A website rarely breaks in one dramatic moment. It decays quietly: a plugin falls behind, a contact form stops sending, a domain renewal email lands in an old inbox. This website maintenance checklist splits the work into weekly, monthly, quarterly and yearly tasks, explains how to test that your backups actually restore, and shows who should own each job, so nothing depends on someone remembering.
In short:
- Weekly: test your forms and WhatsApp button, confirm last night's backup exists, and check for pending updates.
- Monthly: apply and test updates, review Search Console, fix broken links, check speed on mobile and refresh outdated content.
- Quarterly: restore a backup to a test copy of the site. A backup you have never restored is only a hope.
- Yearly: domain, hosting, SSL and licence renewals, a review of your privacy policy and terms, and an honest look at whether the site still fits the business.
- Write down who owns each task. Most maintenance failures happen in the gap between the owner, the developer and the host.
In this guide
What website maintenance actually covers
Website maintenance is everything that keeps a live site safe, working and accurate after launch day. It is not redesign and it is not marketing, although it supports both. For a typical business site on WordPress, the work falls into six areas:
- Software: WordPress itself, the theme and every plugin, plus the PHP version on the server.
- Safety nets: backups, restore tests, security scans and user accounts.
- Function: forms, WhatsApp and call buttons, maps, booking or checkout flows, and the emails they send.
- Performance and visibility: speed on mobile, broken links, and the health reports in Google Search Console.
- Content: prices, services, opening hours, contact details and anything else that goes out of date.
- Renewals and records: the domain, hosting, SSL certificate, paid licences and your legal pages.
The first weeks after a launch have their own routine, which we cover in what to do after your website launches. This guide is about the long run: the rhythm that keeps a site healthy in its second, third and fifth year. If your site is not live yet, start with the website launch checklist and come back here afterwards.
How much time does it take? For a ten-page brochure site, the weekly tasks take around half an hour and the monthly ones an hour or two. An online store or booking site needs more, because every update has more ways to break something.
Weekly website maintenance tasks
The weekly list is about catching failures early. None of these tasks is technical; a business owner or office manager can do all of them from a phone and a laptop.
| Task | How to do it | What a problem looks like |
|---|---|---|
| Open the key pages on your phone | Home, your main service page and the contact page, in Arabic and in English if the site is bilingual | Missing images, overlapping text, an error message, a page that takes many seconds to appear |
| Send a test enquiry through every form | Fill the form as a customer would and check that the email arrives in the right inbox | No email, an email in spam, or a "thank you" message that never appears |
| Tap the WhatsApp and call buttons | Check they open the correct number, with the pre-filled message if you use one | An old number, a broken link, or a button hidden behind another element on small screens |
| Confirm the latest backup exists | Look at the backup log in your dashboard or hosting panel: date, time and size | No backup for several days, or a backup far smaller than usual |
| Check for pending updates | Dashboard > Updates in WordPress | Several plugins waiting, especially ones marked as security releases |
| Read any alert emails | Uptime monitor, hosting provider and Google Search Console messages | Downtime alerts, new indexing errors, a security warning |
The form test matters more than it looks. A broken contact form does not announce itself: visitors simply leave, and you notice weeks later that enquiries "slowed down". If your form emails often land in spam, the cause is usually the sending setup rather than the form itself; our guide to business email with your own domain explains the records that fix deliverability.
An uptime monitor is worth setting up once. Many services check your site every few minutes and alert you when it stops responding, so you hear about downtime before your customers do.
Monthly tasks: updates, Search Console, speed and content
Once a month, set aside a fixed slot, for example the first Sunday morning, and work through these steps in order. The order matters: you back up before you update, and you test after.
Take a fresh backup, then update
WordPress applies minor and security releases of its core automatically on most hosting, but major versions, themes and plugins usually wait for you. WordPress.org advises backing up before you update, so you can restore if something goes wrong. Update plugins in small groups rather than all at once, so that if the site breaks you know which update caused it.
Test the site after updating
Repeat the weekly checks: key pages on mobile, every form, the WhatsApp button, and, if you have them, the booking calendar or checkout. Clear any caching plugin so you see the current version, not a stored copy.
Review Google Search Console
Google suggests checking Search Console around once a month, or after you change your content. Look at four places: Performance (are clicks and impressions stable?), Page indexing (new errors or pages dropping out?), Core Web Vitals, and Security issues and Manual actions, which should both be empty. Google also emails you when it detects a new problem, so make sure those emails reach someone who reads them.
Fix broken links
Run a link checker over the site, or check the "Not found (404)" list in the Page indexing report. Broken links usually come from deleted pages, renamed services or partners who changed their own sites. Either fix the link or redirect the old address to the closest live page.
