Website Maintenance Checklist Monthly: The 6 Checks We Run
Six checks, about twenty minutes, once a month: that is the whole routine. It covers what we watch on live sites after launch, why the list is shorter than launch day, and what this month’s run caught on eight domains.
Why the website maintenance checklist monthly is shorter than launch day
Launch day earns its eleven checks: both domain forms over HTTPS, the certificate, the sitemap, form delivery, a phone pass through every page, and the rest we wrote up in the launch checklist. Those run once because the site is about to face its first visitors, and everything is new.
A month later the site is not new. Only a handful of things drift on their own: the certificate, the sitemap, the backups, the disk, the form, and the way one page redirects to another. The copy, the layout, the image weights, change only when you change them. So the list watches only the parts that move without you.
This month’s run, on 2 October 2026, caught a demo domain serving a dead sitemap, an error page standing in for the real thing. Every certificate we manage sits inside a 60-day renewal window, the tightest at 43 days. Disk on our host sat at 29 percent, nothing to act on, but that is the number that becomes an outage when nobody writes it down.
1. Certificate expiry dates, on the calendar
HTTPS certificates last about 90 days, and renewal is supposed to be automatic. The monthly check finds out whether the automation is actually running.
We pulled the expiry date on all eight certificates we manage. Six are Let’s Encrypt certs with 66 to 77 days left. One is a Google Trust Services cert on agents.d2p.site with 43 days left, the tightest in the set; the media host’s sits at 76 days. All eight are inside the window where a renewal has already been issued, so the pass is green. The tightest number is why the check exists: 43 days is shorter than the gap between two monthly checks, so only a dated record would catch a renewal that had been skipped twice.
The calendar matters because the old safety net is gone. Let’s Encrypt ended its expiration email service on 4 June 2025: enough subscribers had reliable renewal automation in place that the reminders no longer earned their cost. If you kept a calendar entry on expiry, it is now the only expiry notification that exists. We read the notAfter date off each certificate once a month and write it next to last month’s. Dates shrinking month over month is the earliest warning you will get.
2. The sitemap, fetched like a crawler would
A sitemap is the list of pages you hand to search engines. When it rots, you can rank for a page you deleted and miss the one you added.
One fetch, done properly: follow redirects, and read the size as well as the status code. On our three client-facing domains this month, warasat.com.pk returned a 10,318-byte sitemap, mtufaildiagnosticcenter.com returned 3,473 bytes, and truckaxic.com returned 2,954 bytes. All three healthy. The same fetch without redirects shows why the detail matters: truckaxic answers 308 and redirects to its canonical form, so a bare status check would have shown you the redirect, not the file behind it.
The caught failure of the month sits on our own domains: the agents demo site and the media host both answered 404 on their sitemap paths, the media one with a 153-byte error page. Neither has an indexable public page set, but a dead sitemap URL survives a year if nobody looks, and on a content site it means new pages quietly staying out of the index.
One rule worth knowing while you are in there: Google’s Search Central documentation, on the page Build and Submit a Sitemap as crawled on 2 October 2026, states that Google ignores the priority and changefreq values, and uses lastmod only when it is consistently and verifiably accurate. A hand-maintained date someone edits out of politeness gets ignored. If your generator stamps real change dates, keep them; if not, leave the field out rather than fake it.
3. Backups you can restore, not just backups you have
Most backup routines look fine because they produce files every night. The only test that means anything is a restore, and once a month is the right frequency for it, because the failure you are hunting is silent.
We run our sites on Coolify, which takes database snapshots on a schedule, and our monthly test is deliberately small: pick a real record, a form submission from last month, restore the snapshot into a scratch container, and read the record back. It checks the whole chain at once: the snapshot schedule, the storage, the restore path. Last month’s test passed. The month it fails, you learn the backup has been broken for weeks while there is still time to fix the routine.
When it matters: a clinic’s enquiry form fails silently mid-month. Patient notes say bookings were attempted; the inbox has nothing. The database says otherwise, and only a real backup habit proves it. A backup you have never restored is a hope with a filename.
