Most "website maintenance" retainers are a vague monthly invoice with no defined scope, which is exactly why disputes happen six months in when a client asks "what have you actually been doing?" This checklist breaks maintenance into the specific, verifiable tasks that should be happening on a schedule, so you can either run the checks yourself, hand them to an internal team, or use them to hold an agency accountable for a retainer you're already paying for.
Why a checklist instead of a generic "maintenance plan"
A maintenance plan sold as a flat monthly fee with no task list is unverifiable by design - you can't tell if you're paying for two hours of real work or twenty minutes of a bot running an automated scan. A checklist fixes that by making every recurring task explicit: what it is, how often it runs, what tool or log proves it happened, and what the failure mode looks like if it's skipped. If a vendor can't map their retainer against a list like this, that's a scope problem worth raising before renewal.
Weekly tasks
Core, plugin and theme updates
On WordPress, WooCommerce, or any CMS with a plugin ecosystem, unpatched components are the single most common entry point for compromise. Weekly checks should cover: available core updates, plugin/theme updates, and a diff of what changed in the changelog before applying anything to a production site with active checkout or lead forms. Staging-first updates matter more on stores and membership sites than on brochure sites - a broken checkout after an update is a revenue event, not a cosmetic bug.
Backup verification (not just backup creation)
A backup job that silently fails for three weeks is worse than no backup job, because it creates false confidence. The checklist item isn't "backups are running" - it's "a backup from this week was actually restored to a staging environment and confirmed intact." Off-site storage (S3, a separate host, or a dedicated backup service) matters because a compromised server can take its own local backups down with it.
Uptime and error monitoring
Uptime monitors (checking every 1-5 minutes) catch outages; server/application error logs catch the slower-burning problems - PHP fatal errors, 500s on specific pages, API timeouts to a CRM or payment gateway. Weekly log review catches issues before customers report them.
Monthly tasks
Security scanning and firewall rule review
Malware scanning (file integrity checks against known-good hashes), open port review, and SSL certificate expiry checks belong here. For sites behind a WAF (Cloudflare, Sucuri, Wordfence), monthly review of blocked-request logs tells you what's actually being attempted against the site - useful both for security posture and for justifying (or cutting) firewall spend.
Form and integration testing
Contact forms, quote request forms, newsletter signups and checkout flows break silently more often than people assume - a plugin update changes a hook, an SMTP credential expires, a CRM API key rotates. Monthly testing means actually submitting each form end-to-end and confirming the notification email, CRM record, or Slack alert arrives, not just checking that the form renders on the page.
Speed and Core Web Vitals check
Run PageSpeed Insights or a similar tool against key pages (home, a product/service page, a blog post) monthly, not just at launch. Image weight creep from new content, an added tracking script, or a font-loading regression are the usual causes of a slow drift downward in LCP and CLS scores over time.
Quarterly tasks
Content audit and stale page review
Pricing pages with old figures, team pages listing people who've left, blog posts referencing deprecated product features - these erode trust and, for anything E-E-A-T sensitive (health, finance, legal content), can affect how Google evaluates the page. A quarterly pass through analytics for pages with rising bounce rate or falling rankings flags what needs a rewrite versus a redirect versus deletion.
SEO and search visibility health
Quarterly checks: crawl errors in Search Console, broken internal/external links, duplicate title tags, orphaned pages with no internal links pointing to them, and a review of any pages that dropped out of the index. This is distinct from active SEO strategy work - it's the housekeeping that keeps existing rankings from decaying due to neglect.
Dependency and hosting review
PHP version support windows, database engine end-of-life dates, and whether the hosting plan still matches actual traffic and resource usage. A site outgrowing shared hosting shows up here before it shows up as a downtime incident during a traffic spike.
What to have ready before comparing maintenance proposals
- An inventory of what's actually installed: CMS version, plugin/theme list, third-party integrations (CRM, payment gateway, email service), and who has admin access.
- Current backup setup - where, how often, and whether it's ever been test-restored.
- Traffic and revenue dependency on the site, so response-time expectations for an outage are realistic (a lead-gen site and an e-commerce store have very different urgency profiles).
- A record of past incidents - hacks, downtime, broken forms - since recurring issues in one area justify heavier monitoring there specifically.
Comparing proposals against this checklist
When a maintenance quote comes in, map each line item against the weekly/monthly/quarterly tasks above. A cheap retainer that only covers "updates" and nothing else is not comparable to one that includes backup verification, form testing and quarterly SEO audits - the price difference should reflect that scope difference, not just margin. Ask specifically what reporting is provided: a monthly summary with what was updated, what was found in scans, and what forms/backups were verified is a reasonable deliverable to expect in writing.
How Urgent IT Solution approaches ongoing maintenance
Our maintenance work is scoped against a checklist like this rather than sold as an undefined flat fee - clients get visibility into what's checked weekly versus quarterly, and a monthly report that documents updates applied, backups verified, forms tested, and any security or performance findings. For sites we didn't originally build, the first step is always an audit against this list to establish a baseline before quoting an ongoing plan, since inherited technical debt (outdated plugins, unverified backups, broken integrations) needs to be fixed once before it can be maintained on a predictable schedule.