Why set-and-forget sites decay
A website is not a brochure you print once. It is software running on other software, and every layer beneath it keeps changing. Plugins release security patches. The platform updates. Certificates expire. A form provider changes its rules and your contact form starts silently failing.
The decay is invisible from the owner's chair because the homepage still loads. Then you notice bookings are down, and the eventual diagnosis is that the quote form has been erroring out for four months. Nobody complains about a broken form. They just call your competitor.
A disciplined hour each month prevents nearly all of this. Here is the actual checklist we run.
The monthly checklist
- Update the platform, theme, and plugins, after confirming a current backup exists.
- Verify backups by opening one, not by trusting the green checkmark. A backup you have never opened is a hope, not a backup.
- Check uptime. A free monitoring service pings your site every few minutes and emails you when it goes down, so a hosting outage is not discovered by a customer.
- Submit every form on the site and confirm the message actually arrives in your inbox.
- Click your phone number, email link, and map link on a real phone.
- Run a broken-link check and fix or redirect anything dead.
- Confirm the SSL certificate, the padlock in the browser, renews with time to spare.
- Spot-check page speed on your busiest page.
With practice this takes 45 to 60 minutes.
The quarterly extras
Every third month, add these:
- Content accuracy: hours, prices, staff, services. Wrong hours on a website quietly burn trust every single week.
- Access review: remove logins for anyone who no longer works with you, including the old marketing agency. Stale accounts are one of the most common ways sites get hijacked.
- Plugin audit: delete deactivated plugins entirely, because disabled code is still attack surface.
- A restore drill: actually restore a backup to a test location once or twice a year. The first time you test restores should not be the day you desperately need one.
- Review your Google Business Profile and analytics for anything strange. A traffic cliff usually has a technical cause worth finding.
The silent killer: broken contact forms
Of everything on the list, form testing pays for the whole habit. Forms fail quietly: an email provider tightens its spam rules, a plugin update changes a setting, a certificate hiccups, and submissions stop arriving while the form still shows the visitor a cheerful thank-you message.
The visitor believes they contacted you. You believe nobody is interested. Both of you are wrong, and the damage compounds weekly. When we take over maintenance of an existing site, a dead or misrouted form is one of the most frequent problems we find, sometimes with months of lost enquiries behind it.
Test with a real submission, from a non-company email address, and confirm receipt end to end. Two minutes, monthly, every form on the site.
Do it yourself or pay someone
Doing this yourself costs about an hour a month plus the discipline to actually do it. A recurring calendar block on the first Monday of the month works better than good intentions.
Paying someone typically runs $50 to $250 per month depending on site complexity, and a legitimate plan should include everything above plus small content edits and a priority lane when something breaks. Ask any provider two questions: exactly which checks run monthly, and whether you get a short report proving they happened. No report usually means no checks.
HashWhales runs this checklist for client sites across the DMV, and the report is one page a business owner actually reads.
What to do next
- Right now, submit your own contact form and time how long the message takes to reach you. This finds the worst problem in five minutes.
- Set up a free uptime monitor. It takes about ten minutes.
- Check your SSL expiry date and note who renews it: you, the host, or nobody.
- Put a monthly hour on the calendar and run the list above, or hand the checklist to whoever maintains your site and ask them to confirm each item in writing.
- If nobody has touched the site since it launched, start with a full backup before you update anything.