The monthly website checklist most small businesses skip
Most small business websites get a burst of attention at launch and then very little. The site goes live, the agency invoice is paid, and for the next two years the only changes are a new phone number and the Christmas opening hours. Meanwhile the software underneath keeps moving. WordPress, which runs a large share of small business sites, ships updates to its core, and every plugin and theme on the site has its own release schedule on top of that.
Nothing looks wrong while this happens, which is why it gets skipped. The contact form still sends, the homepage still loads. The problems show up later and all at once: a plugin that hasn’t been updated in a year is used to inject spam links, the site slows down until Google starts ranking it lower, or the hosting company upgrades PHP and the homepage turns into an error message on a Monday morning.
The fix is boring. It is about an hour of work a month, done every month. Here is what goes into that hour.
1. Update the core, plugins and theme, in that order of caution
Security patches for WordPress core are safe to apply straight away. Plugin and theme updates are where sites break, so take a backup first, update one at a time and look at the site after each. If you have a staging copy of the site, update there first. Remove any plugin you are no longer using. A deactivated plugin still sits on the server and can still be attacked.
2. Check that the backups work
Almost every site owner will tell you they have backups. Far fewer have ever restored one. Once a month, confirm three things: the backup ran, it is stored somewhere other than the web server itself, and it includes both the files and the database. Once or twice a year, restore one to a test location. A backup you have never restored is a guess.
3. Look at who can log in
List the admin accounts. Former employees, the freelancer who built the site in 2021 and the “test” account nobody remembers creating should all go. Every remaining admin should use a unique password and two-factor login. Most break-ins on small sites come through an out-of-date plugin or a reused password, and both are cheap to close.
4. Measure the speed, on a phone
Run the homepage and your two most important pages through Google’s PageSpeed Insights and read the mobile result, since that is how most visitors arrive and it is the version Google scores. The usual causes of a slow small business site are oversized images, too many plugins loading scripts on every page and cheap shared hosting. Compressing images and removing two or three plugins often does more than any caching tool.
5. Fill in the forms yourself
Submit the contact form, the quote form and, if you sell online, a test order. Check that the email arrives and does not land in spam. A form that fails silently is the most expensive fault a small business site can have, because nobody reports it. The enquiries just stop, and it can be weeks before anyone asks why the phone is quiet.
6. Open Google Search Console
It is free and it tells you what Google sees: pages it could not crawl, pages it has dropped from the index, security warnings and mobile usability problems. Five minutes a month is enough to catch a problem before it costs you traffic. Fix broken links and missing pages as they appear, and redirect any page you have removed to the nearest live one.
7. Check the things that expire
Domain names, SSL certificates and premium plugin licences all have renewal dates, and they tend to be tied to an email address that somebody stopped reading. Put the dates in a shared calendar. An expired certificate puts a full-page browser warning in front of every visitor, and an expired domain takes the website and the company email down together.
Who should do it
If someone on your team is comfortable in the WordPress dashboard, this list is manageable in house, as long as it has a named owner and a recurring calendar slot. What does not work is “whoever has time”.
If nobody is, hand it to a specialist. A WordPress maintenance plan from a team such as Fly High Web covers the updates, backups, security monitoring and fixes for a fixed monthly fee, which for most small businesses costs less than a single emergency repair after a hack or a failed update.
Whichever way you go, the test is the same. Ask when the site was last updated, when a backup was last restored and when someone last submitted the contact form. If nobody can answer, that is this month’s job.
