Website Maintenance: Monthly and Yearly Tasks

Website maintenance is the recurring work of keeping a live site secure, fast, working and accurate after launch, and the version that protects your search traffic includes regression checks for SEO and schema markup. Most checklists stop at updates and backups. Those matter, but they will not tell you that last Tuesday’s update removed your structured data.

This guide is for owners and marketers who run a site on WordPress or a similar CMS, and for anyone who pays someone else to maintain one. It gives you a calendar, the reasoning behind each cadence, and a short list of checks that catch the quiet failures.

On this page

• What does website maintenance include?
• Weekly tasks
• Monthly website maintenance tasks
• SEO and schema regression checks
• Quarterly and yearly tasks
• Who should own each task?
• Getting your website maintenance routine in place

What does website maintenance include?

Website maintenance includes five jobs: keeping software current, keeping backups you can restore, keeping the site secure, keeping it fast and working, and keeping its content and search signals accurate. The first four are what hosts and agencies sell as “care plans.” The fifth is the one that decides whether the site still earns traffic.

Software means the CMS core, themes, plugins and any server packages. Backups mean copies you have actually tested. Security means access control, scanning and certificates. Speed and function mean forms, checkout, and the Core Web Vitals your visitors experience. Content and search signals mean broken links, redirects, titles, canonicals, sitemaps and schema.

The diagram below lays the whole calendar out in one view. Read it left to right: the cadence gets slower and the work gets more strategic.

Scroll the diagram sideways to see all of it.

Weekly tasks

Weekly tasks are five-minute confirmations that the safety net exists: that the last backup ran, that uptime alerts were quiet, and that nothing in the security log needs a reply. You are not fixing anything yet. You are checking that the monitoring itself is alive.

• Confirm the latest backup completed. A backup plugin that silently failed three weeks ago is the classic surprise.
• Read uptime and security alerts. Set them to email so you are not logging in to find out.
• Submit your own contact form. Check that it arrives, and that the confirmation page still loads.
• Glance at Search Console for new warnings. The Search Console guide covers which reports are worth a weekly look.

Monthly website maintenance tasks

The monthly pass is where updates happen, and the order matters: back up first, update second, test third. WordPress’s own upgrade documentation tells you to verify that your backups are there and usable before upgrading. It also notes that minor core updates are applied automatically by default, while plugin and theme updates are not enabled broadly by default, so someone has to apply those or opt in.

A workable monthly sequence:

1. Back up, then confirm the backup is usable. Download one and check it opens.
2. Update core, themes and plugins on a staging copy if the site earns money. Otherwise update live, one component at a time, so a failure has one suspect.
3. Test the money paths. Forms, checkout, login, booking, search. Test on a phone too.
4. Review speed with field data. Core Web Vitals “good” thresholds, judged at the 75th percentile of page loads, are 2.5 seconds for Largest Contentful Paint, 200 milliseconds for Interaction to Next Paint, and 0.1 for Cumulative Layout Shift. A new plugin is the usual culprit when these slip. Our site speed guide and Core Web Vitals explainer cover the fixes.
5. Run the regression checks below. This is the step most plans leave out.
6. Remove what you do not use. Every inactive plugin is still code you have to keep patched. For the WordPress-specific settings worth reviewing, see WordPress SEO.

SEO and schema regression checks

A regression check compares what the site says to search engines now with what it said before the update. The point is that SEO failures are silent: pages still load, the design looks right, and nothing errors. Traffic simply drops weeks later.

The most common ways an ordinary maintenance task breaks search visibility:

The second row deserves emphasis. Google says robots.txt is not a mechanism for keeping a page out of Google, and that noindex or a password is the right tool. So a staging site blocked only by robots.txt can still get URLs indexed, and a noindex tag that travels to production will remove pages. Which problem you have decides the fix.

The diagram below shows the loop: capture a baseline, make the change, compare, and only then call the task done.

Scroll the diagram sideways to see all of it.

Schema regression, specifically

Structured data fails in three ways after maintenance: it disappears, it duplicates (a plugin and a theme both output it), or it stops matching the page. Google recommends JSON-LD where your setup allows it, suggests the Rich Results Test during development, and warns that pages “may break after deployment due to templating or serving issues.” That warning is the monthly check in one sentence.

Its general structured data guidelines add two rules that maintenance tends to violate: the markup must be a true representation of the visible page, and time-sensitive information must be up to date. A price, event date or opening hours field that was edited on the page but not in the markup is now a mismatch. The same guidelines say a structured data issue does not affect how a page ranks in Google web search. What you lose is rich result eligibility. For how schema feeds AI answers, see structured data for AI search, and for the syntax, JSON-LD.

A practical monthly schema check takes ten minutes: run the Rich Results Test on one URL per template, open the rich result reports in Search Console for new errors, and confirm that prices, hours and dates in the markup match the page.

Quarterly and yearly tasks

Quarterly and yearly tasks are the slow decay checks: things that do not break on a Tuesday but go stale over months. Four times a year, crawl the whole site, restore a backup somewhere harmless, and review which pages actually earn traffic.

Quarterly

• Crawl for broken links and redirect chains. Google’s Page indexing report recommends fixing 404s that you link to yourself or list in a sitemap, and says a removed page with no replacement can be fine. If a page moved, use a 3XX redirect. Our guides on fixing 404 errors and redirects for SEO go deeper.
• Do a test restore. A backup is a hypothesis until you have restored it once.
• Review users and permissions. Remove former staff and agencies, and turn on two-factor authentication where the CMS supports it.
• Check the sitemap against reality. It should list live, indexable URLs only. See XML sitemaps.
• Review the 10 pages with the most search traffic. Stale facts on your best pages cost the most.

Yearly

• Renew domain and hosting, and check who the registered contact is. An expired domain is the most avoidable outage there is.
• Check certificate renewal. Let’s Encrypt certificates are valid for 90 days and the FAQ recommends renewing every 60 days, so renewal must be automated and monitored, not remembered.
• Review legal and privacy pages, cookie banners, and any claims your industry regulates.
• Audit content. Update, merge or remove pages that no longer earn their place. The on-page SEO checklist helps with the update step.
• Decide: patch or rebuild. When maintenance costs keep rising and every update breaks something, a rebuild may be cheaper. If you go that way, plan it around redesign SEO so rankings survive.

The third diagram shows which outcome each layer of maintenance protects, which tells you who needs to be involved.

Scroll the diagram sideways to see all of it.

Who should own each task?

Foundation tasks suit automation or your host, experience tasks suit whoever owns the site’s function, and the top two layers need someone who understands search. A common failure is that the person patching plugins has no idea what a canonical tag is, and the SEO person has no access to the update log.

If you outsource, ask a short list of questions before signing. Does the plan include a test restore? Is there a staging copy? Who checks search signals after an update? Is the report sent to you every month? Be wary of a plan that sells “SEO” but lists only updates and uptime. For the wider list of problems to watch for, see technical SEO issues.

Getting your website maintenance routine in place

Start small: put the weekly checks on a calendar, write down your sample URLs, save a baseline for each template, and run the regression loop on the next update. That is a one-hour setup, and it makes every later task cheaper.

If you would rather hand the build and the upkeep to one team that treats search visibility as part of the job, our web development service is built around that. For a self-service starting point, the technical SEO audit checklist is the baseline to compare against.