4. Disk space before it becomes an outage
Disks never fill in a day. Old logs, container images and uploads grow a few megabytes at a time, and the day they cross the line nothing can be written, which on a database-backed site means downtime.
The monthly check is one line, and this month’s disk reading on our host came back 26 GB used of 91 GB. That is 29 percent, no action needed. The value is not this month’s number, it is the trend: a used figure climbing ten points in a month means something is leaking. Write the percentage next to last month’s, same as the certificate dates.
5. One form submission, end to end
The backup check proves the database can be read. The form check proves the road into it still works.
Once a month we submit the real form the way a visitor would: fill it on the phone, send it, confirm the submission lands in the inbox or the database and the confirmation screen shows. It is the check our maintenance and support service runs on client sites on a schedule. On the sites that earn their keep, like the quote form on truckaxic.com, the form is the business.
It catches the failures nothing else does: a rotated mail password, a webhook returning 500, a spam filter eating your test email. The restore test and the form test together cover both directions of the visitor’s pipeline: reaching you, and being remembered.
6. Redirects and the http:// address
The smallest check, and the only one overlapping the certificate pass. Every address a visitor or crawler might use, the plain http:// form, the www form, an old page address from before a redesign, should land on the right page over HTTPS.
For us it is a no-op this month, folded into the certificate step: the sitemap fetches already followed redirects, and all three client domains answered 308 to their canonical https:// address. The check earns its place anyway, because the day it stops being a no-op is the day a redesigned page loses an old address. A visitor hitting a 404 where the page used to be does not read the error. If a page moved, redirect it; if it died, redirect it to the closest living page. Ten minutes more? Run the checks in the padlock article, on what the browser’s padlock does and does not tell a visitor.
What we do not re-check monthly
Page speed, Lighthouse scores, image weights, heading structure. Those run at launch and after any redesign, because they measure things that change only when someone changes the site. Re-running them monthly finds nothing, and a checklist that finds nothing twice gets skipped by month three. This list stays at six checks because every one has produced at least one catch.
Uptime belongs to neither list, because it should never be checked manually: an automated monitor watches it continuously, as we wrote in the uptime monitoring piece.
The whole list
Once a month, on a date you will not forget:
| Check | What green looks like |
|---|---|
| Certificate expiry | Every cert renews within 60 days, dates written down next to last month’s |
| Sitemap fetch | 200, following redirects, byte size noted; no error page standing in for the file |
| Backup restore | One real record restored from the snapshot into a scratch container |
| Disk space | Used percentage written down, next to last month’s |
| Form test | One real submission lands in the inbox or database, confirmation shows |
| Redirects | http:// and old page addresses land on their canonical https:// pages |
The two checks that matter most are the two that prove something works: the restore and the form submission. If the list sits on your desk three months running, hand it to someone whose job it is; our maintenance and support service runs it for clients, and the contact page is where that conversation starts.
FAQ
How often should a small business website be maintained?
Run the six checks above once a month. They are deliberately lightweight: no tools beyond a browser and a terminal, and about twenty minutes. Deeper reviews, page speed and accessibility passes, belong at launch and after redesigns, not every month, because they measure things that change only when the site is changed.
What happens if my SSL certificate expires?
Visitors get a full-page security warning before they see any content, and most leave. The site keeps working underneath, but the browser will not show it until the warning is dismissed. Since renewal is normally automatic, an expiry means the automation stopped, so treat the expiry date on your calendar as the verification that the automation is alive, not a reminder to renew by hand.
Do I need a maintenance plan for a small website?
You need the six checks to happen, whoever does them. A small site has the same certificate, form and backup risks as a large one, and fewer people watching. If you can put a recurring slot on the calendar and actually keep it, do it yourself; if the list has been skipped two months running, hand it off.
How do I check if my website sitemap is working?
Fetch https://yourdomain.com/sitemap.xml in a browser and read what comes back. It should be an XML page listing your URLs, not an error page. Follow the redirect if the address moves, then compare the URL list against the live site: deleted pages still listed, or new pages missing, means it is stale.