Website maintenance checklist for a B2B SaaS site: monthly, quarterly, and yearly.

Why do B2B SaaS teams need a website maintenance checklist?

Website maintenance is the routine work that keeps a site fast, secure, and reliable for visitors: confirming that pages are indexed, that forms deliver leads, that domains and certificates stay valid, that software stays patched, and that content stays true. Maintenance covers four layers: what the site does, such as forms and tracking, what it runs on, how it performs, and what it says. Generic checklists often split these website maintenance tasks into daily, weekly, monthly, and quarterly groups. On a B2B SaaS marketing site, alerts can cover the daily and weekly layer, so people need three rhythms: monthly, quarterly, and yearly.

The reason to write the plan down is that most website problems are quiet. A form stops reaching the CRM, a tag stops firing after a release, a redirect is deleted, a certificate lapses, outdated software goes unpatched, or an old script slows every page, and nobody notices until pipeline drops. Skipping maintenance leaves security vulnerabilities open and lets technical issues pile up until visitors find them before you do. Most websites need some attention every month, because content, tags, and team members change even when the design doesn't, so regular website maintenance has to be scheduled, not remembered. For a B2B SaaS company the website is the center of its digital presence, so a quiet failure there reaches pipeline directly.

Google Search Console emails you when Google finds new issues, but it can't test your forms or tell you which scripts marketing added last quarter. Google also says you don't need to sign in every day; it suggests checking around once every month, or when you make changes to the site's content. That sets a sensible base rhythm for the whole list, and a way to keep your site healthy without daily checks: monthly for breakage, quarterly for drift, yearly for renewals and standards.

This website maintenance checklist assumes one marketing site. If you run multiple websites, such as a marketing site, a documentation site, and a help center, run it once for each. On small sites one person can run the whole list; on complex sites with several languages or domains, add a column that says which domain each check covers.

What should your monthly website maintenance checklist include?

Monthly checks catch breakage before it costs leads. Run the monthly maintenance on the same day each month so the numbers are comparable, and keep the owner's name next to each check. Monthly maintenance should be a short, fixed routine, not a project, and the monthly tasks below are the website maintenance tasks that identify issues before visitors do.

Five details make these checks useful:

1. Test forms by submitting them. Fill in each high-intent form with a test record, then find that record in the CRM with its source fields. A form can look fine on the page and still send nothing downstream, and no report will tell you.
2. Treat 4xx errors seriously. Google says URLs that are already indexed and return a 4xx status code are removed from the index, so a deleted page or a broken redirect can take a ranking page off search engine results pages and cost you search rankings. Fix broken links on your own site first, because you control them, and because a broken internal link is a poor user experience before it is an SEO problem.
3. Read site speed data in the right window. Google sets "good" at a Largest Contentful Paint (LCP) of 2.5 seconds or less, an Interaction to Next Paint (INP) of 200 milliseconds or less, and a Cumulative Layout Shift (CLS) of 0.1 or less, measured at the 75th percentile of page loads. PageSpeed Insights reports real-user data over the previous 28-day collection period, and the Core Web Vitals report in Search Console covers the last 28 days too, so a fix takes about four weeks to validate. Use the monthly check to spot trends in website performance, and use lab tests to confirm a fix sooner.
4. Annotate changes. Search Console allows up to 200 annotations per property and deletes ones older than 500 days, and GA4 allows 1,000 per property. Keep a release log outside both tools, with the date, the change, and who made it, so a dip in Google Analytics has an explanation a year later.
5. Test big changes before they go live. Before any large change, try it on a staging or preview version, save a restore point or backup, and note both in the release log. A staging copy shows layout and form problems that a code review can miss.

Set up uptime monitoring so an outage alerts a person instead of waiting for the monthly review. The monitoring tool matters less than who gets the alert.

