A website is not a one-off purchase. It's closer to a shopfront: paint it once and walk away, and within a year the sign is faded, the lock doesn't quite catch, and someone's tried the door. This post is for Australian small and medium business owners who have a live website and want a clear, practical answer to two questions: what actually needs checking, and how often — and what happens if none of it gets checked at all.
What "Website Maintenance" Actually Covers
Website maintenance is the ongoing work that keeps a live site secure, fast, accurate, and visible in search — as distinct from the one-off work of designing and building it. Building a website is a project with an end date; maintaining one has no end date for as long as the site is live and the business is trading.
That ongoing work splits into four areas that overlap more than they first appear to: keeping the software layer patched and secure, keeping the content accurate and current, keeping the site fast and technically healthy, and keeping search engines able to find and trust it. A plugin left unpatched is a security problem, but it's also often a performance problem and eventually an SEO problem, because Google penalises compromised and slow sites in search rankings. Neglect rarely stays contained to one area.
What Happens When a Website Is Left Unmaintained
Left unmaintained, a website gets slower, then vulnerable, then — for a meaningful share of Australian small businesses each year — actually compromised, and the direct cost of that has been climbing. The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of cybercrime for a small business at $56,571 in FY2024–25 — up from $49,615 the year before, and $45,965 the year before that. That's a rise of almost $11,000 in two years, for the average incident, not the worst case.
The same report breaks down what's actually being reported by businesses of all sizes: the top three self-reported cybercrime threats were email compromise resulting in no financial loss (19%), business email compromise fraud resulting in an actual financial loss (15%), and identity fraud (11%). Email compromise sits at the top of that list for a reason familiar to anyone who's had a staff or admin account reused across services — it's often the easiest door in, and a website's admin login is exactly that kind of account.
The software side tells a similarly sharp story. Patchstack's State of WordPress Security in 2026 report, produced with malware intelligence firm Monarx, found 11,334 new vulnerabilities were discovered across the WordPress ecosystem in 2025 — a 42% increase on 2024's 7,966, and 91% of them in plugins rather than WordPress core. More strikingly, the median time to mass exploitation for a heavily-exploited vulnerability was just 5 hours from disclosure. A monthly update cycle sounds reasonable until you put it next to a five-hour attack window; the gap between "we'll get to it" and "it's already been found" is not a large one.
The Website Maintenance Checklist
A maintenance checklist works best organised by how often each task actually needs doing, not as one long undifferentiated list. Some of this runs in the background continuously; some of it is a five-minute monthly check; some of it only needs a look once a year.
Continuous: Uptime and Backups
These two run in the background and need to be running before anything else on this list matters. Uptime monitoring checks your site is reachable and alerts you the moment it isn't, so downtime gets caught in minutes rather than when a customer mentions it. Automated backups should run daily, be stored off-server (a backup sitting on the same server as the site it's backing up is not a real backup), and be test-restored periodically — a backup nobody has ever tried to restore is an assumption, not a safety net.
Monthly: Updates, Scans, and Broken Links
Software, plugin, and theme updates, checked and applied at least monthly with compatibility testing before anything goes live — pushing an update straight to a production site without checking it first is how a routine patch turns into an afternoon of troubleshooting a broken page. Malware scans, run regularly enough to catch an infection before it spreads or gets indexed by Google as "hacked" in search results. Broken link checks, since dead links and redirect errors degrade both the user experience and the technical SEO signals search engines use to rank a page.
Quarterly: Performance and Search Health
Core Web Vitals and page speed, tested against Google's benchmarks — Google Search Central confirms page experience signals, including Core Web Vitals, factor into search ranking, so a site that's slowed down since launch isn't just annoying visitors, it's actively losing search visibility. Search Console and analytics review, to catch indexing errors, ranking drops, or crawl issues before they compound. A content audit, checking that pricing, service details, and team information across the site are still accurate.
Annually: SSL, Domain, and Accessibility
SSL certificate and domain renewal, confirmed even when both are set to auto-renew — an expired certificate throws a hard browser warning that stops visitors before they read a word of your site, and a lapsed domain registration can take a business's entire online presence down overnight. An accessibility pass against WCAG guidelines, since accessibility issues tend to accumulate quietly as pages get added over the years without anyone specifically checking. A privacy policy review, particularly if data-handling practices or the tools collecting customer information have changed since it was last written.
