Website maintenance checklist for a small site
A small site needs about half an hour a month and an afternoon a year. Monthly: send a test through every form, read the pages for anything out of date, and glance at traffic. Yearly: renew the domain early, review the legal pages, check who has access, and confirm you can restore an earlier version.
Why small sites go wrong quietly
Sites rarely break all at once. A contact form stops reaching your inbox because a notification address changed. Opening hours on the site drift from the ones on your Google profile. A domain renewal card expires. Nobody notices until a customer says so, or doesn't. A short routine, written down as a website maintenance checklist, catches these before they cost you anything, and most of it needs no technical knowledge.
Every month (about 30 minutes)
- Send a test through every form on the site, from a phone, using an address you don't normally use. Confirm it arrives where it should: your inbox, a Slack channel, a spreadsheet. The contact form test workflow has a fuller version.
- Read the home page and contact page aloud. Hours, prices, phone numbers, staff names, the year in the footer, seasonal offers that have ended.
- Click every link in the navigation and footer, plus any link to a booking page, a menu PDF or a payment link. Outside pages move without telling you.
- Look at traffic for the month. You're not chasing growth here, just checking for a sudden drop to zero, which usually means something broke.
- Clear out form submissions you've dealt with if you keep them in your website's dashboard, and check nothing is waiting unanswered.
- Check the site loads over HTTPS with the padlock, on both the address you use and any old one that should redirect.
Every quarter
- Search for your business name on Google and in Maps. Check the result's title, description, hours and website link. If you use Search Console, look at the Page indexing report for new errors.
- Test on a phone you don't usually use or a narrow browser window. Look for text that overflows, buttons hidden behind banners and images that load slowly.
- Update one thing that shows you're active: a new photo, a recent project, a refreshed FAQ answer from questions customers actually asked.
- Check connected tools. If forms feed a CRM, spreadsheet or newsletter tool, confirm the last few entries arrived and the connection hasn't expired.
Every year
| Task | What to check | Why it matters |
|---|---|---|
| Domain renewal | Expiry date, auto-renew on, card on file still valid, contact email still read | An expired domain takes the site and your email down, and the name can be bought by someone else |
| Legal pages | Privacy policy matches the forms, tools and analytics you use now | New tools mean new data flows to describe |
| Data you keep | How long form submissions are kept; delete what you no longer need | Keeping less is safer and simpler to explain |
| Access | Who can sign in to the site, domain, email and connected tools; remove former staff and freelancers | Old accounts are a common way in |
| Two-factor sign-in | On for every account that can read customer data | A leaked password alone shouldn't be enough |
| Restore test | That you can find and restore an earlier version | Backups you've never tried are a hope, not a plan |
| Content audit | Pages nobody visits, services you no longer offer, outdated photos | Old pages confuse visitors and search engines |
The domain renewal checklist and annual website review go deeper on the first and last rows.
What Anticode does and what stays with you
- Handled for you
- The last ten published versions of each site are backed up. File hashes are recorded when you publish and a scan checks them, reaching each site about once a day. Sites are served over HTTPS. Each site has a security report at
/.well-known/anticode-security, worked out from the published pages. - Tools to use in the routine
- Version history keeps saved versions you can preview and restore. Analytics show page views per site per day by source, without cookies. Each project can set how long submissions are kept with Keep submissions, after which they're deleted automatically, and the submissions access log lists the last 200 reads, exports and deletes.
- Still yours
- Testing forms end to end, the accuracy of every fact on the page, renewing a domain you registered elsewhere, reviewing the generated privacy policy and terms (a starting point, not legal advice), and removing people who no longer need access.
One Anticode-specific check: Anticode doesn't email visitors who book, and the generated booking thank-you and FAQ text mention a confirmation email. Read that wording during your monthly pass and make sure it matches how you actually confirm.
Common mistakes
- Treating launch as the finish. The first month after launch is when most broken links and wrong details turn up.
- Testing forms from the owner's own account or browser, where autofill and saved sessions hide problems.
- Letting one person hold every password. Keep shared access in a password manager the business controls.
- Big redesigns instead of small fixes. A yearly content audit usually beats a rebuild every three years.
Limits of a checklist
This routine suits brochure sites, booking pages and small shops using payment links. A site with user accounts, a database or custom code also needs dependency updates, server patching and security monitoring, which is a developer's job rather than a monthly checklist. For what to do if something does go wrong, see rolling back to a previous version.
Questions people ask
How often should a small website be updated?
Facts should be corrected the day they change. Beyond that, a small update each quarter is enough to show the business is active.
What does website maintenance cost?
For a hosted site built with a website builder, mostly your time plus the domain renewal. Paying someone makes sense when you'd rather not do the monthly checks yourself.
What's the single most important task?
Testing that forms still reach you. A broken form loses enquiries silently, and you won't hear about it from the people it failed.