Website maintenance retainer checklist: what to do each month and each year

Before the retainer starts

Do these once, and keep the answers in the client file.

• Inventory: domains, subdomains, hosting, DNS provider, registrar, CDN, email provider, payment provider, analytics, third-party scripts.
• Access: who holds each login, with two-factor authentication where possible, stored in a password manager, with a named recovery contact on the client side.
• Ownership: the domain and hosting accounts are in the client’s name or their ownership is documented.
• Baselines: current uptime, page speed, indexed pages, plugin and PHP versions, certificate expiry and domain expiry dates.
• Scope: what is covered (updates, monitoring, backups, small changes), what is billed extra and the response times.
• Contacts: escalation path for incidents, in and out of office hours.
• Backups: where they are, how often, who can restore, and one restore proven to work.

Continuous (automated)

• Uptime checks from outside, with confirmation from a second region (see Two-region confirmation).
• Certificate expiry and replacement alerts (see SSL certificate expiry).
• DNS change detection on the main hostname (see DNS changes that break client sites).
• Search-visibility checks: noindex, robots.txt, canonical (see Noindex after a deploy).
• Domain expiry alerts at 60, 30, 14 and 7 days (see Domain expiry and RDAP).
• Backups running, with a heartbeat on the job (see Heartbeat and cron monitoring).

Weekly

• Read the week’s alerts and incidents. Close or annotate each one.
• Check for security advisories affecting the stack and plugins in use.
• Apply critical security updates, after a backup, preferably on a staging copy first.
• Spot-check key pages and forms: send a test message through the contact form and confirm it arrives.

Monthly

• Updates: core, plugins, themes, libraries. Record versions before and after.
• Backups: confirm they exist and are recent. Download or check one.
• Forms and checkout: run the money journeys by hand, or confirm the scripted tests passed.
• Search console check: coverage errors, manual actions, drops in indexed pages, new crawl errors.
• Speed: run a lab test on the home page and one template; record the result and compare.
• Broken links: run a crawl; fix or redirect.
• Accounts and users: remove users who left; check administrators.
• Expiring items: domains, certificates, paid plugin licences and hosting renewals for the next 90 days. Raise any that need the client’s approval.
• Write the report (see Monthly website care report) and send it.

Quarterly

• Restore test: restore a backup to a staging site and open it. A backup that has never been restored is a hope.
• Staging-to-production parity: check that staging is still blocked from search (noindex or access control) and that production is not.
• Uptime and incident review: count alerts, false alarms and real incidents. Adjust intervals and rules.
• Security review: admin accounts, two-factor, file permissions, unused plugins removed.
• Third-party scripts: remove those no one uses; check each still loads.
• Redirect map: check that important old URLs still reach the right page in one hop (see Redirect chains after a migration).
• Accessibility and content spot-check on the top pages.
• Cost review: hosting, licences and tools against what the site needs.

Yearly

• Domain renewal confirmed, payment method checked.
• Hosting plan and PHP version reviewed against end-of-life dates.
• Full audit: technical SEO, performance, accessibility, security.
• Contract and scope review with the client, with a year of reports as the evidence.
• Disaster recovery drill: a full restore on a new server, timed.
• Legal and policy pages reviewed by the client (privacy, cookies, terms), and the cookie banner checked against what the site really sets.
• Access review: every login, every integration key, every user.

After any change

Every deploy, plugin update, host move or DNS change gets the same quick checks:

1. The site loads over HTTPS from outside, on the home page and one deep page.
2. The certificate is the expected one.
3. Search visibility is intact: no noindex, robots.txt not blocking, canonical on the production host.
4. Forms and checkout work.
5. Monitoring still sees the site, and the alerts reach a person.
6. A line is written in the client log: what changed, who did it, when.

Show the work

Clients cannot see what did not happen. Make it visible:

• Keep a log of every action, with date and who did it.
• Send the monthly report, even in a quiet month.
• Keep the numbers honest: the figure comes from stored checks, and gaps are shown as gaps.
• Raise risks early with cost, deadline and consequence.
• Name prevented problems: “The certificate renewal failed on the 3rd; we fixed it before expiry on the 17th.”

Pricing the retainer

Estimate from the checklist: minutes per task, times frequency, plus a buffer for incidents. Tiers can differ by response time, number of changes included and the depth of the audit. Price the monitoring as a service, because a client who understands what is watched does not ask “what am I paying for?”.

Questions

Sources

Read on 26 October 2026. Standards and vendor pages change; confirm the current text before you rely on it.

• Google Search Central, Block Search indexing with noindex (developers.google.com)
• WordPress Plugin Handbook, Cron (developer.wordpress.org)