Website and online shop maintenance: what needs doing regularly?

Website maintenance is a set of monthly and quarterly tasks. Every month you update the content management system and plugins, check the backups and test the forms, and on an online shop the payment as well. Every quarter you review the certificate, the speed, the server's PHP version and the legal texts.

If this slips, the damage rarely shows in the first month. But Google can flag a hacked site in its search results, unsupported software gets no security fixes, and without a backup there is nothing to restore.

This article covers the period after launch. What happens up to launch is described in our article on the website development process.

Monthly: core and plugin updates

According to the WordPress documentation, since version 5.6 new installations update automatically for both minor and major core releases. Automatic updates for plugins and themes, however, only run by default in special cases, typically for a critical security issue.

Yet that is exactly where the risk sits. The security company Patchstack reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91 percent of them in plugins and 9 percent in themes. According to the report, roughly half of high impact vulnerabilities are exploited within 24 hours.

So review plugin updates at least once a month, and do not leave security fixes for the next round.

Monthly: backups, forms, payment

The WordPress documentation says a full restore needs both the database and the files. It suggests weekly backups for a smaller site and daily ones for a site with frequent new content, plus 3 to 5 recent copies in different places, such as the hosting account, cloud storage and a local computer.

It also recommends an occasional manual backup on top of the automatic ones, to make sure the process is working. Our own advice: now and then, test a restore on staging.

Send a test message through every form and check that it arrives. On an online shop, place a test order and follow the payment and confirmation email through.

Online shops: update on staging first

The WooCommerce documentation recommends a fresh backup before updating and, where possible, a staging site: a copy of the live shop where an update does not yet affect customers.

There you update WooCommerce, the extensions, the payment gateways and the theme together. Then you test the key customer steps: product page, cart, checkout, payment, shipping, taxes and order emails.

If you are still choosing a platform, our comparison of Shopify, WooCommerce and a custom online shop also shows how much operations work to expect with each.

Quarterly: certificate and server

Under CA/Browser Forum rules, public SSL/TLS certificate validity is shrinking in steps: at most 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. It used to be 398 days.

Each quarter, check that auto renewal works and when the current certificate expires. According to Firefox Help, when a certificate has expired, the browser shows the visitor a security error. Let's Encrypt stopped sending expiry reminder emails on 4 June 2025, so do not rely on them.

Check the server's PHP version too. Security support for PHP 8.2 ends on 31 December 2026. WordPress recommends version 8.3 or newer and warns that unsupported versions may expose a site to security vulnerabilities.

Quarterly: speed

Google's Core Web Vitals call a page good when the largest content element appears within 2.5 seconds (LCP), the response to an interaction takes at most 200 milliseconds (INP) and layout shift stays at 0.1 or below (CLS).

web.dev recommends measuring this at the 75th percentile of page loads, separately for mobile and desktop. Every new plugin, large image or third party tracking script can affect it, so measure again each quarter.

Quarterly: legal texts

If you add a new form, newsletter or analytics tool, the privacy notice has to be updated too. According to the European Commission's GDPR summary, people must be told, among other things, the purpose and legal basis of the processing, how long the data is kept and who receives it.

For online shops, accessibility matters too. The EU Accessibility Directive applies to services provided to consumers after 28 June 2025, which includes online shops that were already running. Microenterprises providing services are exempt: fewer than 10 staff and an annual turnover or balance sheet total of no more than EUR 2 million.

What happens if it slips

According to Google, the "This site may be hacked" label appears in search results when a hacker may have changed the site or added spam pages. It stays until the owner fixes the problem, requests a review in Search Console and Google confirms the fix.

Google's description says a hacked site can be injected with malicious code or redirect visitors elsewhere. Unsupported PHP gets no security fixes, and without a backup there is nothing to restore after an incident.

Who should do it?

Part of this list you can handle yourself, but updates, backups and the server need regular attention. Brauniq develops and maintains websites and online shops, and also works on server operations. If you would rather keep all of this in one place, see our web development service.

Sources

• WordPress: Updating WordPress (automatic updates)
• WordPress: WordPress Backups
• WordPress: Requirements (recommended PHP version)
• Patchstack: State of WordPress Security in 2026 (2025 data)
• WooCommerce: How to update WooCommerce
• CA/Browser Forum: Ballot SC-081v3 on reducing certificate validity periods
• CA/Browser Forum: Baseline Requirements, section 6.3.2
• Firefox Help: certificate errors (SEC_ERROR_EXPIRED_CERTIFICATE)
• Let's Encrypt: ending expiration notification emails
• PHP: Supported Versions
• web.dev: Web Vitals
• European Commission: what information must be given to individuals (GDPR)
• EUR-Lex: Directive (EU) 2019/882 on the accessibility requirements for products and services
• Google Search Help: "This site may be hacked"
• Google Search Central: hacked sites