How to maintain a website: a beginner's checklist for business owners [2026 Guide]

In short

• A website is software. It needs patches, backups and content review on a schedule, or it degrades quietly.
• The minimum viable routine is 30 minutes a month: updates one at a time after a backup, a visitor-level check of the site and its forms, a look at backup status, uptime monitoring and Search Console.
• Add one two to three hour session per quarter for a restore test, an access audit, a performance check and a content sweep.
• Most small business compromises start with an outdated plugin, not the CMS core. Deleting what you do not use is as valuable as updating what you keep.
• In Belgium, cookie consent, accessibility and three language versions are maintenance items, not launch items.
• The cheapest insurance is ownership: domain, hosting, code and accounts in your name, with two-factor authentication and a documented password handover.

Introduction

Your website was delivered, the invoice was paid, and for a few months everything looked fine. Then a form stopped sending emails. Nobody noticed for three weeks. Or your certificate expired on a Sunday and Chrome greeted every visitor with a red warning page. Or a page that used to rank on page one quietly slid to page three because the last content change was in 2024.

None of these are dramatic failures. They are the ordinary decay of a piece of software that nobody is looking after. A website is not a brochure you print once. It runs on a server, on a content management system, on plugins and certificates and DNS records, all of which change without asking you.

The good news is that maintenance for a small business site is not a technical discipline. It is a routine, roughly thirty minutes a month plus one longer session per quarter, and most of it is clicking through things you already understand. This guide gives you that routine as a checklist you can actually keep, with the Belgian specifics that belong on it.

Why a website needs maintenance at all

When you buy a car, you accept that it needs oil, tyres and an annual inspection. Software is the same, except nobody sends you a reminder. WordPress alone runs about 40% of all websites according to W3Techs, and every one of those installations depends on core files, a theme and often a dozen plugins, each with its own release cycle.

Three forces make a neglected site degrade:

Security patches. Vulnerabilities are found in CMS core and plugins continuously. A patch is published, and the details of what it fixes become public within days. Bots scan the entire internet for the exact version that still has the hole. Your site does not need to be interesting to be hit; it needs to be out of date.

Time-based expiries. SSL certificates, domain registrations, hosting plans, payment provider credentials, API keys for your booking widget. Each has a date attached, and each fails silently until it fails loudly.

Content drift. Prices change, staff leave, opening hours shift, a supplier disappears. Every stale detail is a small trust leak, and search engines reward pages that are demonstrably current.

For a Belgian SME the stakes are concrete. LUCID, the awareness centre of the Centre for Cybersecurity Belgium, reports that 42% of Belgian SMEs have already faced a cyber incident, and BlackFog's 2026 data puts SMEs at around 67% of ransomware victims. Automated attacks do not check your headcount before they scan.

What actually breaks when nobody looks

The failures I see on small business sites follow a predictable order, and almost all of them are cheap to prevent and expensive to discover late.

A contact form that silently stops delivering is the most common. The mail server tightens a rule, the plugin updates, and submissions either vanish or land in spam. You keep paying for traffic that never converts.

Expired certificates come second. Free certificates from Let's Encrypt are valid for 90 days and renew automatically, until the renewal job breaks after a host migration. Visitors see a full-page browser warning and leave.

Third is the accumulation of abandoned plugins. A plugin the original developer stopped maintaining does not disappear; it keeps running, unpatched, with whatever access it was granted. Most CMS compromises start with an outdated plugin rather than the core platform, because plugins are the part nobody audits.

Fourth is performance decay. Images get uploaded at 4000 pixels wide, a chat widget gets added, a tracking script gets pasted in twice, and a site that loaded in 1.4 seconds now takes 4.8 on mobile data. Google's thresholds have not moved: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1. A site that drifts past them loses both patience and rankings.

Fifth is the quiet one: nobody remembers where anything lives. The domain is registered in the name of a former employee, the hosting account uses a shared password, the backups were never tested. When something does break, recovery takes days instead of an hour.

