Website maintenance is the routine work that keeps your site safe, fast and working: updates, backups, security checks, speed checks and content fixes. Most of it is small, but skipping it for a year is how sites get hacked, slow down or quietly stop sending enquiries.
Here is a checklist split by how often each task should be done. It is written for WordPress sites, which is what most Malaysian SMEs use, but most items apply to any website.
Every week
- Check the site loads. Open the homepage and one or two key pages on your phone.
- Test the contact form. Send a test enquiry and confirm it reaches the right inbox. A broken form is one of the most common and most costly problems, because nobody notices until sales drop.
- Check your backups ran. Most backup plugins or hosting panels show the date of the last backup.
Every month
- Update WordPress, themes and plugins. Updates fix security holes. Take a backup first, update, then check the site still looks right.
- Remove plugins you do not use. Every inactive plugin is one more thing to update and one more possible security risk.
- Review user accounts. Remove staff who have left and freelancers who no longer need access.
- Check Google Search Console. Look for new errors under Pages and any security or manual action warnings.
- Look for broken links. A broken link checker plugin or Search Console will show pages returning errors.
- Scan for malware. Use your security plugin or your host’s scanner.
Every quarter
- Test page speed. Run your homepage and a key service page through Google PageSpeed Insights, on mobile. Our guide to Core Web Vitals explains what the scores mean.
- Restore a backup to test it. A backup you have never tested may not work when you need it. Restore to a staging site if your host offers one.
- Review your content. Update prices, staff names, office hours, phone numbers and any dates that have passed.
- Check mobile layout. Look at your main pages on an actual phone, not just a resized browser.
- Check your forms and WhatsApp buttons. Make sure every call-to-action goes to the right person.
Every year
- Renew the domain and SSL certificate. Check the expiry dates and who pays. A lapsed domain takes your website and email offline.
- Review your hosting plan. Is the site getting slower as it grows? Is your storage close to full?
- Change important passwords. Hosting, domain registrar, WordPress admin and email.
- Review your privacy policy. If you collect personal data through forms, your policy should explain how it is used, in line with the Personal Data Protection Act 2010.
- Audit your plugins and theme. Replace any that are no longer updated by their developers.
- Check your Google Business Profile. Confirm the address, phone number, hours and website link are still correct.
The backup rule of thumb
Keep at least three copies of your site: the live site, a backup stored by your host, and a backup stored somewhere else, such as cloud storage. If your host has a problem, a backup kept only with that host may be lost with it. We cover the steps in how to back up your WordPress website.
Signs your site needs attention now
- It suddenly loads slowly
- Google Chrome shows a “Not secure” warning
- Strange pages or links appear that you did not add
- You stop receiving form enquiries
- Search Console reports a security issue
Any of these is worth checking the same day.
Do it yourself or hire someone?
If you are comfortable with WordPress, the weekly and monthly tasks take about an hour a month. The risk is in updates that break the layout, and in security problems that need technical skill to clean up.
Many businesses keep content updates in-house and hand updates, backups and security to a maintenance provider. For typical price ranges, see our breakdown of website maintenance cost in Malaysia. If you would rather not manage the checklist yourself, our website maintenance service covers it.
Frequently Asked Questions
How often should a website be maintained?
Check the basics weekly, update and scan monthly, test speed and backups quarterly, and renew and review accounts yearly.
What happens if I do not maintain my website?
Outdated plugins can be exploited by hackers, the site can slow down, forms can stop working without anyone noticing, and a lapsed domain can take the site offline.
How long does website maintenance take each month?
For a small WordPress site, the routine tasks take about an hour a month. Fixing problems such as a hacked site or a broken update can take much longer.
Do I need to back up my website if my host already does?
Yes. Keep at least one backup outside your hosting account, so you can recover even if the host has a problem.
Should I update WordPress plugins automatically?
Automatic updates are convenient for minor security releases. For major updates, take a backup first and check the site afterwards, because some updates can break layouts.
