A maintenance plan should describe how the website stays accurate, secure, recoverable, and observable. An annual review compares that plan with the system that actually runs today. It is an evidence pass, not permission to change DNS, hosting, security, or payment settings.
1. Map ownership and boundaries
Record the owner for the domain, DNS, hosting, source repository, deployment service, content system, analytics, forms, email routing, and third-party scripts. Note renewal dates and approved support contacts without copying credentials. Confirm which site and deployment target are in scope so maintenance work cannot affect another domain or application.
2. Inventory software and dependencies
List the framework, runtime, package manager, plugins, themes, integrations, and operating environment. Compare the inventory with the lockfile and production build record. Flag unsupported or unknown components for review. CISA guidance emphasizes applying software updates because updates can fix security flaws and bugs, but production updates still need testing, approval, and a rollback path.
3. Test backups and recovery evidence
Identify what is backed up: content, database, uploaded files, source code, configuration, and deployment artifacts. Record schedule, retention, destination, encryption, and owner. Open a recent backup and run the provider's integrity check where available. A successful job log is not the same as a restorable backup. Use a safe test environment for restore drills and stop before overwriting production.
4. Review monitoring and incident routes
Check uptime monitoring, certificate alerts, error logging, form-delivery monitoring, security notifications, and who receives them. Confirm that the contact path is still monitored. Test alerting only through an approved non-destructive method. Record missing coverage and stale recipients rather than silently changing notification routes.
5. Inspect public behavior
Open key pages in a private browser on mobile and desktop. Verify HTTP success, navigation, forms, downloads, privacy and policy links, canonical URLs, and intentional missing-page behavior. Google recommends returning a true 404 for missing content and using permanent redirects when a page has a clear replacement. Check status codes directly rather than inferring them from a styled page.
6. Review search maintenance
Inspect sitemap generation, robots rules, canonical tags, structured data, indexing alerts, and the verified Search Console property. Google says Search Console can help owners understand crawling and indexing and suggests checking around monthly or when site content changes. Keep search observations separate from promises about ranking.
7. Examine change control
Review who can deploy, how changes are tested, where release hashes are recorded, and how rollback works. Google recommends testing site moves, mapping old to new URLs, changing one major thing at a time, and monitoring both old and new locations. Even when no move is planned, the same discipline helps prevent an annual cleanup from bundling unrelated risky changes.
8. Update the plan with verified state
Record the review date, assets, owners, versions, backup evidence, monitoring results, public checks, search observations, risks, approved actions, and next review date. Label items as observed, prepared, deployed, or live. The plan is current only after important live behavior has been reread and the recovery evidence has been checked.
Sources
- Secure Our World: Software Updates — Cybersecurity and Infrastructure Security Agency
- Get started with Search Console — Google Search Central
- Troubleshoot crawling errors — Google Search Central
- How to move a site — Google Search Central