Website Security: The Non-Negotiables
Security isn't a single feature you install once — it's a handful of habits done consistently, and skipping any one of them tends to undo the rest. Patching applications and operating systems promptly is two of the Australian Signals Directorate's Essential Eight mitigation strategies, and it's the single most common gap Patchstack's research points to: 91% of the vulnerabilities found in the WordPress ecosystem in 2025 were in plugins, which is exactly the layer most likely to get skipped when "we'll do it next month" becomes a habit.
Access control, including multi-factor authentication on every admin login and removing accounts for staff who've left, closes off the easiest attack path there is: a reused or stolen password. Given that email compromise and identity fraud sit among the top reported business cybercrime threats in the ACSC's own figures above, this is not a theoretical risk. HTTPS everywhere — not just on a checkout page — encrypts every page a visitor loads, and its absence is now flagged directly in the browser as "not secure," which is a trust problem long before it's a payment-security problem. Backups, covered above under continuous maintenance, double as ransomware insurance: if a site is encrypted and held for ransom, a verified, recent, off-server backup is what makes the difference between a same-day restore and a genuine crisis.
How Often Should You Actually Update Your Website?
The honest answer is that it depends on what's being updated, not a single fixed schedule. Security-relevant software — the CMS core, plugins, and themes — should be checked monthly at minimum, because as the five-hour exploitation window above shows, a known vulnerability doesn't stay theoretical for long once it's public. Content should be updated whenever the underlying facts change: new pricing, a new service, a team member who's left, an outdated testimonial. For an active business that's often more frequent than the technical schedule, not less. Backups and uptime monitoring are the exception to "how often" entirely — they should simply always be running.
Signs Your Website Has Been Compromised
A compromised website doesn't always announce itself with a defaced homepage — more often the signs are quieter and easy to miss unless you know what to look for. Watch for: unexpected redirects sending visitors to another site entirely; new admin accounts in your CMS that nobody on your team created; Google Search Console or a search result itself flagging the site as potentially hacked; a sudden spike in outbound email or unusual server traffic (a common sign of a compromised site being used to send spam); unfamiliar files appearing in your hosting file directory; and a browser security warning appearing where there wasn't one before. Any single one of these is worth acting on immediately — waiting to see if it resolves on its own is how a contained compromise turns into a full rebuild.
DIY vs Outsourced Maintenance
Some of this checklist is genuinely manageable for a business owner; some of it isn't, and being honest about the split saves time and risk. Content updates — new pages, edited copy, refreshed images — are accessible to most business owners through a standard content management system, and there's no reason to pay a developer for a straightforward text change. Technical and security maintenance is a different matter: applying updates safely without breaking the site, interpreting a malware scan result, configuring backups so they'd actually restore cleanly, and diagnosing a performance regression all require specific technical knowledge, and getting them wrong carries real consequences — a bad update can take a site offline, and a skipped patch can be the vulnerability that gets exploited. For most business owners, the practical split is handling content changes in house and outsourcing the technical side to whoever built the site or a dedicated website management plan, rather than attempting the technical work without the background to do it safely.
Building Maintenance In From Day One
A site that's built with maintenance in mind from the start is a much smaller ongoing job than one where security and updates were never part of the original build. If you're planning a new build rather than maintaining an existing one, our guide to website development trends in Canberra covers what that looks like at the build stage, including why cybersecurity needs to be designed in rather than bolted on afterwards. For a site that's already live, a free run through our website audit tool is a fast way to see where it currently stands against the checklist above.
For Canberra and ACT Businesses
Byte Size Labs is based in Canberra, and our website management plans exist because most businesses would rather this whole checklist simply happened on a schedule than be one more thing on an owner's own to-do list. It's month-to-month with no lock-in contract, covering the updates, backups, SSL monitoring, malware scanning, and content work above as a standing service rather than something that only gets attention after a problem shows up.
Where to Start
If you're not sure where your own site currently stands against this checklist, that's a reasonable place to start the conversation rather than something to figure out alone. Get in touch and we'll walk through what's already covered, what's missing, and what a maintenance plan would actually need to include for your site.