A small-business website needs attention on three different clocks: security and software updates on a monthly-or-sooner cycle, content and accuracy checks on a quarterly cycle, and a fuller review of performance, links, and search results roughly once a year. Skipping the fast cycle risks security and uptime problems; skipping the slow cycle lets the site quietly go stale, inaccurate, or hard to find.
“Maintenance” gets treated as one vague task, which is why it is easy to neglect. It is really a short list of specific responsibilities, each with its own frequency and its own consequence for skipping it.
The maintenance schedule at a glance
| Frequency | Task | Risk of skipping it |
|---|---|---|
| Monthly or sooner | Platform, plugin, and dependency security updates. | Known vulnerabilities left open to automated attacks. |
| Monthly or sooner | Backups, verified to actually restore. | No recovery path after a hack, error, or host failure. |
| Monthly | Form and contact-path testing. | Inquiries silently fail to arrive. |
| Quarterly | Content accuracy: hours, pricing, staff, service details. | Visitors and search results show outdated information. |
| Quarterly | Broken-link and 404 check. | Dead ends for visitors and wasted crawl attention. |
| Annually | Performance, Core Web Vitals, and mobile usability review. | Slow, unstable pages that discourage visitors and hurt ranking. |
| Annually | Search Console review: queries, indexing, and errors. | Slow-building visibility problems go unnoticed. |
| Annually | Accessibility and domain/SSL renewal check. | Excluded visitors and, at worst, an expired domain or certificate. |
Security and platform updates
Any website built on a content management system or plugin ecosystem depends on that software staying current. Publicly disclosed vulnerabilities are actively scanned for across the web soon after they become known, which is why security agencies such as CISA treat prompt patching as a baseline defense, not an optional practice. A site that has not been updated in a year is not simply “behind”—it is running software with known, published weaknesses.
HTTPS is part of the same responsibility. Certificates need to stay valid, and the underlying software needs to keep supporting current browser and security requirements. A lapsed certificate is a visible, embarrassing failure that a routine check prevents entirely.
Backups are only useful if they are verified
A backup schedule that has never been tested is a guess, not a safety net. Confirm on a regular basis that a recent backup can actually be restored, and keep at least one copy outside the primary hosting account so a host-level failure cannot take out the site and its backups together.
Content accuracy is a maintenance task, not a launch task
Hours, pricing, service details, staff bios, and policies drift out of date the moment the business changes and nobody updates the site. Outdated information erodes trust quietly—a visitor rarely reports it, they simply stop trusting the page. A short quarterly pass through the highest-traffic pages catches most of this before it accumulates.
This is also the moment to confirm the site still matches its Google Business Profile. The article on how a website and Google Business Profile work together covers why consistency between the two matters for local search.
Broken links and dead ends
Pages get moved, renamed, or removed, and links pointing to them do not update themselves. A quarterly crawl—even a basic automated one—will surface broken internal links, missing images, and dead outbound references. Left alone, these create dead ends for visitors and waste the crawl attention search engines give the site.
Performance and Core Web Vitals
Pages get heavier over time as images, scripts, and embeds accumulate, even without anyone intending to slow the site down. Google’s Core Web Vitals guidance explains the loading, responsiveness, and stability metrics it considers part of a good page experience. An annual check—more often for a site that changes frequently—keeps small additions from quietly compounding into a slow, unstable page.
Search Console: the site’s own status report
Google Search Console reports indexing status, search queries, click performance, and crawl errors directly from Google’s perspective. A business that never checks it is relying on hope instead of evidence. If visibility looks off, the guide to diagnosing missing Google visibility walks through how to read those reports and what each type of problem means.
Accessibility does not stay fixed automatically
New content, images without alternative text, or a new page template can reintroduce accessibility problems even on a site that once passed review. The W3C’s accessibility introduction is a reasonable baseline to check new content against, not just a one-time launch requirement.
Who is actually responsible?
Before launch, assign each task on the schedule above to a specific person or provider—not “someone will handle it.” A workable ownership model usually looks like this:
- Security, backups, and technical updates: a developer or a maintenance plan, since these require technical judgment when something breaks.
- Content accuracy: whoever in the business already knows when hours, pricing, or services change.
- Search and performance review: whoever can act on the findings, whether that is internal or an outside provider.
A site with no assigned owner tends to drift until a visible problem forces a reactive fix—usually at a worse time and higher cost than a scheduled check would have been.
Next step
Write the schedule above into whatever calendar or task system the business already uses, and name an owner for each row. If the business would rather not carry that responsibility internally, Cintavo’s Website Care covers ongoing updates, maintenance, and technical support after launch. Start with a project inquiry describing the current site and what has been slipping.