Most small business websites do not break suddenly. They break slowly: an update is skipped, a backup stops running, a plugin goes six months without a security patch, and then one day you try to log in and nothing works. By then, the fix is expensive because the neglect has compounded.
This checklist prevents that. It takes about 30 minutes per month if everything is healthy. Treat it like changing the oil in your car. It is not exciting, but skipping it costs far more than doing it.
Don't want to do this yourself?
Our monthly support plan covers all of this and more. Updates, backups, security, and small fixes handled for you.
Weekly: WordPress and Plugin Updates
Check for updates every week. Back up your site before applying any updates. Update WordPress core first, then plugins one at a time, then your theme. Test after each update. Do not use the Update All button. If you are running WooCommerce, update it separately and test checkout after every update.
If a plugin has not been updated by its developer in over a year, it is a risk. Consider replacing it with an actively maintained alternative. Our plugin risk checklist helps you evaluate which plugins are safe to keep.
Weekly: Verify Backups Are Running
Having a backup plugin installed is not enough. You need to verify that backups are actually completing successfully. Log into your backup plugin (UpdraftPlus, BlogVault, etc.) and check the date of the most recent backup. If it is more than a week old, something is wrong.
At least once per quarter, test a restore. Download your backup files and verify they are not corrupted. A backup you have never tested is a backup you cannot rely on.
Monthly: Security Scan
Run a malware scan using your security plugin (Wordfence, Sucuri, or iThemes Security). Look for any flagged files, unauthorized admin accounts, or suspicious login attempts. Check your security plugin's firewall log for blocked attacks. This takes about five minutes and is your early warning system for compromised sites.
Also check your list of WordPress admin users. If you see any accounts you do not recognize, remove them immediately and change your admin password.
Monthly: Test Your Contact Forms
Submit a test entry through every form on your site. Verify the confirmation message appears and the notification email arrives in your inbox. Form failures are one of the most common silent problems on WordPress sites because the form looks fine on the page but the emails never arrive. You could be losing leads for weeks before noticing.
If your forms are not sending emails, see our guide on why contact forms stop sending emails.
Monthly: Mobile Check
Open your site on your phone and tap through every major page. Check the navigation menu, the contact form, any call-to-action buttons, and the footer. More than 60% of your visitors are on mobile devices, and layout issues that are invisible on a laptop can make your site unusable on a phone.
Pay special attention to: text that is too small to read, buttons that are too close together to tap accurately, images that overflow the screen, and pop-ups that are difficult to close on mobile.
Monthly: Speed Check
Run your site through Google PageSpeed Insights or GTmetrix. Your goal is a mobile load time under three seconds. If your site is slower, the most common causes are unoptimized images, too many plugins, render-blocking JavaScript, and lack of caching. Each of these is fixable without a redesign.
Track your score over time. If it is gradually getting worse, something is accumulating, usually a plugin adding more and more scripts to every page.
Site feeling slow?
A speed optimization is often a Quick Fix project. We will identify the bottleneck and resolve it for a flat price.
Monthly: Check for Broken Links
Broken links hurt your SEO and frustrate your visitors. Use a free tool like Broken Link Checker (plugin) or an online crawler like Screaming Frog's free version. Fix or remove any links that return 404 errors. Pay special attention to links in your navigation, footer, and call-to-action buttons because those affect the most visitors.
Quarterly: Analytics Review
Log into Google Analytics (or whatever analytics tool you use) and check three things: Is traffic going up or down over the last quarter? Which pages get the most traffic? Where are visitors dropping off? You do not need a deep analysis. You need a quick health check that confirms your site is being found and used.
If traffic has dropped significantly, check Google Search Console for any crawl errors, manual actions, or indexing issues. A sudden traffic drop often means Google has found a technical problem with your site.
Quarterly: WooCommerce Checkout Test
If you run a WooCommerce store, place a test order every quarter. Go through the full checkout: add a product, enter shipping information, complete payment (use a test payment method or place a small real order and refund it). Verify the order confirmation email arrives, the order appears in your dashboard, and inventory updates correctly. Silent checkout failures are the most expensive kind of website problem.
Annually: Domain and Hosting Renewal Check
Check the expiration date on your domain name and your hosting plan. Set a reminder 30 days before each renewal date. An expired domain can be scooped up by someone else within days. An expired hosting account takes your entire site offline. These are the most preventable and most catastrophic failures a website can have.
While you are at it, verify that your domain's DNS records, SSL certificate, and nameservers are all configured correctly. If you recently changed hosting providers, make sure nothing was missed in the migration.
Let us handle all of this for you
Monthly support from Sparks Motion covers updates, backups, security, form testing, speed monitoring, and small fixes. Everything on this list, done for you.
Frequently Asked Questions
Q: How long does monthly maintenance take?
About 30 minutes per month if everything is healthy. If you find a problem (a broken form, a failed backup, a slow page), the fix time varies. The checklist itself is quick. It is the catch-and-fix that takes time.
Q: What if I have been neglecting my site for months?
Start with a backup, then work through updates one at a time. Do not try to update everything at once after a long gap because the risk of conflicts is much higher. If your site has been neglected for more than six months, a professional audit is a smart investment before updating anything.
Q: Do I need a security plugin?
Yes. A basic security plugin like Wordfence (free version) provides login protection, malware scanning, and a firewall. It is not optional for a business website. The free tier is sufficient for most small business sites.
Q: How often should I back up my site?
Daily if your site changes frequently (blog posts, WooCommerce orders). Weekly if your site is mostly static. The backup should include both files and the database, and it should be stored off-site (not on the same server as your website).
Q: What is the most important thing on this checklist?
Backups. Everything else on this list can be fixed if something goes wrong. But without a backup, a catastrophic failure (hack, server crash, accidental deletion) means starting over from scratch.
Q: How much does professional monthly maintenance cost?
Our monthly support plan is $300 per month. That covers everything on this checklist plus small fixes and priority support. For most businesses, it costs less per year than the emergency fixes they would need without maintenance.