Check speed on mobile
Test your home page and main service page in PageSpeed Insights and compare with last month. Google's web.dev defines good Core Web Vitals as a Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of real visits. A sudden drop usually has a simple cause: a new uncompressed image, a new plugin, or a chat or tracking script someone added. See why website speed drives sales for the fixes that matter most.
Review users and plugins
Remove accounts for staff or contractors who no longer need access, and give everyone else the lowest role that lets them do their job; an employee who writes news posts does not need Administrator. Deactivate and delete plugins and themes you no longer use, because inactive code can still contain vulnerabilities.
Refresh content that goes stale
Read your prices, offers, service list, opening hours and contact details as if you were a new customer. Before Ramadan and the Eid holidays, update working hours on the site and on your Google Business Profile at the same time, and remove seasonal banners once the season is over. Our guide to Google Business Profile in Saudi Arabia explains why the two should always match.
Look at what visitors did
In your analytics, note three numbers each month: visits, enquiries (form submissions, WhatsApp clicks and calls) and the top five pages. You are not looking for perfection, only for change. If visits are steady but enquiries fall, something on the path to contact has broken or stopped convincing people.
Quarterly tasks: deeper checks
Every three months, go one level deeper. These tasks take longer and some need a developer, but they catch problems the monthly routine cannot see.
- Restore test. Restore a recent backup to a staging copy and confirm it works. The next section explains how.
- Plugin health review. For each plugin, check when it was last updated and whether it is still maintained. A plugin that has not been updated in a long time, or has been withdrawn from the WordPress plugin directory, should be replaced before it becomes a security problem.
- Server software. Ask your host, or check the hosting panel, which PHP version the site runs on. Old PHP versions stop receiving security fixes, and newer versions are usually faster. Test the switch on staging first.
- Full journey test. Go beyond the form. Follow each path a customer can take: from a Google result to a service page to an enquiry; from the English home page to the Arabic one and back; from a product page to payment if you sell online. Check the confirmation emails and auto-replies customers receive, in both languages.
- Real devices. Test on at least one iPhone and one Android phone, not only a desktop browser's mobile view. Pay attention to right-to-left layout on Arabic pages: icons pointing the wrong way, mixed Arabic and English lines, and phone numbers that flip order.
- Accessibility spot check. Tab through a page with the keyboard, confirm images have useful alt text, and check that text is readable against its background. The website accessibility checklist lists the essentials.
- Access audit. List who can log in to the hosting account, the domain registrar, DNS, business email and the WordPress dashboard. Change shared passwords if someone with access has left, and turn on two-factor authentication where the service offers it.
- Content audit. Find pages and blog posts that are thin, outdated or describe services you no longer offer. Update them, merge them into a stronger page, or remove them and redirect the address.
A website maintenance checklist only works if it has dates on it and a name next to each task.
Yearly tasks: renewals, legal pages and the big picture
The yearly list protects the things that are hardest to recover if they lapse. Put each date in a shared calendar with a reminder a month ahead, not in one person's head.
Domain, hosting and SSL
- Confirm the domain's expiry date, turn on auto-renewal and make sure the payment card on file is still valid.
- Check that the domain is registered in your company's name and that the contact email is one you still read. Renewal and transfer notices go to that address.
- Review the hosting renewal price. Introductory prices often rise sharply at the first renewal, and a plan that suited a five-page site may not suit the site you have now.
- Check the SSL certificate's expiry date in your browser's padlock menu. Most hosts renew free certificates automatically, but automation fails silently when DNS settings change.
- Renew licences for premium themes and plugins, or replace them. When a licence lapses, its updates stop, and an un-updated plugin is a risk.
If you are unsure where your domain, hosting and email are registered, our domain, hosting and email service can untangle the setup and put everything in your name.
Legal and business details
Read your privacy policy, terms and refund policy against what the site actually does today. Did you add a booking form, a chat widget, analytics or a newsletter this year? Each one changes what personal data you collect and who receives it, and your privacy policy should say so in line with Saudi Arabia's Personal Data Protection Law. Also check that your commercial registration details, VAT number and physical address are current wherever you display them. The PDPL website compliance checklist and our overview of Saudi website legal requirements cover the details; for advice on your specific situation, consult a qualified legal adviser.
The annual review
Once a year, step back from the checklist and ask bigger questions. Does the site still describe what the business sells today? Do the photos show your current premises, products and work? Did the site bring enquiries this year, and which pages brought them? Are competitors' sites now easier to use on a phone than yours? Small gaps can be fixed with new pages and edits; if the answers point to a structural problem, the website redesign checklist explains how to rebuild without losing rankings. Finish by saving a full backup outside the hosting account as a year-end archive.
