Small websites fail quietly. A certificate expires on a Tuesday, a form stops sending email, a backup job quits writing files, and nobody notices for weeks. A short monthly routine catches nearly all of it. Set a recurring calendar reminder and work through five checks in order. Once the habit is in place, the whole pass takes about five minutes.
Confirm the backup ran
Open wherever backups are stored (a folder in the host’s control panel, a cloud drive, a bucket) and look at the date of the newest file. A backup plugin can look healthy in its dashboard while its last successful run was in March. The file date is the truth.
Two habits make backups worth having. Keep the copies off the server, so a host problem can’t take the backup with it. And once or twice a year, restore a copy somewhere temporary and confirm the site comes back. A backup that has never been restored is untested.
Check the certificate date
An expired TLS certificate puts a full-page browser warning in front of every visitor, and it happens to small sites more often than it should.
From any terminal, the expiry date is one command (swap in the site’s domain):
“` echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate “`
Most small sites run certificates from Let’s Encrypt, the free certificate authority whose certificates are valid for 90 days and renew automatically about a month before expiry. So the monthly check is simple: if the date returned is more than a fortnight away, all is well. If expiry is close and nothing’s renewed, run `certbot renew –dry-run` to see what the renewal job is choking on, and fix it today.
Find the broken links
Pages move, other sites reorganize, and old links die. This decay has a name, link rot, and it accumulates without any visible symptom until a visitor hits a 404.
A terminal command finds the dead ones without any service:
“` wget –spider -r -l 5 https://example.com “`
That walks the site and prints every URL that failed. Online checkers and link-scanner plugins do the same job for people who would rather click than type. Fix what turns up: repoint links that moved, delete entries pointing at pages that are gone for good.
Work through the updates
Log in once a month and clear pending updates: core software first, then plugins and themes. Update security releases within a few days of release rather than waiting for the monthly visit, since those are the ones attackers probe for. After any major version jump, click through the home page and one form before closing the tab. If something breaks, the fresh backup from step one turns a panic into a rollback.
Make sure something is pinging
The one check that runs without anyone remembering it: an uptime monitor. Services like UptimeRobot, Freshping, and StatusCake all have free tiers that ping the site every few minutes and email when it stops answering. Five minutes to set up, and then outages get noticed at 2 a.m. instead of at the next monthly visit. Add the site’s main page and its checkout or contact page, and set alerts to reach a phone as well as an inbox.
Keep a one-line log
After each pass, append one line to a plain text file: date, newest backup, certificate expiry, updates applied, anything found. Next month’s line sits beside last month’s, and patterns show up that no single check reveals, like certificate dates creeping closer because renewal is quietly broken.
The routine is dull on purpose. Five quiet minutes a month is cheap insurance against the slow, silent failures that hurt small sites the most.