenance service covers all of the above in a fixed monthly retainer. No hourly billing. No surprise invoices when a security patch takes longer than expected.

The Maintenance Calendar

Here's a template your team can use right now:

• Weekly: Check uptime reports, review error monitoring dashboard, apply critical security patches
• Monthly: Full dependency audit, Core Web Vitals check, broken link scan, Search Console review, backup verification
• Quarterly: Restore a backup to staging, audit third-party scripts, content freshness review, SSL certificate check
• Annually: Full security audit, performance benchmark against competitors, hosting and infrastructure review

What Happens When You Don't Maintain

We've cleaned up enough neglected sites to tell you exactly what happens:

• Month 3: Minor dependency warnings accumulate. Site still works
• Month 6: Performance has degraded 15–20%. Search rankings start slipping. Nobody notices yet
• Month 12: A dependency has a known critical vulnerability. A form has been silently failing for weeks. Organic traffic is down 30%
• Month 18: The site is a security risk, a performance liability, and an SEO disaster. The cost to fix it now exceeds the total cost of 18 months of maintenance

Don't be month 18. Start the checklist now — or talk to us about handling it.