The Website Maintenance Tasks You Keep Forgetting to Do
Why website maintenance keeps falling through the cracks
Most website problems are not caused by bad decisions. They are caused by nobody checking. A certificate quietly expires. A link that worked fine in March starts returning a 404 in July. A sitemap references pages that were deleted months ago. None of these things are hard to catch. They are just easy to forget, because they do not announce themselves until something breaks in front of a visitor or a customer.
The fix is not to try harder to remember. It is to build a short list of checks that run on their own schedule, so the information reaches you before a problem becomes visible to anyone else.
Here is a practical rundown of the checks worth putting on autopilot, why each one matters, and roughly how often to run it.
Certificate and connection health
SSL certificate expiry
An expired SSL certificate is one of the most avoidable outages on the internet. Browsers throw a full-page warning, visitors bounce, and if the certificate belongs to an API or an internal tool, integrations can fail silently. The trouble is that certificates are usually issued once a year (or every 90 days with automated providers) and then forgotten.
What to check regularly:
- Expiry date, ideally with a warning window of 14 to 30 days out
- Certificate chain completeness, since a missing intermediate certificate can break trust on some devices even when the main cert is valid
- Hostname match, especially after adding subdomains or changing hosting providers
Run this check weekly at minimum. If you manage several domains or subdomains, a shared calendar reminder is not reliable enough. Each domain needs its own check, because renewal dates rarely line up.
Link and content integrity
Redirect chains and loops
Redirects accumulate. A page moves once, then moves again during a redesign, then again after a URL structure change. Each move adds another hop to the chain. Search engines and browsers can follow a few hops fine, but long chains slow down page loads, waste crawl budget, and occasionally loop back on themselves, which breaks the page entirely.
Audit your redirects when:
- You migrate a site or change your URL structure
- You merge or retire old content
- Traffic to a specific page drops unexpectedly, since a broken redirect is a common silent cause
A good redirect audit checks a full list of URLs at once and reports how many hops each one takes and whether any of them loop. Anything over two or three hops is worth fixing directly rather than leaving the chain in place.
Sitemap validity and freshness
Your sitemap is the map you hand to search engines. If it is stale, it either points to pages that no longer exist or omits pages you have added since the last update. Both problems quietly hurt discoverability.
A useful sitemap check looks at:
- Whether the XML is valid and correctly formatted
- How recently it was generated or updated
- Whether spot-checked URLs inside it actually resolve, rather than pointing to deleted pages
If your site publishes content regularly, check the sitemap monthly. If it is mostly static, quarterly is usually enough, but always re-check right after a content purge or a site restructuring.
Performance checks that affect real users
Page weight
Heavy pages lose visitors before they ever see your content. Images that were never compressed, scripts loaded from three different tracking tools, and fonts pulled from external servers all add up. Most site owners do not notice this happening because it creeps in gradually, one plugin or one embed at a time.
A page weight check should tell you:
- Total page size and how it breaks down by resource type (images, scripts, fonts, stylesheets)
- Which individual assets are the biggest contributors
- Whether load time has crept up compared to a previous check
Run this after any redesign, after adding new embeds or widgets, and on a baseline schedule of every month or two so you catch slow creep before it becomes a real slowdown.
Checks for anyone running APIs or AI integrations
If your site or product exposes an API, or connects to AI tools through a protocol like MCP (Model Context Protocol), you have a newer category of maintenance to think about: interfaces that can change without a visible signal.
API documentation and security coverage
An OpenAPI spec is only useful if it accurately describes what the API does and how it should be secured. Specs drift out of date as endpoints are added or changed, and security requirements (like which endpoints need authentication) are easy to leave undocumented. Reviewing your spec periodically against the live API catches both documentation gaps and security oversights before someone else finds them for you.
MCP server tool inventory and drift
If you run or depend on an MCP server, its list of available tools is effectively a contract. When that list changes, whether because a tool was renamed, removed, or its parameters changed, anything built against it can break without warning. Two checks matter here:
- A full inventory of what tools an MCP endpoint currently exposes
- A comparison against the last known inventory, so you get flagged the moment something changes
This is especially important if you did not build the MCP server yourself and are relying on someone else’s endpoint. You will not get a changelog. You will just get a broken integration, unless you are checking for the diff yourself.
Turning this into a system instead of a memory exercise
The common thread across every check above is timing. None of these problems are hard to detect. They are only hard to detect on time, because they require someone to remember to look, and none of us are reliable narrators of our own to-do lists.
A workable system looks like this:
- List every check that applies to your site (not all of the above will apply to everyone)
- Assign each one a realistic frequency: weekly for anything with a security or uptime risk, monthly or quarterly for the rest
- Put the check on a schedule that runs without you starting it manually, whether that is a cron job, a scheduled script, or a monitoring service
- Make sure the output actually reaches you: an email, a message in a channel you check, or a dashboard you glance at, not a file sitting in a folder nobody opens
The goal is not perfection. It is catching the certificate before it expires, the redirect before it loops, and the sitemap before it goes stale, all without adding another item to a list you already are not getting through. Once the checks run themselves, site maintenance stops being a chore you dread and becomes something you barely think about, which is exactly the point.
For the complete, structured playbook on this topic, see Website Checks You Can Automate in our library. New here? Start with our free guide.