Monthly security scans mean different things on different platforms. On a hosted platform such as Webflow, the vendor runs the servers, so your scan covers what you control: user accounts, third-party scripts, and forms. On a WordPress site, a scanner compares core, plugin, and theme versions against known security vulnerabilities. On a headless site, npm audit checks the dependencies, as the headless section below explains. In every case, read the Search Console security issues and manual actions reports as well, and give the results to an owner, because security scans only help if someone reads them.

What should you check every quarter to keep your site secure and fast?

Quarterly reviews are the part of regular maintenance that catches what drifts as people add scripts, change tools, and come and go. This quarterly website maintenance checklist has eight items, and each of these maintenance activities belongs in the release log:

1. Third-party scripts and tags. List every script and tag, with an owner and a purpose, and remove what nobody can justify; that can improve performance and cut load time, and it shrinks the list of code you have to trust. OWASP's guidance on third-party JavaScript says to restrict who can publish in the tag manager and to review tag changes as you would application code.
2. User access. Review user accounts for the content management system, analytics, Search Console, the tag manager, and the CRM, and remove people who have left or changed roles. Two-factor authentication is one of the strong security practices to switch on everywhere: Webflow offers it to every customer, regardless of Workspace plan, and offers single sign-on on Enterprise Workspace plans only. CISA describes multifactor authentication as a layered approach to protecting online accounts and the data in them.
3. Consent and cookies. Compare the cookie banner and the cookie list with the tags that actually fire. The UK ICO says you should carry out regular reviews of your online service and the storage and access technologies it includes, and more often if you make regular changes. Our post on Consent Mode v2 on Webflow covers how to test the setup.
4. Redirects. Look for redirect chains and missing rules after any launch or URL change. For site moves, Google says to keep redirects for as long as possible, generally at least one year, and a redirect that points to a deleted page sends visitors and search engines to an error, which can cost search rankings. Our website redesign SEO checklist covers the rules for a larger change.
5. robots.txt and crawler access. Search Console's robots.txt report shows which robots.txt files Google found for the top 20 hosts on your site, when it last checked them, and whether the fetch worked. Confirm that file is the one you published, so search engines crawl the pages you want them to. If you block AI training crawlers, note that Google says Google-Extended doesn't affect a site's inclusion in Google Search and isn't a ranking signal. Our post on AI crawlers and robots.txt covers the options.
6. Sitemaps. Google uses the lastmod value only if it's consistently and verifiably accurate, and it ignores priority and changefreq. Make sure lastmod changes when a page changes in a significant way, not on every deploy.
7. Speed and performance audit. Compare PageSpeed Insights field and lab results for your key pages with last quarter, because page load speed, load time, and website performance drift as scripts and images are added. Check the field data first, then use lab tests to find the cause.
8. Conversion review. Look at the pages with the most traffic and the fewest demo requests, and pick one test for the next quarter. Our CRO audit guide shows how to choose it.

What should you check every year to keep your site current and accessible?

Yearly maintenance tasks cover renewals, standards, and the content that ages, and they keep your site current and accessible. This yearly website maintenance checklist has six items:

1. Domains. ICANN's Expired Registration Recovery Policy requires registrars to send at least two reminders, about one month and about one week before a domain expires, to the registered name holder. Make sure that contact is a monitored team inbox on a different domain, not one that stops working if the domain lapses, and renew well before the date.
2. Certificates. An expired SSL certificate makes browsers warn visitors before they reach the page, which costs user trust. Webflow renews its hosted SSL certificates automatically as long as your DNS records stay continuously pointed at Webflow. It doesn't renew a custom SSL certificate, which only Enterprise customers can upload, and if your domain uses CAA records they must allow Webflow's certificate providers, Let's Encrypt and Google Trust Services, or issuing and renewal can fail.
3. Plan limits. Compare usage with the plan you pay for. Webflow's pricing page lists 50 form submissions per site and 50 CMS items on the free Starter plan, and 20,000 CMS items on Premium.
4. Accessibility. Re-test key templates against WCAG 2.2 level AA, with a keyboard and a screen reader as well as an automated tool, because the W3C says evaluation tools can't determine accessibility, only assist in doing so. Our Webflow accessibility checklist lists what designers and developers each fix.
5. Analytics settings. Confirm the data retention setting in Google Analytics 4. Standard properties can keep event data for 2 or 14 months, and the setting affects explorations and funnel reports, not standard reports, so a 2-month setting limits how far back you can analyze.
6. Content and legal pages. Run a content audit: update prices, product names, screenshots, statistics, titles, and meta descriptions, and remove or merge outdated content. Check the privacy policy and cookie notice against what the site collects now, and ask counsel what applies if you serve visitors in the EU, the UK, or California, where rules such as GDPR and CCPA can matter. Out-of-date facts mislead buyers, and anyone quoting your page, human or machine, will repeat them.