Backups and restore tests: the step most sites skip
Almost every hosting plan advertises backups. Far fewer site owners have ever checked that one of those backups brings the site back. A backup has to answer four questions: what is in it, how often it runs, where copies live, and whether it restores.
What a complete backup contains
A WordPress site lives in two places: the files (WordPress core, the theme, plugins, uploaded images and the configuration file) and the database (pages, posts, settings, form entries, orders). WordPress.org's backup documentation is clear that you need both to fully restore a site. A backup tool that saves only the files, or only the database, leaves you with half a website.
How often, and where
The same documentation suggests weekly backups for smaller sites and daily backups for busy ones, and a backup before every upgrade. For a business site, daily automated backups are a sensible default, because the database changes every time a customer submits a form or places an order. WordPress.org also recommends keeping several recent backups in different places, for example on the host, in cloud storage and on a local computer. The reason is simple: a backup stored only on the same server as the site disappears with it if the hosting account is suspended, hacked or closed.
How to run a restore test
- Pick a recent backup, not the one you made five minutes ago. You want to test what the automatic schedule produces.
- Restore it to a staging site or a temporary subdomain, never over the live site. Many hosts offer one-click staging; a developer can set one up otherwise.
- Open the restored copy and check the home page, a few inner pages, images, the latest blog post and the most recent form entries or orders.
- Log in to the dashboard of the copy to confirm users and settings came through.
- Note how long the restore took and any manual steps it needed. That is your real recovery time.
- Delete the staging copy or block it from search engines, so Google does not index a duplicate of your site.
A worked example
Picture a training centre in Riyadh whose site takes course registrations through a form plugin. On a Thursday evening, an automatic plugin update conflicts with the theme, and the registration page shows a blank space where the form used to be. With a restore-tested nightly backup, the fix is routine: roll back to Wednesday night's copy and hold the update until the conflict is resolved. Without one, the evening becomes a weekend of rebuilding while would-be students register elsewhere.
Who does what: owner, developer and host
Most maintenance problems are not technical. They happen because the owner assumes the developer is updating the site, the developer assumes the host is taking backups, and the host assumes the owner is handling renewals. Agree the split in writing. A common, workable division looks like this:
| Task | Business owner | Developer or maintenance provider | Hosting company |
|---|---|---|---|
| Software updates | Approves timing for big changes | Applies and tests updates | Keeps the server and PHP versions available |
| Backups | Knows where they are and how to ask for a restore | Configures off-site copies, runs restore tests | Provides server-level backups |
| Security | Uses strong passwords and two-factor login | Scans, hardens, cleans up after an incident | Network protection and server security |
| Forms and buttons | Weekly test enquiry | Fixes faults and email delivery | Mail server reliability |
| Content accuracy | Owns prices, hours, services, photos | Publishes changes on request | None |
| Search Console and speed | Reads the monthly summary | Investigates errors and slow pages | Server response time |
| Renewals | Pays and keeps contact details current | Reminds and checks SSL | Renews the hosting plan and certificates it manages |
| Legal pages | Confirms what data the business collects | Updates the pages and cookie or consent tools | None |
Even if you hand everything to a provider, keep a short "site record" that you control: where the domain is registered and when it expires, where the site is hosted, who has administrator access, where backups are stored, and who to call when something breaks. If your provider disappears, that one page is what lets someone else take over.
What skipping maintenance really costs
The cost of neglect is rarely a single large bill. It is a series of quiet losses that are hard to trace back to their cause. These are the ones business owners most often discover too late:
Enquiries that never arrive
A form that stopped sending after an update, or a WhatsApp button pointing to an old number, loses customers silently. You see fewer leads, not an error message.
A hacked site
Outdated plugins are a common way in. Google's Search Console flags sites that may have been hacked or could harm visitors, and a clean-up, plus restoring trust, costs far more than the updates would have.
An expired domain
When a domain lapses, the website and the email on it stop working together. If it is not renewed in time, the name can be lost to someone else.
Wrong information
Old prices, discontinued services or last year's opening hours lead to awkward calls and lost trust. Customers rarely complain; they just choose someone whose details look current.
A slower, weaker site
Unoptimised images, piled-up plugins and old server software slow pages down over time. Visitors on mobile data notice before you do.
Expensive emergencies
Skipped updates pile up until one big jump breaks the site. Urgent fixes under pressure cost more than routine work done on schedule.
There is also a visibility cost. Google's Manual Actions report warns that when a manual action applies to a site, some or all of it may not be shown in search results. Spam injected into a hacked site is one route to that outcome. Routine maintenance will not guarantee rankings, and nobody can, but it removes the technical problems that pull a site down. For the positive side of search visibility, see how to get found on Google.
