Website Maintenance Checklist: What to Do, How Often and What It Costs

The short version: Website maintenance is a short list of jobs. Install security updates within two weeks, or within 48 hours when a security hole is rated critical or a working exploit exists. Take a backup before every update. Let an uptime monitor check the site every 5 minutes. Read Google Search Console when it emails you. Make sure your padlock certificate renews automatically, and renew your domain before it expires. Most of it you can do yourself with free or low-cost tools. Or our optional care plans do most of the technical jobs for you from $49 a month, including GST.

What to do next: Use the table below as your checklist. If you’d rather hand it over, our plans are on the website maintenance page and the pricing page. Wondering what others charge? Our guide to website maintenance prices has the numbers.

The checklist

Every job, with how often to do it where an official source sets a timing. “Do it yourself” lists a tool and its price where we have one. The last column says whether a CatalystHub care plan does the job for you.

Job	How often	Why it matters	Do it yourself	In our care plan?
Uptime check (an alert if the site goes down)	Every 5 minutes, automatically	You find out the site is down without waiting for a customer to tell you	UptimeRobot free plan: 50 monitors, checked every 5 minutes	Yes: 24x7 uptime monitoring with alerts
Backup	Before every update, and on a regular automatic schedule	WordPress says to make sure you can roll back to an earlier version before you switch on automatic updates	UpdraftPlus Premium (WordPress): US$70 a year for up to 2 sites	Yes: daily off-site backups
Security monitoring	All the time, and read every alert	Google can label a hacked site “This site may be hacked” in results or block it behind a browser warning. The average self-reported cost of cybercrime for a small business was $56,600 per report (ASD, 2024-25)	The Security issues report in Google Search Console, free	Yes: security monitoring and vulnerability scanning
Software, theme and plugin updates	Install within two weeks of release, or within 48 hours if the hole is critical or a working exploit exists	That’s the patching (updating) baseline in the Essential Eight from the ASD, the government’s cyber security agency. 96% of the new WordPress security holes found in 2024 were in plugins (Patchstack)	Your site’s dashboard. WordPress installs minor security releases of its core by itself	Yes: security and dependency updates
Speed and Core Web Vitals	No official timing. Our plans report it monthly	The Core Web Vitals measure how fast and steady a page feels, and search rankings use them	The Core Web Vitals report in Google Search Console, free, checks real visits against the targets below the table. PageSpeed Insights, also free, shows real visitors’ results from the past 28 days plus a lab test	Yes: a monthly performance report (Lighthouse and Core Web Vitals)
Google Search Console	when it sends you an alert	It alerts you when Google hits indexing, spam or other problems on your site	Google Search Console, free	We set it up free before launch and watch it until handover
Content (prices, photos, services)	When something changes	So the site matches what you sell today	Your site’s editor	Premium: one hour a month. Specialist: 30 minutes a month. Basic: no content changes
Opening hours on Google	Before public holidays	Google says to set special hours for holidays and other temporary changes	Edit your Google Business Profile	Not in a care plan. Business Profile setup is part of our separate Growth Advanced package
Padlock certificate	automatic renewal, with monitoring that alerts you if a renewal fails	Let’s Encrypt’s default certificates go from 90 days to 64 days in 2027, then 45 days in 2028, and it says manual renewal is not recommended (details below)	Let’s Encrypt, a free certificate provider	Not listed by name. Ask us on the call
Domain renewal	Every renewal, one to five years at a time	When a .au domain expires, your website and email stop working. You get 30 days to renew, then anyone can register it (auDA)	Renew with your registrar and keep your contact details current. A .com.au was $22.95 a year at one registrar’s regular price (read 9 October 2026)	Not listed. The domain is in your name. Ask us
PHP version, on WordPress (PHP is the language WordPress runs on)	Check you’re on PHP 8.3 or newer	WordPress recommends PHP 8.3 or newer	Ask your host which version you’re on	Not needed on the sites we usually build, which don’t run on WordPress

The three Core Web Vitals targets (web.dev):

• Largest Contentful Paint (LCP), how fast the main content shows: 2.5 seconds or less.
• Interaction to Next Paint (INP), how fast the page reacts to a tap: 200 milliseconds or less.
• Cumulative Layout Shift (CLS), how much the page jumps around while it loads: 0.1 or less.

