15 Website Maintenance Checks for a UK Business

Website maintenance is the work that keeps an online service accurate, usable and recoverable after launch. It includes software, content, accounts, forms and supplier dependencies. A site can look unchanged while a contact mailbox stops receiving submissions or an expired licence prevents an important update.

Assign an owner to each task and keep a short maintenance log. Prioritise security fixes and blocked customer journeys promptly; use a planned schedule for the rest. The fifteen checks below cover distinct responsibilities, including both controlled performance tests and longer-term real-user trends.

1. Keep a repeatable performance baseline

Select representative pages and record a controlled test with the URL, date, location, device profile and cache state. Include a service or product page, an article and the main enquiry or purchase route. Compare later runs under the same conditions.

Use the report to identify causes such as oversized images or delayed server responses. A score is a diagnostic aid rather than an objective for its own sake. Keep the actual report so another person can review the evidence behind an optimisation.

2. Check internal and external links

Crawl public pages and examine broken links, failed resources and unexpected redirects. Update links to moved content directly. Redirect an old URL when a genuinely relevant replacement exists; sending every missing page to the homepage can confuse visitors.

Review important external references and embedded resources too. A third-party page can disappear without a change to your own CMS. Keep a useful error page for genuinely missing content and verify that it returns the appropriate status rather than disguising a failure as success.

3. Maintain core software, themes and extensions

Review update notifications, compatibility requirements and release notes. Apply urgent fixes through a controlled process, with a restorable backup and checks afterwards. Complex or transaction-heavy sites should test significant changes in a protected staging environment.

Remove abandoned components after checking their data and dependencies. WordPress documents its update methods; the hosting provider and site owner should agree which party maintains which layers. Paying for hosting does not automatically assign every application update to the host.

4. Verify backups and restoration

Check that scheduled backups actually complete and include the required files, database and configuration. Keep recovery copies sufficiently independent of the live system and protect them with appropriate access controls. An archive stored only beside the website can be lost in the same incident.

Restore a recent backup into a separate environment and test it. Set the frequency around the amount of data the business can afford to lose, rather than applying an arbitrary weekly schedule to every shop, publication and brochure site.

5. Review security and account access

Audit administrator accounts, remove access that is no longer needed and use unique credentials with stronger authentication where supported. Review suspicious login activity, unexpected files and relevant alerts. Keep certificate and domain renewal ownership visible.

The NCSC small-organisations guide covers accounts, devices, email and backups. Security tools can assist, but a scan or HTTPS padlock is not a guarantee that the application and its data are safe.

6. Correct outdated content

Review service descriptions, prices, opening hours, staff details and contact routes. Update an article when its instructions or facts have materially changed, and retain historical context for genuine news. Do not change dates merely to make old material appear newly researched.

Check shared components as well as individual pages. A discontinued product can remain in a footer, sidebar advert or comparison table even after the main sales page changes. Record the source and review date for time-sensitive commercial claims.

7. Test mobile layouts and enlarged text

Check narrow widths, landscape orientation, longer headings and browser zoom. Open menus, dialogs and forms on a real phone. Make sure floating notices and chat controls do not cover important actions or trap visitors when the keyboard opens.

Preserve useful content on mobile rather than hiding difficult sections. Tables need an understandable small-screen treatment, and buttons need enough space to operate. Test the important inner pages, not only the homepage.

8. Complete forms and business features

Submit a genuine test enquiry and verify delivery, stored records and confirmation. Test validation failures, password resets, booking selections and relevant file uploads. Remove test personal data according to the site's normal process.

For a shop, use the payment provider's supported test arrangement and check stock, delivery, order status and confirmation. A button click or HTTP 200 response alone does not prove the business process completed successfully.

9. Review useful audience and outcome data

Track outcomes that matter, such as qualified enquiries or paid orders, and distinguish them from spam and duplicates. Review failed searches and repeated exits from important tasks. Combine numbers with customer feedback and observation.

Check that measurement tools collect only what is appropriate and that settings still match the published explanation. A newly installed marketing integration can change data collection without an obvious visual change to the page.

10. Check supported browsers and accessibility

Test key journeys in a sensible set of browsers based on your audience, including keyboard operation and visible focus. Review headings, labels, contrast, image descriptions and error handling. Automated tools find some issues but do not replace human checks.

Keep browser-specific defects reproducible with the URL, version and steps. Re-test shared components after fixes, because changing a navigation or form pattern can affect many pages at once.

11. Review new images and media

Check recent uploads for oversized originals, unsuitable crops and missing dimensions. Use appropriate formats and responsive variants, preserving a separate master where needed. Verify that actual screenshots remain legible and accurately captioned.

Review image permissions and alternative text in context. A decorative photograph and an instructional screenshot have different purposes. Avoid repeating a generic image simply to fill every available design slot.

12. Revisit UK legal and privacy requirements

Keep the site's privacy information, business details and relevant terms aligned with its actual activities. Review new forms, advertising, processors and tracking technologies. The ICO's current storage and access guidance includes purpose-specific exceptions and conditions; do not assume a generic banner configures compliance.

Public-sector bodies have specific website and app accessibility requirements described by GOV.UK. Other organisations should assess the duties applicable to their service rather than copying a public-sector statement unchanged.

13. Monitor availability and route alerts

Configure checks for important public endpoints and define what counts as success. Add transaction or content checks where a homepage probe would miss a failure. Test alert delivery and identify both the primary responder and a backup.

Record incidents with start and end observations, affected functions and the remedy. Monitor results describe what was checked at particular intervals; avoid presenting them as proof that every user experienced uninterrupted service.

14. Review field loading and interaction trends

Alongside repeatable lab tests, inspect available real-user Core Web Vitals and patterns by page type. Field data can reveal slow devices or interactions that a clean development machine misses. Allow for its collection period when assessing a recent fix.

Compare trends with releases, traffic changes and content additions. Do not treat a missing field dataset as a pass, and investigate whether the issue is loading, interaction delay or layout movement before choosing a solution.

15. Perform a broader annual audit

Review content structure, permissions, supplier contracts, licence ownership, recovery arrangements and the platform's suitability. Confirm that the organisation controls its domain, hosting, analytics and important integrations. Check what would happen if an agency or key employee left.

Use the audit to retire duplicate content and obsolete code deliberately, with backups and regression checks. Plan capacity changes from measured demand. Compare hosting resources when necessary, while keeping application maintenance responsibilities explicit.

Turn the checklist into a schedule

A quiet brochure site and a busy shop need different intervals. Automate availability checks and backup reporting, review urgent alerts promptly, and schedule content, access and usability reviews around actual change. Repeat affected checks after releases rather than waiting for the calendar.

Keep the log short: task, date, finding, action, owner and next review. Maintenance becomes dependable when a named person can see what passed, what failed and what remains open. A long checklist without ownership is much less useful than a smaller routine that is consistently completed.