What changes on a headless Astro and Sanity site?

You take on the software upkeep that a hosted builder handles for you. The rows below sit on top of the monthly, quarterly, and yearly lists.

Node.js says LTS releases typically get critical bug fixes for a total of 30 months, that production applications should only use Active LTS or Maintenance LTS releases, and that from Node.js 27 the release cycle becomes annual. Outdated software is the usual way a headless site falls behind: a framework two majors back gets no security updates, and an old Node.js version stops receiving fixes.

On the content side, Sanity says clients should be configured with an explicit, static API version, and that once Sanity removes a version, calls to it return errors with code 410. Pin the version in your code, and read the deprecation notices before they become outages. Our post on headless CMS SEO covers what else changes for search.

What changes if the site runs on WordPress?

A WordPress site adds routine work of its own, because the content management system and its plugins and themes each have their own updates. WordPress's developer documentation says existing installations receive minor core updates by default, that fresh installations created on WordPress 5.6 or later receive major core updates too, and that plugins and themes update automatically only in special cases by default. Plugin updates and theme updates therefore need a person, or an automatic updates setting you have chosen on purpose. Check for security patches at least monthly, and sooner when a fix is announced for something you run, because updating promptly helps close security gaps.

Review your plugins and themes each quarter, because sites accumulate plugins over time, and run plugin updates on a fixed day each month. WordPress's hardening guide says to keep plugins updated and to delete a plugin you are not using, so remove inactive plugins and unused plugins rather than leaving them installed. Unused plugins add code that still needs updates, and outdated software is the first thing a security scan should flag. The same guide warns that older versions of WordPress are not maintained with security updates, so the core software needs to stay on a maintained release. Updates and tight user access are two of the practical defenses against website hacks.

If plugin upkeep takes more time than the site is worth, our WordPress to Webflow migration guide covers what a move involves.

How do you back up a B2B SaaS website, and how do you test a restore?

Every platform backs up differently, and none of them replaces a restore you have tried. The table shows what each setup gives you and what to add.

CISA's backup guidance for businesses describes a trusted rule of thumb: three copies of important files, on two types of storage media, with one copy off site. It also says to choose a backup solution that runs automatically and regularly, and to run scheduled recovery tests to verify backup integrity. For a website, verify backups every month by restoring a recent one to a test environment, opening the key pages, and submitting each main form. Automatic backups can stop without warning after a plan, host, or credentials change, and the monthly restore test is how you find out.

Who should own each task in a website maintenance plan?

One named person per row, or the checklist won't run. Many maintenance tasks fail because nobody owns them, so decide which tasks belong to marketing, which belong to developers, and which belong to IT before the first review.

In a small business or an early-stage SaaS team, one person may own every row, and on larger sites you can split the table by team. Either way, a website maintenance plan is ongoing technical care with names attached: it assigns the maintenance tasks to owners, and each of these maintenance activities gets a date and a line in the release log. On Webflow, save a restore point by hand before any large change, and note it in the log.

We run ongoing Webflow support for B2B SaaS companies, so we have an interest in this topic. For how a support plan covers these checks, see our ongoing website support page.

Questions about website maintenance