Website Maintenance Checklist for MSP and Tech Company Sites

My website maintenance checklist for an MSP: weekly update and backup checks, monthly form, speed, and Search Console reviews, quarterly access audits, and a named owner on every task.

Ask who owns the website. Go on, try it at Monday’s leadership meeting. Somebody studies the table. Somebody says “Dave, I think?” and Dave left in March.

Nobody’s to blame, it’s just how these things go. The site isn’t a ticket, nobody bills for it, and it runs fine right up to the afternoon it doesn’t, so it slides to the bottom of every list. Pipeline gets reviewed. Delivery gets a queue. The website gets guilt.

I ask three questions about any part of a business, always in the same order: is there a cadence, is there an owner, is there a number? Company websites flunk all three more often than not, which stings when you sell patching, backup verification, and access reviews for a living. Same job, different front door.

So here’s the list. It’s sorted by how often each job runs, and it has a column for the name you still have to fill in.

The Website Maintenance Checklist at a Glance

Website maintenance is the recurring work that keeps a live site secure, fast, and working. That means applying updates, proving a backup can be restored, testing the forms that bring in leads, reviewing who has access, and checking speed and accessibility. Think operations, not redesign, and expect it to need a calendar and a named owner.

Read the owner column first. A task with a blank there won’t get done. It gets discovered, usually by a prospect, usually at the worst time.

Weekly Website Maintenance: The Ten-Minute Checks

Weekly work is small on purpose, call it ten or fifteen minutes on the same day by the same person, and please don’t schedule a meeting about it.

Updates first. WordPress ships a Site Health screen that flags plugins waiting on updates, an outdated PHP version, and background updates that have stopped working, sorted by how serious each one is, so open it before anything else on Monday. The documentation points out that plugins have deep access to your site, which is a polite way of saying one forgotten plugin can sink the whole thing.

Security fixes go on fast. Feature releases can sit until you’ve read what changed, and if the site feeds a CRM (HubSpot, say, or your PSA) or runs custom forms, try the update on a staging copy first. If it’s a plain brochure site with nothing connected, I’d stop overthinking it.

Then look at last night’s backup. I don’t mean whether backups are switched on, because everyone says yes to that. I mean whether one ran, finished, and landed somewhere other than the server the site lives on.

An untested backup is a hope. You already tell clients that, so tell yourself.

One more. Put an uptime monitor on the site, UptimeRobot or whatever your stack already uses, and send its alerts to a phone you carry. A shared inbox that three people each assume someone else is watching will fail you on the one night it matters, and it will do it politely.

Monthly Website Maintenance: Where the Hour Goes

Monthly is where the real checking happens. Budget an hour, maybe two, for a simple brochure site (the first month will run longer because you’ll find things), and start with the forms.

Submit every one. Fill it in like a stranger would, then chase the lead all the way down the line. Did it land in the CRM? Did a human get pinged? Did the autoresponder go out, and did the thank-you page even load? (Yes, check the one buried in the footer that nobody has touched since the last redesign.) All of them.

A broken form doesn’t throw an error, it just goes quiet, and quiet looks exactly like a slow month. Picture a 25-person MSP whose quote form stopped delivering after a plugin update in March: leads thin out, the owner blames the market, sales blames marketing, and in late April someone submits the form to see what happens and gets nothing back. That’s hypothetical, but the mechanism is real. More leads won’t fix a form that swallows them.

Then Search Console. Google’s Search Console documentation suggests looking about once a month, or after you change the site. Three reports earn the visit. Indexing lists pages with errors or ones excluded from Search, Security Issues warns when Google thinks the site may have been hacked, and Manual Actions tells you whether some or all of your site might not show up in results. Google emails you when it finds something new, so make sure that address belongs to a human being.

Speed gets measured against a standard, not a feeling. The web.dev guidance on Core Web Vitals calls a page good when its largest element loads within 2.5 seconds, interaction to next paint comes in at 200 milliseconds or less, and layout shift stays at 0.1 or under, all judged at the 75th percentile of page loads across mobile and desktop.

