Website Maintenance Checklist for Small Businesses

A small-business website doesn't die in a crash — it dies quietly: the certificate lapses, the domain auto-renew fails on a dead card, the contact form has been eating leads for three weeks, and the backup everyone assumed was running stopped when a plugin updated. None of those announce themselves. The fix isn't a redesign or a retainer — it's a 30-minute routine, once a month, that checks the four things that actually fail.

1. The four quiet failures

Everything on your site can break, but only four failures are common and silent. Each has a check that takes minutes:

Quiet failure	How it announces itself (if you do nothing)	The check
Certificate expires	Browsers show a warning page; half your visitors just leave. Often a non-renewed ACME challenge or a lapsed plan.	Cert expiry date checked monthly, alerts set at 30 days — see the SSL expiry checklist.
Domain expires	Site resolves for cached users, then vanishes entirely. Resellers send renewal mail to an inbox nobody reads.	Expiry date + registrar account reachable, monthly — see domain hijack protection.
Contact/checkout form breaks	Nothing. The page looks perfect. Leads vanish into a misconfigured mailer or a spam folder, for weeks.	Submit a real test lead monthly and confirm it arrives in an inbox a human reads.
Backup stopped (or never restored)	You find out the day you need it — usually during a hack or a bad update.	Restore test quarterly, spot-check the backup ran this month — see the backup restore test checklist.

2. The 30-minute monthly routine

Same day every month (pick one — the 1st, invoicing day, whenever), one cup of coffee, in this order:

Browse like a customer (5 min): homepage on your phone, top product or service page, the booking or checkout path, then the contact page. If a page looks broken, it's been broken for weeks — the monthly cadence catches what daily life normalizes.
Submit a real test lead (5 min): fill the contact form from your phone and confirm the message lands in an inbox someone actually reads — not the owner's personal address that forwards to a mailbox that was decommissioned in March. This is the highest-value five minutes on this page.
Check the two expiries (5 min): certificate expiry and domain expiry. Both take under a minute to read off the site and the registrar. Set the calendar reminder at 30 days out, not at expiry.
Updates, on a copy, one at a time (10 min): apply pending CMS/plugin updates to a staging copy first, screenshot after each, then promote. If you must update live, do it at your quietest hour, one item at a time, with yesterday's backup confirmed — never bundle ten plugin updates at 5pm Friday.
Glance at the two graphs (5 min): traffic and errors. A sudden traffic drop usually means indexing or a plugin, not "marketing is failing." An error-log spike means something changed — look at what shipped that week. If you only watch uptime, see the five signals worth monitoring.

3. The quarterly pass (the 30-minute routine isn't the whole job)

Restore test: actually restore a backup to a scratch location and click around. An untested backup is a rumor — this is the quarterly half-hour that decides whether a hack is an afternoon or a disaster.
Owner and access audit: who can log into the CMS, the host, the domain, the DNS? Remove anyone who left. "The person who set it up in 2022" is not an owner.
Mobile speed check: run one page through a speed test on a phone connection. Slow homepages are silent revenue leaks that no uptime monitor will ever catch.
Legal and contact details: prices, opening hours, the privacy page, the address. Stale hours on the contact page cost real customers and take four minutes to fix.

4. The mistakes that turn maintenance into an outage

Updating live at 5pm Friday. Plugin updates are the #1 self-inflicted outage on small sites. Copy first, one at a time, quiet hour, backup confirmed.
The bus factor of one. The site only "the web guy" can touch. Export an admin login and a note on where things are hosted into your password manager — ownership is a fact you can hand over, not a person you can call.
Testing the form with your own session. Logged-in admins bypass half the failure modes (caching, bot protection, mail routing). Test from a phone, logged out, like a stranger.
Never checking where the form mail goes. A form that sends to a mailbox nobody opened since 2023 has been eating leads the whole time — and no dashboard will tell you.
"It's just a brochure site." Brochure sites still collect leads, still get hacked, still expire. The 30-minute routine is the same; only the stakes differ. When the site is revenue, add an uptime budget so you know what your targets actually buy — see the uptime budget.

Takeaways

Websites fail quietly, in four known places — certificate, domain, form, backup. Thirty minutes a month checks all four before customers do.
The test lead is the highest-value five minutes. A broken form is invisible in every dashboard and expensive in every pipeline.
Updates on a copy, one at a time — and a restore test every quarter, because an untested backup doesn't exist.

---

The Ops Starter Kit ($14) turns this routine into a fillable monthly plan — and when something on the site does break anyway, Vol. 2 ($27) adds the DR plan and evidence log for the review after. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout (ends Sep 11, 23:30 ACST).