A website maintenance plan should tell an authorized backup person what must be protected, who controls it, when it must be checked, and how to prove the work happened. A calendar alone is not enough. The plan needs an ownership map, a settings baseline, decision history, and recovery evidence so that a domain renewal or access loss does not become a discovery exercise.
Build an asset and account map
List the domain registrar, DNS provider, hosting platform, content management system, source repository, deployment service, analytics, Search Console, forms, email delivery, payment services, certificate automation, and backup storage. For each asset, record the business owner, technical administrator, backup administrator, account identifier, renewal date, billing owner, support route, and where recovery material is held. Reference a credential vault rather than copying passwords or tokens into the plan.
Capture decisions and the settings baseline
Maintain a brief decision register for choices such as hosting, update windows, backup retention, deployment approval, analytics, form retention, and emergency rollback. Next to it, keep a baseline of important settings: DNS records, canonical hostname, redirects, access roles, automated updates, cache behavior, monitoring targets, and backup schedules. Each entry needs a reason, last verification date, evidence link, and rollback note.
Search Console illustrates why ownership details deserve their own section. Google defines verified owners, delegated owners, full users, restricted users, and associates. It says a property needs at least one verified owner for users to retain access (Search Console users and permissions). Record which people hold each role and why. Review old verification tokens carefully because removing an owner in the interface does not necessarily remove every token that could be used to verify ownership again.
Schedule maintenance by risk
Use different intervals instead of one monthly checkbox. Daily or automated checks can cover uptime, certificate errors, failed jobs, and form delivery. Weekly checks can cover backups, security alerts, updates, and checkout or lead paths. Monthly checks can cover performance trends, broken links, access lists, and pending renewals. Quarterly checks can test a restore, review vendors, and rehearse owner handoff. State the evidence required for completion, such as a dated restore log rather than "backup checked."
Protect ownership continuity
Google's ownership guidance says verification must remain valid and notes that more than one verification method can reduce the risk of losing access (Search Console ownership verification). Apply that lesson narrowly: document the active verification methods, who can maintain them, and what should happen when staff or vendors leave. Do not remove DNS records, HTML files, or tags until an authorized owner confirms their purpose and a replacement path.
Test the plan and log changes
Have the backup administrator locate the registrar, confirm access without changing production, find the last successful backup, trace the deployment route, and explain the rollback procedure. Record the test date and gaps. Every production change should then add requester, approver, implementer, before-and-after values, validation evidence, and rollback status to a change log. This turns the maintenance plan from a promise into a repeatable operating record.
Sources
- Managing owners, users, and permissions — Google
- Verify your site ownership — Google