Most business websites receive a lot of attention when they launch and very little after that. Nothing seems wrong, until a form quietly stops delivering enquiries, a security warning appears in visitors' browsers, or the site is taken over and redirected somewhere unpleasant. Regular maintenance is cheap compared with fixing those problems at short notice.
Why small sites get attacked
Many business owners assume nobody would bother with a small website. But most attacks are automated: programs scan the internet for known weaknesses and don't care who you are. A hacked small site can still be used to send spam, host scam pages or spread malware. On WordPress, vulnerability reports from security firms such as Patchstack have repeatedly found that plugins account for most newly disclosed problems, far more than WordPress itself. That is why keeping them updated, and using fewer of them, makes such a difference.
A maintenance schedule you can follow
Weekly
- Apply security updates to your platform, theme and plugins, ideally after a backup.
- Submit your contact form and confirm the message arrives.
- Check that the main pages load properly.
Monthly
- Check that recent backups exist and are stored away from the website's own server.
- Look at Google Search Console for errors and security issues.
- Remove plugins and admin accounts that are no longer needed.
- Check your page speed, particularly after adding new content.
Every few months
- Test restoring a backup. Until you have restored one, you cannot be sure that it works.
- Check links and read through the key pages for outdated information.
- Review who has access, and remove former staff and suppliers.
Yearly
- Check your domain, hosting and certificate renewal dates, and your payment details for them.
- Review whether the site still reflects your business and what customers ask.
- Check that your PHP and server software are still supported versions.
Basic security habits
- Use long, unique passwords stored in a password manager, and turn on two-factor authentication.
- Give each person their own login, and only the access they need.
- Keep backups off the server, so that an attack can't reach them as well.
- Use https across the whole site.
- Limit repeated login attempts.
- Collect only the personal data you need, and protect what you do hold.
What to do if your website is hacked
- Stay calm and record what you see, including screenshots and the time.
- Contact your hosting provider. They may be able to isolate the site and tell you what happened.
- Change every password, including hosting, database and admin accounts.
- Restore a clean backup or have the site cleaned. Then fix the weakness, or it may happen again.
- Check Search Console, and request a review if Google has flagged the site.
- Take advice if customer data may be involved. You may have legal responsibilities to report it.
Imagine a shop owner who learns from a customer that the shop's website is showing a warning. With a recent off-site backup and known logins, recovery might take hours. Without them, it could take far longer, and enquiries stop in the meantime. That difference comes from routine work done months before.
A simple rule for backups
A widely used guideline is the 3-2-1 rule: keep three copies of your data, on two different types of storage, with one copy somewhere else. For a small business website, that could mean the live site, a backup held by your host, and another copy in separate cloud storage that uses different login details.
Make sure the backup includes both your files and your database. A copy of the database alone would not restore your uploaded images, or a store's product photos.
Who should look after it?
You have three realistic options, and each can work:
- A trained member of staff: the cheapest choice, if someone will reliably do it and knows what to do when an update breaks something.
- Your hosting company: some plans include updates and backups. Check exactly what is covered, as many cover the server but not your website's software.
- A maintenance provider: usually the best fit if the website brings in business and nobody has the time. Our maintenance service supports businesses in Tirunelveli District and beyond.
Whichever you choose, write down who is responsible, and keep the logins for your domain, hosting and website somewhere safe that the business controls. Many urgent problems become much worse because the only person with the password has left.
Frequently asked questions
Does a simple website need maintenance?
Yes, though less of it. Even a basic site has a domain, a certificate and usually a form, all of which can fail.
Are automatic updates safe?
They are useful for security fixes, but an update can occasionally break something. Keep backups, and check the site after updates.
Is my hosting company's backup enough?
Don't rely on it alone. Check how often it runs and how to restore it, and keep a separate copy of your own.
What would this checklist look like for an online store?
The same, but more often. Stores change daily, so back up the database at least daily, test the checkout after every update, and check that order emails are still arriving.
Would you rather not do this yourself? Our website maintenance service takes care of it. Tell us about your site.
Share this article
