Websites do not stay fast and safe on their own. Here is the weekly, monthly, quarterly and yearly checklist we use, and what skipping it really costs.
A website is closer to a company truck than a brochure. It works hard every day, and if nobody changes the oil, it eventually breaks down at the worst moment. This website maintenance checklist is the routine we use to keep small business sites fast, secure and working, broken down into weekly, monthly, quarterly and annual tasks.
We will also look at what neglect actually costs, what a reasonable website maintenance cost looks like in Calgary, and how to decide between doing it yourself and handing it off.
WordPress runs 40.2% of all websites, according to W3Techs, and 58.7% of sites with a known content management system. That popularity is great for choice and cost. It also makes WordPress the most targeted platform on the web, because one working exploit can hit thousands of sites at once.
The numbers keep climbing. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024. High-severity vulnerabilities more than doubled, up 113% year over year.
WordPress core is well maintained. Patchstack recorded only 6 core vulnerabilities in 2025. The problem is everything bolted on: 91% of vulnerabilities were in plugins and 9% in themes. On the small business sites we audit, 15 to 30 plugins is common, and each one is a separate piece of software written by a separate team with its own update habits.
Worse, 46% of vulnerabilities did not have a patch available when they were disclosed. That means "just update" is not always enough. Sometimes the right move is to remove a plugin and replace it.
Most owners think of a hack as a dramatic event: a defaced homepage, a ransom note. In reality, the damage is usually quieter and more expensive.
Sucuri's 2023 Hacked Website and Malware Threat Report found SEO spam on 42.22% of the infected sites it cleaned. That is the kind of hack where your site looks normal to you, but Google sees pages selling knock-off products or pharmaceuticals. Rankings drop, Google may show a warning, and you only find out when the phone stops ringing.
The same report found at least one backdoor on 49.21% of compromised sites. A backdoor lets the attacker come back after you think you have cleaned up. That is why a "quick fix" by deleting the obvious bad file often fails within weeks.
Then there is the slow cost. Sites get heavier over time. The 2025 Web Almanac puts the median mobile page at 2,559 KB, and much of the bloat on small sites comes from photos uploaded at full size and scripts nobody remembers adding. Without a routine, a fast launch-day site can feel sluggish within two years. Our post on how site speed quietly costs you customers shows what that does to leads.
Here is the schedule we follow. It assumes a typical WordPress site for a service business with a contact form, a few service pages and maybe a blog. Custom-coded sites need less plugin work but the same backups, monitoring and content checks.
| Frequency | Task | Why it matters | Time |
|---|---|---|---|
| Weekly | Apply security updates to plugins, themes and core | Exploits arrive within hours of disclosure | 10 to 15 min |
| Weekly | Confirm the latest backup completed | A backup that silently failed is no backup | 2 min |
| Weekly | Glance at uptime alerts and form submissions | Catch outages and broken forms early | 3 min |
| Monthly | Apply feature updates after testing on staging | Avoid layout breaks on major releases | 30 min |
| Monthly | Run PageSpeed Insights on your top 3 pages | Catch speed regressions early | 10 min |
| Monthly | Send a test enquiry through every form | Forms break quietly after updates | 10 min |
| Monthly | Review users and remove old accounts | Old logins are an easy way in | 5 min |
| Quarterly | Restore a backup to a staging site | The only way to know backups work | 45 min |
| Quarterly | Audit plugins: remove unused, replace abandoned | Fewer plugins means fewer holes | 30 min |
| Quarterly | Check for broken links and 404 errors | Protects user trust and SEO | 20 min |
| Quarterly | Review Google Search Console for errors and security issues | Google tells you about hacks first | 15 min |
| Annually | Renew domain and SSL, check contact details | Expired domains take sites offline | 15 min |
| Annually | Review hosting plan and PHP version | Old PHP is slower and unsupported | 30 min |
| Annually | Content refresh: prices, team, hours, service areas | Out-of-date info costs trust | 2 to 4 hrs |
| Annually | Accessibility and mobile spot-check | Standards and devices change | 1 hr |
With a 5 hour median time to exploit, weekly is the minimum for security updates, and we apply critical patches the same day. If you do this yourself, pick a fixed time, such as Monday morning before the phones get busy. Check that last night's backup actually finished before you update anything.
