# What website maintenance does a small business need?

> A small business site needs updates, tested backups, uptime and form checks, and a yearly domain and legal review. Here is a weekly-to-yearly checklist.

By Sotirios Terzis, Ariston Studios — updated 2026-10-10 — https://us.aristonstudios.com/guides/website-maintenance

## Key takeaways
- Most small business sites break or get hacked for boring reasons: outdated plugins or dependencies, an expired domain, a failed certificate renewal, or a contact form that silently stopped sending.
- A backup only counts if you have restored it at least once. Test a restore every quarter.
- Check weekly that your contact form actually delivers to your inbox; it is the failure that costs the most leads and is noticed last.
- WordPress sites need the most hands-on updating; modern framework sites (such as Next.js) need fewer but still need dependency and security updates; hosted builders handle software but not your content, forms or domain.
- A good care plan names what is included, how fast they respond, who owns the backups and domain, and what happens when the site is hacked.

A small business website needs four things on a schedule: software and security updates, backups you have actually tested, monitoring that tells you when the site or its forms stop working, and a yearly check of your domain, legal pages and content. Weekly checks take minutes, monthly ones under an hour, and you can do them yourself or pay someone through a care plan.

## Why do small business websites break or get hacked?

Sites rarely fail because of a dramatic attack aimed at you. They fail because something nobody was watching quietly went out of date.

- **Outdated plugins, themes and dependencies.** Automated bots scan the web for known vulnerabilities in popular software. An unpatched WordPress plugin or an old framework version is an open door. Even modern stacks are affected: in 2025 Next.js published a security fix for a middleware bypass (CVE-2025-29927), and sites only got the fix after someone updated them.
- **An expired domain.** If the renewal payment fails because a card expired, the site and often your email stop working. In the worst case someone else registers the name.
- **An expired SSL certificate.** The certificate is what gives you the padlock and https. If automatic renewal fails, browsers show visitors a full-page security warning.
- **Forms that stop delivering.** A changed email password, a full mailbox or a spam filter can mean enquiries vanish without any error on the site.
- **Hosting changes.** Old PHP versions reach end of life, hosts migrate servers, and something stops working.

## The website maintenance checklist: weekly, monthly, quarterly, yearly

### Weekly (5–10 minutes)

- Send a test enquiry through every form and confirm it reaches the right inbox.
- Check that uptime monitoring has not flagged downtime. An uptime monitor checks your site every few minutes and alerts you when it does not respond.
- Look at your error monitoring, if you have it. Error monitoring (tools like Sentry) records the errors visitors run into, so you hear about a broken page before a customer tells you.
- Install security updates that are flagged as urgent.

### Monthly (30–60 minutes)

- Apply regular updates: CMS core, plugins, themes, or framework dependencies. Check the site afterwards.
- Confirm backups ran and that a recent copy is stored somewhere other than your hosting account.
- Run a speed check with PageSpeed Insights on your home page and one key page. See our [website speed guide](/guides/website-speed) for what the numbers mean.
- Open Google Search Console. Look at the Pages (indexing) report, any manual actions and the Security issues report. Search Console is Google's free tool that shows how Google sees your site and warns you if it detects hacked content.
- Scan for broken links, especially links to booking tools, PDFs and social profiles.

### Quarterly (1–2 hours)

- **Test a restore.** Restore your latest backup to a staging copy or a test environment and check that it works. A backup you have never restored is a hope, not a backup.
- Review who has admin access. Remove former staff, agencies and freelancers. Turn on two-factor login where available.
- Refresh content that dates: opening hours, prices, team members, service descriptions, the year in your footer.
- Check your Google Business Profile matches the site (address, phone, hours). More in our [local SEO guide](/guides/local-seo).

### Yearly

- Confirm the domain is set to auto-renew, the payment card is valid and the registrar account uses an email address you still read.
- Review your privacy policy and cookie notice against what the site actually does now. If you added analytics, a chat widget or embedded videos, the notice must reflect it. In the EU, non-essential cookies need consent before they are set (ePrivacy Directive, Article 5(3)).
- Check that your hosting plan, PHP or Node.js version and any paid licences are still supported.
- Do a full review: does the site still describe what you sell and to whom?

