Website maintenance: what to check every week, every month and every year

Why does a website need maintenance?

A website built on a content management system (CMS) is software that keeps changing: developers patch newly found security holes, while plugins, themes and server software get new versions. A website that isn't updated doesn't break overnight, but over time it becomes an easy target for automated attacks that scan for known vulnerabilities.

The server's PHP version matters too. As of September 2026, PHP 8.2–8.5 receive security fixes, and support for PHP 8.2 ends on 31 December 2026. If your website only runs on an older version, it first needs to be updated or rebuilt, because simply switching the PHP version can break it.

Once a website has been infected, there's far more work than with regular maintenance: the malicious code has to be cleaned out, the vulnerability closed, and sometimes Google has to be asked to remove the warning in search results. The process is described on our page about malware removal.

What to check every week

Every week, a quick check that the website is doing its job is enough: that it's receiving enquiries, orders and payments. Some checks can be automated, but a person still needs to look at the results.

• Forms. Send a test enquiry and check that it reached your inbox rather than the spam folder.
• Orders and payments. In an online store, look for orders stuck in ‘awaiting payment’ and check that customers are receiving emails.
• Uptime monitoring. An automated service checks regularly that the website loads and alerts you by email if something goes wrong.
• Backups. Make sure the latest backup was actually made and that its size doesn't look like an empty file.
• Unexplained changes. New administrators, pages or links that nobody created are a sign that you need to check your security.

What to do every month

Every month, update the CMS, plugins and theme – but not blindly: take a backup first, and after updating check the key pages, forms and basket. This is exactly the task that tends to get put off once a website has gone live.

1. Back up the whole website – both files and database.
2. Install CMS, plugin and theme updates; test major version upgrades on a copy of the website first.
3. Check the key pages and forms, and place a test order in an online store.
4. Remove unused plugins and themes: a plugin that's disabled but not deleted stays on the server and may contain vulnerabilities.
5. Review the Google Search Console reports: indexing errors, security notices and pages that no longer load.
6. Check the loading speed on mobile, e.g. with PageSpeed Insights.

What to do every quarter and every year

The less frequent tasks are the ones most often forgotten, precisely because they don't come up every week. Put them in your calendar with a reminder at least a month before each deadline.

DOMREG, the .lt domain registry, does not warn you when a domain is about to expire, so you need to take care of the renewal yourself or arrange auto-renewal with your service provider. Owners of websites we host are sent the invoice for the next year before the deadline.

How to back up a website properly

A backup is only useful if you can actually restore the website from it. So what matters is not just how often backups are made, but also where they're kept, how long they're retained and whether anyone has ever tried restoring the website from them.

A handy rule of thumb is the 3-2-1 rule: keep 3 copies of your data (the live one and two backups), store them on 2 different media or systems, and keep 1 copy off-site – not on the same server, and ideally not with the same provider.

• Back up everything. A backup of the files without the database contains neither your text nor your orders.
• Frequency based on change. Weekly backups are enough for a website that rarely changes; an online store with daily orders needs daily backups.
• Several versions. Keep backups going back at least a few weeks, because an infection or an error is often not noticed straight away.
• A backup before every update. If an update fails, you can quickly roll back to the previous state.
• Test restores. Restoring a backup every quarter shows whether it's intact and how long a restore takes.

In Saitai.lt maintenance plans, backups are made weekly on the Basic plan, daily on the Business plan, and daily on the Premium plan with an extra copy kept in external storage.

Who should own the logins?

All the website's logins and accounts should belong to the company, not to the developer or a single employee. Otherwise, when people change, you may spend a long time proving that the domain or the website is yours.

• The domain is registered in the company's name, and the registrar account uses a shared company email address, not an employee's personal one.
• The list of logins is kept in a password manager: domain registrar, DNS, hosting, CMS admin, email, Google Analytics and Google Search Console.
• A separate account for each person instead of one shared password. That way you can see who changed what, and when someone leaves you simply disable their account.
• Two-factor authentication (2FA) for the admin, hosting and domain registrar accounts.
• Only the permissions people need. Someone who writes text doesn't need administrator rights.

When we build a website, we register the domain in the client's name, and once the project is finished and paid for in full, we hand over all the logins, files and the database.

What can you do yourself, and what should you leave to a specialist?

Content changes and the weekly check can usually be done by a member of staff, while system updates, restoring from backups and security are better left to a specialist who knows what to do if something breaks after an update.

If you'd rather not schedule these tasks yourself, Saitai.lt offers three website maintenance and support plans:

• Basic – €29/month: monthly updates, weekly backups, uptime monitoring, 30 minutes of changes a month, response within 2 working days; hosting is paid separately (from €60/year for a website, from €70/year for an online store).
• Business – €69/month: weekly updates, daily backups, security checks, 2 hours of changes, response within 1 working day, hosting included.
• Premium – €149/month: adds backups in external storage, 5 hours of changes, response within 4 hours during working hours, and maintenance of online store modules, payments and shipping.

Without a plan, individual jobs are charged by the hour at €30/hour. You'll find all our prices on the prices page; prices include all taxes – no VAT is added.

Sources

• DOMREG, ‘How do I renew the registration of my domain?’ (in Lithuanian): domreg.lt
• DOMREG, ‘What is quarantine?’ (in Lithuanian): domreg.lt
• PHP supported versions: php.net
• WordPress security recommendations (Hardening WordPress): developer.wordpress.org
• WordPress documentation, plugin and theme auto-updates: wordpress.org
• CISA, ‘Data Backup Options’ (the 3-2-1 rule): cisa.gov

Not sure who last updated your website, or when? Enter its address in the enquiry form. Within 1 working day we'll assess its condition free of charge and tell you what to fix first.