If something breaks: the first hour
- Note what you see, when it started and what changed just before: an update, a new plugin, an edit, a DNS change. Take screenshots.
- Check whether the problem is the whole site or one page, and whether it happens on another device and network.
- Contact whoever owns maintenance with that information. If you manage the site yourself, check your host's status page and error logs.
- If an update caused it, roll that update back or restore the last good backup. If you suspect a hack, change the passwords for the dashboard, hosting and email first.
- While the site is being fixed, point customers to WhatsApp or your phone number on your Google Business Profile and social accounts.
- Afterwards, write one line in your site record: what happened, the cause and what will prevent it next time.
Website maintenance at Webnaa
Webnaa is a Riyadh-based website design service serving businesses across Saudi Arabia. On our website subscription, most of this website maintenance checklist is our job, not yours. Prices start from SAR 39 a month, paid every 6 months or yearly at 10% off, with no setup fee and no long contract, and on a WordPress site (for example SAR 324 a month for 5 pages in two languages), the website design service includes:
- Security and technical updates, backups and fixing technical faults, at no extra charge.
- Technical support included in the subscription, plus answers to your questions about the site. You edit the site yourself from the dashboard.
- Hosting, SSL and a standard domain registered in your name, so the renewals on the yearly list are covered.
- A fast, mobile-friendly WordPress site in Arabic, English or both, connected to Google Search Console with a sitemap.
- A ready privacy policy and terms, an enquiry form, WhatsApp button, map and direct call number.
What stays with you is what only you know: telling us when prices, services or hours change, and sending the occasional test enquiry. A new page after launch is priced as in the calculator and added to your subscription, and new features such as online booking or payments are priced in writing before any work starts. From the second year you pay the monthly base only. You can cancel renewal at any time with no cancellation fee. Buying the website is optional: the website value plus a 30% independence fee, with a year of hosting and the domain in your name; if you buy it, we move it to accounts in your name with the first year of care included, then you go fully independent at no fee or choose the optional yearly care plan. Work out your own price in the price calculator.
Choose what you need, see your exact price
The price updates with every choice. No surprises, no hidden fees.
The calculator is off. Press the power button to start
From Zoho, a global provider with data centres in Riyadh and Jeddah. More than 10 addresses are quoted separately.
Already have a website built elsewhere? Our website maintenance service takes over updates, backups, security and fixes for existing sites, priced by written quote after we review the site.
Hand the checklist to someone who does it every week
Tell us about your site and we will send a written scope and price for keeping it updated, backed up and working.
FAQ
What should a website maintenance checklist include?
At minimum: software updates, backups and restore tests, security checks, form and button tests, broken link fixes, speed checks, content updates, Search Console reviews, domain and SSL renewals, and a yearly review of your legal pages. The useful part is the schedule: what happens weekly, monthly, quarterly and yearly, and who does it.
How often should I update WordPress plugins?
Check for updates weekly and apply them at least monthly, after a backup. Security releases should be applied as soon as practical. Update in small groups and test the site afterwards so you can tell which update caused any problem.
How often should I back up my website?
WordPress.org suggests weekly for smaller sites and daily for busy ones, plus a backup before every upgrade. For a business site that receives enquiries or orders, daily automated backups stored in more than one place are a sensible default. Test a restore at least every few months.
Can I maintain my website myself?
Yes, for many tasks. Testing forms, updating content, reading Search Console and tracking renewals need no technical skills. Updates on a complex site, restore tests, security clean-ups and server changes are where a developer or maintenance provider saves time and risk.
How much does website maintenance cost in Saudi Arabia?
It depends on the site's size, platform and how much is included, such as edits, hack clean-up and reporting. Ask for a written scope before comparing prices. Webnaa's prices start from SAR 39 a month, and on a WordPress site (SAR 324 a month for 5 pages in two languages), updates, backups and fixes are included and you edit the site yourself from the dashboard; maintenance for sites built elsewhere is quoted in writing.
Does website maintenance improve SEO?
Indirectly. It fixes problems that hold a site back, such as broken links, slow pages, indexing errors and security warnings, and it keeps content accurate. It cannot guarantee rankings; nobody can.
Summary
A good website maintenance checklist is short, dated and owned. Each week, test the forms and buttons and confirm a backup ran. Each month, back up, update, test, then review Search Console, links, speed and content. Each quarter, restore a backup to a test copy and audit plugins, access and devices. Each year, renew the domain, hosting, SSL and licences, review your legal pages and ask whether the site still fits the business. Write down who owns every task, and keep a site record you control. Do that, and most website emergencies become routine fixes.
Sources: WordPress.org: WordPress backups, WordPress.org: Updating WordPress, Google Search Central: Get started with Search Console, web.dev: Web Vitals. Webnaa: website maintenance, pricing.