## How does maintenance differ for WordPress, Next.js and hosted builders?

| | WordPress | Modern frameworks (e.g. Next.js) | Hosted builders (Wix, Squarespace, Shopify) |
| --- | --- | --- | --- |
| Software updates | Frequent: core, plugins, themes | Less frequent: framework and package updates by a developer | Done by the platform |
| Main risk | Vulnerable or abandoned plugins | Outdated dependencies, failed builds | Platform lock-in, app add-ons |
| Hosting and SSL | Your host; varies a lot | Usually a managed platform with automatic SSL | Included |
| Backups | You or your host must set them up | Code in version control; content and data still need backups | Limited; check what the platform keeps |
| Who can maintain it | Owner can click "update", but should test after | Needs a developer | Owner |

WordPress can update minor core releases automatically, and since version 5.5 you can switch on auto-updates per plugin and theme. That helps, but an update can still break a page, so check the site after updates run. Modern framework sites have far less attack surface because there is no admin login on the public site and often no database, but someone still has to update dependencies and redeploy. Hosted builders remove the software work, yet your domain, forms, content, Search Console and legal pages are still your job.

## Should you do it yourself or pay for a care plan?

**DIY works** if your site is simple, you are on a hosted builder or a modern framework with few moving parts, and you will genuinely block out an hour a month. Put the checklist above in your calendar.

**A care plan makes sense** if the site brings in leads or sales, runs on WordPress with several plugins, or you know you will not do it. A care plan is a monthly fee for someone to keep the site updated, backed up and monitored.

A good care plan includes:

- Hosting with SSL, domain renewal, and daily backups stored off the server
- Security and software updates, with a check after each update
- Uptime monitoring and a named response time
- A small amount of content changes per month
- A clear answer on what happens, and what it costs, if the site is hacked

Questions to ask before you sign:

1. Who owns the domain, the hosting account and the backups? (The answer should be: you.)
2. When did you last test a restore, and how long does one take?
3. How fast do you respond, and on which days?
4. Is a hack clean-up included, or billed separately?
5. Can I leave at any time and take everything with me?

For a concrete example: Ariston's [care plans](/services) cover hosting with SSL, domain renewal, daily backups, uptime monitoring, and security and software updates, with higher tiers adding monthly content changes, speed and uptime checks, and SEO and analytics reporting. They also cover existing WordPress and Laravel sites. Whoever you choose, compare plans on the list above, not on price alone.

## What should you do if your website is down or hacked?

1. **Confirm it is really down.** Try another device and network. Check your uptime monitor or your host's status page.
2. **Check the boring causes first:** domain expiry, SSL expiry, unpaid hosting invoice.
3. **If it is hacked,** change all passwords (hosting, CMS admins, FTP, registrar) and turn on two-factor login.
4. **Restore from a clean backup** taken before the hack, then update everything that was out of date. Restoring without updating usually means getting hacked again.
5. **Check Google Search Console** for a Security issues warning. Once the whole site is clean, request a review there so Google removes the "This site may be hacked" warning from search results.
6. **Write down what happened** and fix the gap: missing updates, a weak password, an old admin account.

> If you cannot tell whether your site was hacked, Google's guidance is to search site:yourdomain.com and use the URL Inspection tool in Search Console, because hacked pages are sometimes hidden from people but shown to Google.

## Where to start

If you are not sure what state your site is in, run a [free website audit](/audit) for a report on speed, SEO and technical issues, or [get in touch](/contact) if you want someone to take maintenance off your plate.

## Frequently asked questions
### How often should a small business website be updated?
Check for security updates weekly and apply regular updates monthly. WordPress sites with many plugins need the most attention; hosted builders update their own software.

### How often should I back up my website?
Daily backups stored somewhere other than your hosting account are a sensible default for a business site. Test a restore at least once a quarter.

### Does a Next.js or static site need maintenance?
Yes, but less. There is usually no admin login or plugin ecosystem to patch, but the framework and its packages still receive security fixes that someone has to install and deploy.

### What should a website care plan include?
Hosting with SSL, domain renewal, off-site daily backups, security and software updates, uptime monitoring and a stated response time. Ask whether hack clean-up is included and confirm you own the domain and backups.

### How do I know if my website has been hacked?
Watch for a Security issues warning in Google Search Console, strange pages in a site: search, unexpected redirects, or a browser warning. Hacked pages are sometimes only shown to Google, so check with the URL Inspection tool.

## Sources
- [Search Console Help: Security issues report](https://support.google.com/webmasters/answer/9044101)
- [web.dev: How do I know if my site was hacked?](https://web.dev/articles/how-do-i-know-if-my-site-was-hacked)
- [Google Search Central: Get started with Search Console](https://developers.google.com/search/docs/monitor-debug/search-console-start)
- [Google Search Central: Prevent abuse on your site](https://developers.google.com/search/docs/monitor-debug/security)
- [WordPress.org: Plugins and themes auto-updates](https://wordpress.org/documentation/article/plugins-themes-auto-updates/)
- [Next.js: Postmortem on the middleware bypass (CVE-2025-29927)](https://nextjs.org/blog/cve-2025-29927)
- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)