What Should Website Maintenance Include? A Small-Business Handoff Checklist

Website maintenance should cover more than occasional content edits. A useful arrangement identifies who handles software and security updates, backups, monitoring, forms, integrations, performance, accessibility, and urgent problems. It should also make clear who owns the domain, hosting, content, data, and other accounts.

This checklist is useful if you are hiring a maintenance provider, taking over a site from another company, or deciding what your team can manage internally.

What website maintenance should include

There is no single standard maintenance package. The right scope depends on the website platform, hosting arrangement, integrations, traffic, and how much the business relies on online enquiries. Before comparing providers, separate routine maintenance from redesigns, new development, and marketing services.

1. Software and security updates

Content management systems, plugins, themes, libraries, server software, and third-party tools may need updates. Updates can improve compatibility or address security weaknesses, but an update can also affect layouts, forms, integrations, or other functionality.

A responsible process should record what changed, maintain a current list of important components, and check key functions after updates. Google's security guidance recommends keeping installed software and plugins current, monitoring site health, and maintaining appropriate backups.

2. Backups and restoration planning

A backup is part of a recovery plan only if the required data is included and the backup can be restored. Ask:

• Are files, databases, uploaded media, configuration, and relevant integrations covered?
• How often are backups created?
• Where are copies stored, and who can access them?
• How long are they retained?
• When was a restoration last tested?

Hosting backups may not cover every part of a business's recovery needs. Confirm what could be lost between backup points and whether restoring the website would affect forms, email, analytics, bookings, payments, or other connected systems.

3. Uptime and error monitoring

Monitoring can alert the responsible person when a site becomes unavailable or a serious error is detected. It cannot identify every problem, but it can reduce the delay before someone investigates.

Define priority levels in advance. A total outage, compromised website, failed contact form, and minor layout issue should not necessarily follow the same response process. Ask what counts as urgent, how incidents are reported, and who is contacted outside normal business hours.

4. Forms, phone links, email, and integrations

A website can appear normal while enquiries fail to reach the business. Checks should reflect the actions that matter most to your customers, such as:

• Submitting the main contact, quote, or booking form.
• Confirming that notifications reach the correct inbox.
• Testing telephone links on a mobile device.
• Checking booking, payment, newsletter, CRM, or automation connections.
• Reviewing confirmation and error messages.

Document responsibility for each part of a multi-service workflow. If a form depends on the website, email provider, spam filter, and CRM, the handoff document should say who investigates each layer.

5. Performance and accessibility checks

Maintenance should include checks for changes that make pages slower or harder to use. Review mobile layouts, large media files, scripts, embeds, broken links, keyboard access, headings, colour contrast, and form labels.

Google's developer guidance advises site owners to keep websites secure, fast, accessible, and functional across devices. These practices support visitors and search visibility, but they do not guarantee rankings, enquiries, or sales.

6. Search visibility and technical checks

Depending on the site and service agreement, maintenance may also include checking indexability, redirects, canonical URLs, sitemap changes, unexpected pages, and Search Console warnings. These checks are different from promising a particular ranking.

Google describes Search as a process of crawling, indexing, and serving results, and says that it does not guarantee that a page will be crawled, indexed, or shown for a particular query. See How Google Search works and its technical requirements for the distinction between technical eligibility and actual search visibility.

Website ownership checklist before a handoff

Unclear ownership can turn a routine change into a serious delay. Before a new provider starts work, collect and verify the following:

Accounts and assets to document

Item	What to confirm
Domain	Who owns the registrar account, controls renewal, and receives renewal notices?
Hosting	Where is the site hosted, who controls the account, and what access does the provider need?
Website access	Are individual administrator accounts used instead of one shared password?
Email and DNS	Who controls business email, DNS records, forwarding rules, and authentication records?
Analytics and Search Console	Does the business own the properties and have administrator access?
Forms and integrations	Which systems receive enquiries, bookings, payments, or customer information?
Backups	Where are backups stored, who can restore them, and when was restoration tested?
Content and brand assets	Who owns the copy, photographs, logos, design files, and other supplied materials?

Keep important accounts in the business's name wherever practical. A provider can receive appropriate permissions without becoming the permanent owner of the domain, analytics, hosting, or customer data. Use unique passwords and multi-factor authentication where available.

Questions to ask a website maintenance provider

1. What exactly is maintained? Ask whether the scope includes the website platform, plugins, server, DNS, forms, integrations, backups, monitoring, and third-party tools.
2. How are updates tested? Ask whether a backup or rollback plan is used and whether important pages, forms, and integrations are checked afterwards.
3. What is included and what is separate? Content edits, new pages, redesigns, custom development, copywriting, SEO, emergency recovery, and third-party charges may have different terms.
4. How are urgent problems reported? Confirm the contact method, expected response process, escalation path, and whether after-hours support exists.
5. What records will you receive? A useful report may list completed updates, backup status, monitoring results, notable issues, and recommended work.
6. What happens if the arrangement ends? Confirm that the business can retrieve its content, domain, data, credentials, configuration, and usable backups.
7. Who is responsible for each external service? Identify the owner of email delivery, payment processing, booking software, CRM connections, analytics, and DNS.

When maintenance is enough—and when it is not

Maintenance keeps an existing system current and operating. It does not automatically fix unclear messaging, weak calls to action, poor navigation, outdated services, or a website that no longer fits the business.

A redesign may be appropriate when the site is difficult to use on mobile devices, depends on a fragile technical setup, cannot support current services, or requires repeated workarounds. Maintenance may be the better choice when the structure is sound and the main need is reliable updating, monitoring, security attention, and small changes.

A practical middle option is to improve the highest-impact pages first and then reassess. That approach makes sense only when the existing platform is safe, accessible enough to improve, and maintainable.

A monthly customer-facing review for owners

Even when a provider handles technical work, owners should periodically review the experience customers actually see:

• Call the main phone number from a mobile device.
• Submit the main enquiry form and confirm that a reply arrives.
• Check services, hours, service areas, prices if displayed, and contact details.
• Review the website on a current phone and desktop browser.
• Look for expired promotions, discontinued services, outdated staff information, and broken links.
• Review Search Console or analytics for unusual changes, indexing warnings, or unexpected pages.

Do not treat a single monthly review as a complete technical audit. It is a simple way to catch customer-facing problems that automated monitoring may not reveal.

Document the handoff

The best time to clarify responsibility is before an emergency. Create a short handoff document listing account owners, access permissions, software components, integrations, backup arrangements, routine checks, urgent contacts, and work outside the maintenance scope.

If you are comparing providers, review Certtech's website maintenance service to see how the company presents ongoing maintenance, monitoring, security, performance, and content support. If the existing website needs a broader rebuild or technical assessment, see its web design service. For an early visual direction, you can request a free website mockup before deciding on next steps.

The goal is not to buy the largest package. It is to make sure the right person owns the right task, the business retains access to its assets, and the recovery process is clear when something changes.