Website maintenance and security: what to do regularly

The key tasks

• Updates: Keep the system, plugins and themes up to date. Outdated versions are a common point of entry.
• Backups: Regular backups that are stored somewhere else and can be restored.
• Access: Long, unique passwords, two-factor authentication, delete accounts that are not needed.
• HTTPS: A valid certificate, renewed automatically.
• Monitoring: Keep an eye on availability and errors.
• Tidying up: Remove unused plugins.

How often?

Security updates as promptly as possible, backups daily to weekly depending on how often the site changes, functional tests after major changes, and regular checks of forms and links.

Worked example: a year of maintenance

This is what a manageable routine for a business website might look like. Weekly: check availability and the form, read the system’s security notices. Monthly: install updates, make a backup first, then click through the most important pages. Quarterly: review user accounts, check the certificate and domain expiry dates, restore a backup as a test. Annually: check that content is up to date, remove unused plugins, review the hosting plan and costs. What matters is that someone is named as responsible for it, otherwise it gets left undone.

Typical mistakes

• Backup only on the same server: If the server fails or is attacked, the backup goes with it.
• Backup never tested: A backup only counts once you have successfully restored it.
• Shared admin account: If everyone uses the same password, you cannot tell who changed what, and when an employee leaves, everything has to change.
• Putting off updates because it “works”: Security vulnerabilities are often publicly known before an update is installed.
• Overlooking the domain expiry: If the renewal is missed, the site is gone, and in the worst case the email address too.

How you can spot an attack

Possible signs are unknown pages or links in the search results, redirects to other sites, suddenly slow loading times, browser warnings or notices in your Google search account. If you suspect something: change your login details, block access, restore a clean backup and find out the cause before you make the site available again. It helps to have Google Search Console set up, which can point to security problems.

Decision aid: maintain it yourself or outsource it?

Maintaining it yourself is worthwhile if you know the system, set aside fixed time for it and can install updates safely. Outsourcing makes sense if the site is business-critical (a shop, for example), nobody in-house has the knowledge, or holidays and illness would leave gaps in the upkeep. A low-maintenance site without many plugins reduces the effort in both cases; for more on choosing a system, see WordPress or custom-built.

Myth versus fact

Myth: Attackers are not interested in small sites. Fact: Many attacks are automated and look specifically for known vulnerabilities, regardless of the size of the operator. A small site with an outdated plugin is just as easy a target as a large one. An attack can do harm even when the site is merely used as a base for spam or redirects, without you noticing at first.

Document access and responsibility

Record in writing where the domain, hosting, email and the website’s admin area are registered, and to whom. It happens more often than you would think that a former agency or employee is listed as the owner and nobody has access any more. A short overview kept in a safe place, and at least two authorised people, will prevent that deadlock. Passwords belong in a password manager, not in an open spreadsheet or an email.

Less technology, less risk

The fewer plugins and third-party services a site uses, the lower the effort and the risk. That is why we deliberately build lean. On request, ongoing support is part of our services under Websites.