The 30-minute monthly baseline

If you do nothing else, do these five things on the first working day of each month. Put a recurring calendar block in place and treat it like a standing meeting with your website.

1. Apply the updates, in the right order. Core first, then theme, then plugins, one at a time. Take a backup before you start. If your host offers a staging environment, apply there first and click through the main pages before pushing live. One at a time matters: when five plugins update together and something breaks, you have no idea which one did it.

2. Check the site as a visitor. Open it on your phone, on mobile data rather than office wifi, and on a desktop. Submit the contact form and confirm the email arrives. Click the main navigation. Then do the same on a French or Dutch version if you have one, because translations break independently.

3. Read the backup status. Whatever your backup tool is, confirm the most recent run succeeded and shows a date within the last 24 hours. A backup you have never looked at is a hope, not a backup.

4. Look at uptime and errors. If you have no monitoring yet, a free uptime checker that pings your site every five minutes and emails you when it fails costs nothing and takes ten minutes to set up. That single tool converts most outages from "a customer told us" into "we knew before anyone else".

5. Glance at Search Console. Google Search Console is free and tells you the two things that matter: whether pages are indexed, and whether any crawl errors or manual actions appeared. If coverage suddenly drops, you want to know in the same month, not the same quarter.

That is genuinely it. Thirty minutes, no developer required.

The quarterly session, two to three hours

Every three months, block a longer slot. This is where you catch the slow problems.

Test a restore, not just a backup. Pick one file and one database table and restore them into a test location. The 3-2-1 rule is the standard: three copies of your data, on two different media, with one off site. For a small site that usually means host backups plus an independent copy somewhere else, ideally in a different country or provider.

Audit accounts and access. List everyone with an admin or editor login. Remove anyone who left, downgrade anyone who only needs to publish, and turn on two-factor authentication for every remaining account. If your domain or hosting is still in a former developer's personal account, fix that this quarter. Ownership of the domain, hosting and code is something you should have in writing, and it is the single most common thing SMEs discover they do not have.

Check performance on a real page. Run PageSpeed Insights on your three most important URLs, not the homepage only. Compare against the previous quarter. If LCP crept from 2.1 to 3.4 seconds, something got heavier, and it is usually a script or an unoptimised hero image.

Run a content sweep. Prices, opening hours, team page, phone number, service descriptions, legal page. Ask two people who do not work on the site to find one outdated fact each. They will.

Review the legal layer. Does your cookie banner still reflect the tools actually loaded? Did you add a newsletter signup and forget the privacy policy? GDPR and cookies belong in the maintenance calendar, not in a folder from 2022.

The annual review, half a day

Once a year, step back from tasks and look at the platform itself.

Check the software versions against what is still supported. PHP branches go end of life on a published schedule, and running an unsupported branch means no security fixes at all, even if your CMS is current. Confirm your hosting plan still matches your traffic and that you know the renewal price, since introductory pricing quietly doubles.

Review your plugin list with a delete-first instinct. Every plugin you deactivate and remove is one fewer dependency to patch and one fewer entry point. Then look at what the site is for: the enquiry rate, the conversion path, the pages that get traffic versus the pages you thought mattered. Maintenance without this annual look becomes preservation of things that no longer earn their place.

How to run updates without breaking the site

The reason many owners stop updating is a bad experience: an update broke the layout once, so updates became risky and then stopped. Three habits fix that.

Keep a manual backup immediately before any update, and know how to restore it. Update on a Tuesday morning rather than Friday afternoon, so you have working hours to react. And resist the urge to install a plugin for every small wish; each one adds a dependency you will maintain for years.

If your site is on a modern framework rather than a CMS, the equivalent discipline is dependency updates and framework upgrades: the same cadence, the same staging step, usually through a developer. There is no version of a website that needs no maintenance. There is only a version where the maintenance is scheduled instead of emergency.

The content maintenance nobody schedules

Security gets the attention. Content is what actually earns money, and it decays faster.

