Picture a shop where nobody tried placing an order on its own website for two months. In that time an automatic update broke the "Place order" button on phones. The ads kept running and visitors kept coming, but orders stopped. By the time the owner noticed, two months of sales were gone.
A website is like a car: it runs well when you buy it, but if you never change the oil or check the tires, it will eventually die on the road. This post covers what monthly maintenance includes, how long each job takes, and why neglect ends up costing more.
Six jobs, every month
1. Updates
The software behind a site (WordPress, the theme, plugins, or libraries if the site is custom built) keeps getting new versions. Many of them patch security holes that attackers already know about. A site that never updates is like a house with a lock the whole neighborhood knows how to open.
The safe way: back up first, update in small groups, open the important pages (home, cart, checkout, contact form), then move to the next group. If the site matters, try the updates on a copy (called staging) before touching the live one. A whole year of updates applied at once often breaks the layout, because the parts that depend on each other have drifted too far apart.
The official WordPress guide to upgrading also tells you to back up first (Updating WordPress).
2. Backups, and a test restore
A backup is a copy of the site and its data, kept somewhere else. But a copy you have never tried to open may not work. Once a month, restore one copy to a separate place and check that the site comes up fully. I wrote about keeping several copies in several places in Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores.
3. Security check
This means: remove admin accounts of people who left, change passwords if you suspect a leak, turn on two step login for admin accounts, remove plugins and themes you no longer use, and look at the login history for anything odd. A fuller list is in the WordPress hardening guide.
One more point: outdated software is on OWASP's list of common risks, in the 2021 edition (Vulnerable and Outdated Components). That means it is a common kind of weakness, not a rare event.
4. Speed check
Run a mobile speed test on the home page and one product page. What you watch is the trend: is this month slower than last month? The cause is usually a newly uploaded heavy image or one extra plugin. Google measures page experience with Core Web Vitals, explained in web.dev's documentation. For why speed matters to revenue, see How a Slow Website Costs You Customers, and a 5-Minute Speed Check.
5. Broken links
A broken link points to a page that was deleted or moved, so the visitor gets "not found". It looks minor, but many of them cost visitors' trust and search engines rate the site lower. Use a link scanner (many are free) and fix or redirect each one. A few dozen minutes a month is enough if you keep at it.
6. Renewals
Write down in one place everything that expires: domain, hosting, the security certificate (the HTTPS padlock in the address bar), paid plugins, business email. Set a reminder three weeks before each date. Free certificates such as Let's Encrypt usually renew themselves, but automatic does not mean it can never fail, so check monthly. General certificate information is in the Let's Encrypt FAQ.
Why neglect costs more
Regular maintenance costs a little each month. Neglect does not make the bill go away; it just piles up and arrives all at once, usually at the worst time.
A site infected with malware has to be cleaned, every password changed, Google asked to remove its warning, and meanwhile customers cannot visit. The cleanup steps are in Website Hacked: How to Spot It and What to Do in the First 24 Hours. A year of updates pushed together can mean rebuilding part of the design. A domain left expired for too long can be bought by someone else. And a slow decline in speed goes unnoticed until revenue drops.
I do not have a single number that fits every site, because every site is different. But the pattern is stable: fixing an incident always costs more than preventing it, and it comes with losses you cannot measure, like lost customers and lost trust.
What a maintenance session looks like
For a small online shop, a monthly session usually takes one to two hours when things are tidy. The order I follow: backup, updates, open the main pages and place a test order, security check, speed test, link scan, then review the renewal calendar. At the end I write a few lines about what was done so next month has something to compare against.
For those who run the site
If you do this yourself, put the jobs above on a checklist with a fixed date (the first of each month, say). Let machines do whatever can be automated: scheduled backups, alerts for security updates, a check every few minutes that the site is up with a message when it is not. People only need to read the results and handle the odd ones.
What to do next
Open your calendar and create a monthly repeating event called "Website maintenance". This month, try all six jobs and note how long they take. If it feels like too much, or nobody on your side is comfortable with it, I can take over the regular maintenance. Message me through phatdev.net and tell me what platform your site runs on, and I will tell you what is needed.
