Website maintenance checklist for a small business: who checks what

A website that works today can quietly stop working. An update might be missed, a form might start sending to an old address, or a backup might turn out to be impossible to restore. One way this can happen is that nobody was sure the task was theirs.

This guide is for owners of small service businesses whose website works but who aren't sure who looks after it. As a practical starting point, it suggests agreeing who does each task, in-house or with a supplier, and how you'll know it was done. The guide works whatever platform your site runs on. It includes a responsibility table and an evidence log you can copy.

It isn't a security audit or a technical procedure for your platform. Your web supplier or whoever manages the site should handle the technical steps.

1. Split maintenance into two kinds of work

Treat these two kinds of work separately:

• Critical work, done as needed. This covers security and other critical updates, fixing a broken form or enquiry route, responding to a warning from Google and restoring the site after a failure. It happens when it's needed, not on a schedule.
• Routine review, at a cadence you agree. This covers checking content, contact details, forms, key pages and Search Console. It happens at regular intervals you've agreed.

The reason to keep them apart is simple. If critical updates are folded into a monthly review, they wait up to a month. They shouldn't.

2. Agree who applies updates

What needs updating depends on how your site is built. On a hosted website builder, the provider may update the platform itself, but you still look after your content and settings. On a site where your supplier installed the software and add-ons, someone has to apply their updates. Find out which kind you have.

The UK's National Cyber Security Centre (NCSC) advises small organisations to keep software up to date and to use software that is still supported. That principle comes from the NCSC's small organisations guide on protecting your devices. That guide isn't a procedure for website platforms, so agree the details with whoever manages your site:

• Who watches for updates, including security updates for the platform and any add-ons.
• Who applies them, and how quickly critical ones are applied. Agree this per site, rather than assuming a fixed timescale.
• Who checks the site afterwards, especially forms and key pages.
• What happens if an update breaks something, including who rolls it back and whether a recent backup exists first.

If any part of your site is no longer supported by its maker, ask your supplier to plan a replacement. Don't simply leave it running.

3. Backups only count if you can restore them

A backup that nobody has ever restored is a hope, not a plan. The NCSC's small organisations guide on backing up your data advises backing up your data and checking that you can restore it.

Agree and write down:

• What is backed up. This might be the site's files, its content and settings, and any form entries it stores.
• Where backups are kept, and whether they're stored separately from the website itself.
• Who runs the backups, and how you'd know if one failed.
• Who can restore the site, and what they'd need to do it.
• When a restore was last tested, and what evidence shows it worked.

Ask your supplier how they test a restore without disturbing the live site.

Backups may contain customer details from your forms, so agree who can access them.

4. Run a routine review at a cadence you agree

There's no single right schedule. A site that changes every week may need more frequent checks than one that rarely changes. Agree a cadence that suits your site, then stick to it. A routine review might cover:

• The enquiry route. Send a clearly marked test enquiry and check it reaches the right person. If it doesn't, our guide to tracing a contact form that isn't sending emails shows how to find where it stopped.
• Search Console. Google says Search Console emails you when it finds new issues on your site, and suggests checking around once a month or after you change the site's content. Its Security Issues report shows warnings if Google finds that your site might have been hacked. Its Manual Actions report shows whether Google has taken action against the site. Treat either kind of warning as critical work, not routine.
• Contact details and key content. Check phone numbers, email addresses, opening hours, service descriptions and any prices you show.
• Key pages and links. Check that your most important pages load and their links work.
• Who has access. Remove access for anyone who no longer needs it, such as a former employee or an old supplier.

5. After any change, test again

Any change can break something that was working. After an update, a new page, a form edit, a change to your email set-up or a new supplier, test the form and your key pages again. Record what you checked.

If you've just redesigned your site, our website redesign checklist covers the after-launch checks. This guide is about the ongoing arrangement after that.

6. Write it down in a responsibility table

The responsibility table records who does each task and when. The evidence log records each time it's done.

1. Copy the blank tables into a document or spreadsheet.
2. Fill in an owner for every task. That can be a person in the business or your supplier, but name one.
3. For critical work, write what triggers it. For routine work, write the cadence you've agreed.
4. Each time a task is done, add an entry to the evidence log.
5. If a task has several parts, record each part's result separately. Mark the task as passed only when every required part has passed; otherwise mark it incomplete and note what's missing.
6. If a task has no owner, that's the first thing to fix.

If a supplier does any of this, write down what their support includes and what it doesn't. Support should be agreed as part of the scope. Don't assume it's unlimited or available around the clock.

Illustrative example

Illustrative example only: an invented three-person cleaning business working with a web supplier. The owners and cadences are this business's own choices, not recommendations, and nothing here was tested.

Common questions

How often should I maintain my website?

There's no single schedule that suits every site. Critical updates and fixes happen when they're needed. For routine checks, agree a cadence based on how often your site changes and what would go wrong if something broke. Google suggests looking at Search Console around once a month, or after you change the site's content.

Is my host's backup enough?

It might be, but check. Ask what it covers, where it's stored, how long it's kept, who can restore it, and when a restore was last tested.

What should I do if Google emails about a security issue?

Treat it as critical work. Forward it to whoever manages your site straight away, and agree who will investigate and confirm when it's resolved.

Do I need a maintenance plan from a supplier?

It depends on your platform and on what you can do in-house. If you use a supplier, ask exactly what's included, what isn't, and how you'll know each task was done.

ScalePass offers ongoing support that keeps an agreed website setup maintained. Support coverage is agreed as part of the scope. It isn't unlimited or round-the-clock. If you'd like help agreeing who does what, see how we approach ongoing support.

In short

Split critical work from routine review, and never let critical updates wait for the review. Agree who applies updates and use software that's still supported. Make sure backups run and that someone has proved a restore works. Agree a cadence for routine checks that suits your site. Test again after any change. Write down the owner and the evidence for every task.