Google rewards pages that are current, and visitors judge you on the same signal. A blog post from 2023 with a dead link and a price that has since doubled tells a prospect that nobody is home. Build a light content cadence into the monthly slot: one page refreshed, one broken link fixed, one outdated fact corrected. Fixing a link is not cosmetic; it is the difference between a visitor staying and a visitor leaving.

Keep a short list of your ten most important pages and rotate through them. Refresh the ones with traffic, prune the ones nobody reads, and add the internal link from the new page to the relevant service page. That is 80% of content maintenance for a small business site.

DIY, a freelancer, or a maintenance plan

You have three options, and the right one depends on how much of your week you want to spend on this.

Doing it yourself is realistic for a brochure site on a mainstream CMS, and costs your time: roughly one hour a month plus three hours a quarter, once the routine is set up. You need access to the hosting panel, a backup routine and the discipline to keep the calendar block.

A maintenance plan from a freelancer or agency typically covers updates on staging, backups, uptime monitoring, a monthly report and a set number of small changes. In the Belgian market, expect the entry tier for a small brochure site to sit in the low hundreds of euros per month, with e-commerce and custom applications higher, because the surface to maintain is larger and the cost of downtime is measured in orders. Ask what happens outside business hours, whether the plan includes content edits or only technical work, and whether you keep ownership of everything if you leave. For a deeper look at what protects the site itself, see our guide to website security, SSL and WAF.

A managed hosting platform sits in between: you keep control, the provider handles patching, backups and certificates. It suits owners who want the technical layer off their plate but still want to publish themselves.

The comparison that matters is not the monthly fee against zero. It is the monthly fee against one hacked site, one week of lost enquiries, or one emergency rebuild. Recovery from a compromised small business site routinely costs several multiples of a year of maintenance.

The Belgian items that belong on the calendar

A few obligations are specific to operating here, and they belong in the quarterly slot rather than a one-off launch checklist.

Cookies and consent. The Belgian Data Protection Authority has made cookie compliance an enforcement priority. Consent must be given before non-essential cookies load, it must be granular, and refusing must be as easy as accepting. A banner with a large accept button and a hidden refuse link does not meet that bar. Every time you add a tool, revisit the banner.

Accessibility. WCAG 2.2 level AA is the reference standard, and the European Accessibility Act has applied since 28 June 2025 to a range of consumer-facing services, including e-commerce. Micro-enterprises providing services are exempt, but the exemption is narrow and the commercial argument is broader: accessible sites are simply easier to use on a phone in bad light.

Language. Belgian visitors expect the site in their language. Maintaining three language versions means the maintenance routine runs three times, which is exactly why translated pages rot first. Put the FR and NL check into the monthly slot.

Invoicing and legal mentions. Your company number, VAT number and legal details must stay accurate, and if you invoice through the site, the e-invoicing rules that are phasing in across Belgium affect what the checkout and confirmation emails must contain.

Next Steps

1. This week: book a recurring 30-minute calendar block on the first working day of each month, and set up a free uptime monitor on your homepage.
2. This month: take a backup, apply every pending update one at a time, and submit your own contact form to confirm it delivers.
3. This quarter: run a restore test, list every admin account and remove the ones that no longer belong, and confirm the domain and hosting sit in your name.
4. This year: review the platform, the plugin list and the renewal prices, and decide whether DIY, managed hosting or a maintenance plan fits the time you actually have.

Need help putting the routine in place? Contact Omnistack and we will audit your site and set up the schedule with you.

Maintenance is not the interesting part of having a website, which is precisely why it gets skipped. But the difference between a site that keeps working and one that quietly stops is rarely talent or budget. It is a calendar entry and thirty minutes of attention.

Start smaller than you think you should. One monthly block, five checks, one backup you have actually restored. Once that holds for a quarter, add the rest. Your site will load faster, rank more steadily, and stop surprising you at the worst possible moment.