Search Console’s Core Web Vitals report shows how real visitors are doing against those numbers. If one slips, ask what changed last month. A new plugin? A bigger hero image? A widget someone embedded on a Friday afternoon?

Quarterly Checks: Access, Accessibility, and a Restore Test

Quarterly work takes an afternoon, and it starts with access.

List everyone who can log in: WordPress admins, the hosting account, the domain registrar, analytics, the form tool, the CRM connection. Remove the contractor from 2023. Remove the agency you fired. Switch on two-factor authentication anywhere it’s offered, because you would never leave a departed technician’s credentials live on a client network, and the same standard ought to apply to the site that carries your own name.

Next, the restore test. Spin up a staging site, restore the latest backup into it, and time the whole thing from start to finish. Something will be missing. It always is. Better to find out on a quiet Tuesday than during an outage with a prospect waiting on a proposal link.

Then prune. Site Health lists inactive plugins and themes, and its documentation recommends deleting themes you don’t plan to use, which I’d stretch to plugins, since every unused one is a door you forgot to lock. Delete them.

Last comes the accessibility spot check. The Department of Justice says the ADA’s requirements apply to the goods, services, privileges, or activities a business offers the public, and its web accessibility guidance, dated March 18, 2022, adds that no regulation sets detailed web standards while existing technical standards give helpful guidance. The usual one is the Web Content Accessibility Guidelines (WCAG). I’m not a lawyer and this isn’t legal advice, so ask counsel what applies to you. The spot check is plainer than the law around it:

• Tab through the menu and every form without touching the mouse.
• Is body text readable against its background?
• Any image added since last quarter needs real alt text.
• Video gets captions.

Annual and As-Needed Work

Once a year, put the renewals on the owner’s calendar: domain, hosting, certificates. Not in the inbox of someone who left. When a domain lapses it takes your email down with the website, and that is an ugly morning.

Look at the PHP version while you’re there, since Site Health flags an old one, and do the upgrade on staging first, because a PHP jump that breaks a theme or a form plugin is exactly the kind of surprise a maintenance calendar exists to schedule out of your week.

Then read the whole site the way a buyer would, front to back and slowly. Is the team page current? Does it still sell something you stopped selling? Are the phone number, address, and copyright year right? Someone weighing a six-figure engagement reads exactly those details, and our guide to E-E-A-T for MSP websites covers the bios, proof, and trust signals worth checking on the same pass.

A few jobs have no date. After a redesign, a host move, a new plugin, or an employee with site access walking out the door, run the monthly list that same week.

Who Owns Each Task

Write a person in the owner column. A team name doesn’t count, since teams don’t own anything.

Founders end up as the bottleneck wherever work has no owner, and the website is no different. When the answer to “who handles that?” is “whoever built it,” the honest answer is nobody. I want systems replacing individual dependency here the same way they should in sales and delivery.

Then measure it. Add one line to your monthly operating review (forms tested, backup restored, access reviewed, yes or no) and watch how fast things start happening. Tracked work gets done. Untracked work is a guess.

For a simple site, plan on an hour or two a month and half a day each quarter. That’s my planning estimate, not a study, although the vendor checklists I read while researching this landed in the same range. Add time for e-commerce, a client portal, or heavy custom integrations.

What This Checklist Leaves Out

Everything above keeps the lights on, which is not the same as making the site better.

Crawl settings, schema, robots.txt, and AI crawler access all sit in the technical SEO checklist. Layout, messaging, and conversion work belong on the design side, which we cover in our guide to MSP website design. Keep the jobs apart, because whoever patches your plugins is rarely the person who should be rewriting your homepage.

Where to Start

Pick the three jobs you’ve never done. For many owners that’s the restore test, the form test, and the access review. Do those this week. Today, ideally. Then put the rest on a calendar with names attached.

C4 Solutions is a growth partner for MSPs and technology companies, based in Irvine, California. If you want help turning this list into a standing cadence, book a growth strategy call.

Book a Growth Strategy Call