Website Maintenance Planner

How the plan is scaled

The planner gives each site a care level from your answers. It weighs what happens if the site is down for a day, whether it takes orders, bookings or sign-ins, and how busy it is. A brochure site that brings in a few enquiries gets a light plan: weekly backups, monthly updates and quarterly restore tests. A shop on its own server gets daily backups, weekly updates and server patches, monthly restore tests and a yearly security review. Platform matters too:

• WordPress and other CMSs: plugin, theme and core updates, and database clean-up. WordPress applies minor and security releases automatically on most sites; plugins, themes and major releases need someone to update them, after a backup.
• Shopify and hosted builders: the platform runs the hosting and software, so the plan focuses on apps, the theme, content, access and the domain. Shopify suggests CSV exports, theme downloads or a backup app for backups.
• Custom applications: framework and library updates, database checks and, on a VPS or cloud server, operating system patches.
• Static sites: fewer moving parts. Keep the source in version control and keep the build tools up to date.

Backups you can actually restore

The plan follows the 3-2-1 rule that CISA describes: three copies of your data, on two different types of storage, with one copy offsite. A backup only counts if it restores. The NCSC advises knowing how to restore your data and checking the backup contains everything important. That is why every plan includes a restore test, monthly for critical sites and quarterly for the rest.

Speed, certificates and domains

• Core Web Vitals: once a month, check your key pages against Google’s targets. web.dev gives them as LCP within 2.5 seconds, INP of 200 milliseconds or less and CLS of 0.1 or less, at the 75th percentile of page loads. Our website speed test runs the check for you.
• TLS (SSL) certificates: lifetimes are shrinking. Let’s Encrypt certificates last 90 days, and the CA/Browser Forum has agreed to reduce the maximum for public certificates to 47 days by March 2029. Renewal must be automatic; the plan adds a quarterly check that it works.
• Domains: a lapsed domain takes your website and email offline. Once a year, check automatic renewal, the payment method and the contact email.

Who does what

Each task names who should do it, based on who looks after the site. Content and admin jobs can stay with the business: content reviews, test enquiries, domain renewal and access reviews. Technical jobs need someone confident with them: updates, restore tests and server patches. If nobody technical is named, the plan says so at the top. Access reviews include two-step verification for every admin account; our guide to multi-factor authentication explains why.

Using the plan

Fix the gaps listed first, then print the schedule (“Print or save as PDF”) and pin it where the team will see it, or download it as Markdown for your task tracker. Moving host or platform soon? Work through the website migration checklist first. If you would rather hand it over, our website team and IT support and cloud team offer ongoing maintenance.