Key takeaways
- Website maintenance is the regular upkeep that keeps a site safe, working and up to date.
- The main jobs are updates, backups, security, checking the site still works, and renewals.
- On WordPress, minor security releases install on their own by default. Plugins and themes usually don’t.
- A backup you haven’t tested is a guess. Keep copies somewhere other than the website itself.
- You can do it yourself with a simple routine, or have someone do it for you.
What is website maintenance?
Website maintenance is the regular upkeep that keeps your website safe, working and up to date. It covers updates, backups, security, checking that the site still does its job, and renewing the things that expire.
Say a plumber in Capalaba had a site built a few years ago and nobody has logged in since. It looks fine. Then a customer rings to say the quote form never worked. A site that’s left alone can go wrong without telling you.
Updates
A WordPress site has three parts that need updating: WordPress itself, your plugins and your theme. WordPress’s own documentation says older versions aren’t maintained with security updates, and that you should keep up to date with the latest version.
WordPress does some of this for you. For existing sites it installs minor releases, which are the maintenance and security ones, by default. Major releases don’t install automatically on an existing site unless someone turns that on. Plugins and themes aren’t updated automatically in general either. That’s where sites tend to get left behind.
Updates can occasionally break something. WordPress’s guidance is to take a backup before you upgrade, so you can go back if it goes wrong. Have a look at the site afterwards too.
Backups
WordPress says there are two parts to back up: the database and the files. Backing up only the files misses the database, which holds your pages and posts.
- How often. WordPress’s guide says smaller sites with fewer posts can back up weekly, and busier sites daily. Always back up before an upgrade.
- Where. Keep copies in separate places, such as your hosting, cloud storage and your own computer. A backup that lives only on the same server as the site goes down with it.
- Check them. The Australian Cyber Security Centre says to test the whole backup, not a spot check, so you know you can recover. WordPress suggests taking a manual backup now and then, even if you have automatic ones, to make sure the process is working.
Security
Most of this is housekeeping:
- Use long, unique passwords and turn on two-factor login where you can.
- Delete plugins you’re not using. WordPress’s hardening guide says to delete a plugin from the system if you’re not using it.
- Remove people who no longer need access.
- Check Security Issues in Google Search Console now and then. It lists problems Google has found with your site.
If something does go wrong, here’s what to do first if your website has been hacked.
Checking it still works
Updates and backups don’t tell you the site is doing its job. Check these:
- The site loads, on a phone as well as a computer.
- Your phone number is right and tapping it starts a call.
- The contact form sends. Fill it in yourself and see if the email arrives.
- Important pages and links aren’t broken.
- It loads quickly. Google’s Core Web Vitals aim for the main content to appear within 2.5 seconds of the page starting to load, a page that responds to taps and clicks in 200 milliseconds or less, and little jumping around as it loads. The Core Web Vitals report in Search Console shows how your pages are going.
Renewals
Some things expire. Your domain name needs renewing. So does your hosting. Your SSL certificate, which is what makes your address start with https, also has an expiry date, although many hosts renew it for you. Our guide to SSL certificates explains it. If a domain lapses, your website and your business email can stop working. Domain name vs web hosting covers who looks after what.
A simple routine for a small site
- Every week: log in, check for updates and install them, then look at the site. Send yourself a test enquiry through the contact form.
- Every month: confirm a recent backup exists and you can get at it. Check Search Console for any messages. Click through the main pages on your phone.
- Every year: check when your domain, hosting and certificate renew, and that the phone number, hours and service areas on the site are still right.
Do it yourself or hand it over?
You can do all of this yourself if you’re comfortable in the WordPress dashboard and you’ll actually do it. Most business owners would rather be on the tools, and the jobs get skipped when work is busy.
Our website care plans run the updates, backups and health checks every day on our own servers, log every change, and give you one person to call. We look after WordPress sites we didn’t build too, once we’ve checked them over. There’s no lock-in contract.
Questions people ask
What does website maintenance include?
Updates to WordPress, plugins and your theme, backups, security housekeeping, checks that the site and its forms still work, and renewals for your domain, hosting and certificate.
Does WordPress update itself?
Partly. Minor releases, which include maintenance and security updates, install automatically by default on existing sites. Major releases, plugins and themes generally don’t.
How often should I back up my website?
WordPress’s guide says smaller sites with fewer posts can back up weekly and busier sites daily, and that you should always back up before an upgrade.
Do I still need maintenance if I never change my website?
Yes. The software behind the site keeps ageing even if the content doesn’t change, and WordPress says older versions aren’t maintained with security updates.
Not sure what shape your site is in? Ask for a free website check and we’ll tell you what we can see. If you’d rather have it looked after every day, have a look at our website care plans.