Updates can break things in ways you will not notice by looking at the homepage. A booking widget that stops loading, a quote form that sends to an old inbox, a mobile menu that will not open. Once a month, act like a customer: fill out every form, tap the phone number on your phone, and load your top pages.
This is the step almost everyone skips. A backup is only useful if you can restore it. The Canadian Centre for Cyber Security tells organizations to routinely test that restores work, and to follow the 3-2-1 rule: three copies of your data, on two different types of media, with one copy kept off site. For a website, that usually means your live site, a host backup, and an off-site copy in separate cloud storage.
Once a year, step back. Is the hosting still right for your traffic? Is the server running a current PHP version? Do the service pages still describe what you sell? Did you add Okotoks to your service area but forget to mention it on the site? An annual review is also a good time to decide whether the site needs a refresh. Our guide to small business website hosting covers how to judge whether your host is still pulling its weight.
Updates scare people because they have been burned before. Here is how we keep them boring.
The Canadian Centre for Cyber Security's top measures for small and medium organizations puts patching near the top of its list and recommends activating automatic updates where possible. It also recommends multi-factor authentication wherever it is available, which for most sites means the admin login. That is a five-minute change worth making today.
Maintenance is not expensive compared to the cost of a hacked or broken site. The real question is whether your time is better spent on it or on running your business.
| Do it yourself | Maintenance plan | |
|---|---|---|
| Direct cost | $0, plus any premium plugin licences | Ours is $80 CAD per month |
| Your time | About 2 to 3 hours a month if done properly | Near zero |
| Update testing | You, on staging if you set it up | Done by the developer before going live |
| Backups | Depends on host; off-site copy is up to you | Daily, off site, restore-tested |
| Uptime monitoring | Free tools, alerts go to you | Monitored, we respond |
| When something breaks | Search forums or hire someone at short notice | Small fixes included, larger work at $135 CAD per hour |
| Best for | Owners who enjoy it and have the time | Owners who want to forget about it |
DIY works if you are disciplined. A bookkeeper in Kensington who likes tinkering and actually blocks out Monday mornings can keep a simple site healthy. The risk is drift: after a busy Stampede season or a hectic winter of furnace calls, the checklist slides, and three months of updates pile up.
If you would rather hand it off, our website maintenance service covers updates, daily off-site backups, uptime monitoring and small fixes for $80 CAD per month. For how maintenance fits into the total cost of owning a site, see how much a small business website should cost in 2026.
Not all plans are equal. Be cautious if a provider:
Maintenance and security overlap so much that we treat them as one habit. Updates close known holes, backups give you a way back, monitoring tells you something is wrong, and user reviews keep old accounts from becoming entry points. Sucuri found malicious admin users in 55.2% of the infected WordPress databases it cleaned, which is exactly what a monthly user review catches.
For a full look at how small business sites get hacked and how to harden yours, read our guide to website security for small businesses.
Check for plugin, theme and core updates at least weekly, and apply security updates as soon as they are released. Patchstack's 2026 report found the weighted median time to first exploit was about 5 hours after disclosure, so waiting a month is a real risk.
It ranges from doing it yourself for free to several hundred dollars a month for agency retainers. Our maintenance package is $80 CAD per month and covers updates, backups, monitoring and small fixes. Larger jobs are billed at $135 CAD per hour.
Usually not on their own. Host backups often sit on the same infrastructure as your site and may only be kept for a few days. The Canadian Centre for Cyber Security recommends the 3-2-1 rule: three copies, on two types of media, with one off site.
For minor core releases and well-maintained plugins, yes. For major updates to your page builder, ecommerce or booking plugins, test on a staging copy first. Automatic updates plus a daily backup is a sensible middle ground for most small sites.
The site keeps working until it does not. Outdated plugins are a leading way small sites get hacked, and speed slowly degrades as content and scripts pile up. Sucuri found 39.1% of CMS installs it cleaned in 2023 were outdated at the point of infection.
Not sure when your site was last updated, or whether your backups would actually restore? Book a free 15-minute call and we will go over your plugin and core versions, backups, speed and security basics with you, then give you a clear list of what needs attention. If you already know you would rather hand it off, ask us about the $80 CAD per month maintenance package.
Dimitri runs Clear Pixel, a Calgary web studio building fast, clean websites for small businesses across North America.
Tell us about the project. We’ll map out scope, timeline, and a fixed price. No pressure, no obligation.