A page passes when it meets each target for at least 75% of visits.

Why the padlock certificate needs watching. The SSL certificate is what puts the padlock in the browser bar. In April 2025 the CA/Browser Forum, the industry body for certificate issuers and browsers, voted to cut the longest a certificate can last from 398 days to 47 days, in steps from March 2026 to March 2029. Let’s Encrypt’s default certificates go from 90 days to 64 days on 10 February 2027, and to 45 days on 16 February 2028. It says manual renewal is not recommended and suggests a monitor that alerts you if a renewal fails.

How the list changes for your kind of site

A WordPress site has the longest list. WordPress has installed minor core updates by itself since version 3.7, but major versions are a separate step. Plugins are where the risk sits: Patchstack counted 7,966 new security holes in the WordPress ecosystem in 2024, and 43% needed no login to exploit. When Sucuri cleaned infected sites in 2023, 39.1% were running out-of-date software. WordPress’s own upgrade guide says to back up before you start.

A Shopify store has a shorter list. Shopify says it is certified Level 1 PCI DSS compliant (PCI DSS is the card industry’s security standard), and that this covers every Shopify store by default. You don’t patch servers or the checkout. Your jobs are the theme, your apps, your content and your settings. Shopify applies some theme updates itself for bug or security fixes, and offers the rest for you to add. Theme editor changes carry over, but code edits may need copying by hand, and Shopify advises you to save a copy of any customised code before updating. Our Specialist care plan watches for Shopify platform changes that affect your store.

A site with no plugins has the shortest list. The sites we build run on Astro, a modern way of building websites, with TinaCMS as the editor, hosted on Cloudflare. There are no WordPress plugins to update. They still have code dependencies (the code libraries a site is built on) that need updating now and then, and that’s part of our care plan. Backups, uptime, your domain and your Google listing still matter on any site. Our sites also score Lighthouse 95+ on mobile (Google’s speed score), so a speed check is usually a quick look.

What you can do yourself

Most of it. Uptime alerts and Search Console are free. Content changes happen in your site’s editor, and holiday hours in your Google Business Profile. On WordPress, backups cost a little, and the real cost is your time: someone has to run the updates, then check that nothing broke.

You own your site, code, content and domain, so you can do all of this without us. If you skip the care plan, updates and fixes are yours, but we’re still here. Email or call and we’ll help at our hourly rate.

What our care plans cost

All optional, all month to month, all prices including GST:

• Basic, $49 a month: daily off-site backups, security and dependency updates, security monitoring and scanning, 24x7 uptime alerts, and a monthly performance report and summary email.
• Specialist, from $79 a month: Basic plus 30 minutes of content updates a month, plus monitoring of your regulator’s rules or of Shopify platform changes. Built for clinics, allied health and online stores.
• Premium, $99 a month: Basic plus one hour of content updates a month. You email, we make the change within two business days.

The first month is free on every new build. Cancel with 14 days’ notice and no exit fees. An extra page is $100 a page, during a build or after launch. The Standard, Advanced and Specialist sites we build are hosted free on your own account, so you never need a plan just to stay online.

Compare the plans side by side on the website maintenance page or on pricing. Need a new site first? Start your project. Scope and timing are worked out with you on the call.

Frequently asked questions

What does website maintenance include? The jobs in the table: software and plugin updates, backups, uptime and security monitoring, speed checks, content updates, padlock certificate renewal and domain renewal. Google Search Console alerts you when Google hits indexing, spam or other issues on your site. On a WordPress site, check your PHP version: WordPress recommends PHP 8.3 or greater.

How often should a website be updated? Install security updates on time. The Essential Eight, the baseline from the ASD (the government’s cyber security agency), is to install security updates within two weeks, or within 48 hours when the hole is critical or a working exploit exists.

How often should I back up my website? Before every update, and on a regular automatic schedule. WordPress says to make sure you can roll back before you switch on automatic updates. Our care plans take daily off-site backups.

What happens if my .au domain expires? Your website and email stop working. auDA gives you 30 days to renew, then the name is removed and anyone can register it. Keep your contact details current so you don’t miss the reminder emails.

Do I need a maintenance plan? No. Our care plans are optional. If you’ll do the jobs in the table yourself, you don’t need one. If you won’t, a plan from $49 a month means someone else does most of the technical ones.