Monthly Website Maintenance Checklist

□ Confirm scheduled backups completed and are stored separately from the production site. □ Check that databases, uploaded media, configuration and required secrets are covered appropriately. □ Perform a documented sample restore on a safe environment; a successful backup message does not prove recoverability. □ Verify retention and deletion settings. □ Record the recovery owner and the date of the last full exercise.

□ Inventory the content management system, themes, plugins, libraries and hosted services. □ Apply security updates according to risk and vendor guidance, using tested rollback steps. □ Remove unsupported components and unused administrator accounts. □ Confirm multifactor authentication for privileged access. □ Review certificate health, security alerts and unexpected file or configuration changes. □ Never delay a critical fix merely to keep the monthly schedule tidy.

□ Submit every public form using test data and confirm the intended team receives it. □ Check validation, success messages, email or CRM routing and response ownership. □ Test tap-to-call numbers, email links, map links and appointment buttons on mobile. □ Confirm third-party scheduling availability and fallback contact instructions. □ Verify that forms request only necessary information and use approved handling. □ Do not enter real patient information into analytics or test tools.

□ Review uptime, error rates and slow server responses. □ Test the homepage, contact page, appointment route and top service pages on mobile and desktop. □ Review Core Web Vitals field data where available and use lab tests for diagnosis. □ Investigate large images, new scripts, layout shifts and delayed interactions. □ Compare with the previous baseline so a redesign does not quietly become slower.

□ Review Search Console messages, indexing changes, sitemap processing and manual actions. □ Inspect unexpected changes in clicks, impressions, queries and important landing pages. □ Find broken internal links, accidental noindex directives and redirect chains. □ Keep the sitemap limited to intended canonical pages. □ Reconcile website name, address, phone and hours with the Google Business Profile. □ Update special hours before holidays rather than after a patient reports an error.

□ Confirm clinician biographies, qualifications, services, locations, prices or offers and finance statements are current. □ Route clinical pages due for review to an appropriate dentist. □ Check cited links and replace superseded guidance. □ Remove outcome guarantees, stale superlatives and unsupported claims. □ Review emergency language so the website does not imply continuous monitoring. □ Update the reviewed date only after an actual review.

□ Run automated checks as one part of the review. □ Complete keyboard-only checks for navigation, dialogs and forms. □ Verify visible focus, headings, labels, error handling, contrast, zoom and reflow. □ Check new images for appropriate alternative text and new videos for captions. □ Include booking widgets and downloadable documents. □ Retest previously fixed high-impact barriers.

□ Inventory tags, pixels, chat tools, call tracking and embedded services actually loading on the site. □ Remove tools with no current owner or approved purpose. □ Confirm consent and notice behavior against the practice's reviewed requirements. □ Check that analytics events do not capture form contents, patient identifiers or sensitive URL parameters. □ Review vendor access and material contract or subprocessors changes. □ Escalate suspected exposure through the incident process rather than the marketing backlog.

□ Review new feedback and unresolved escalations. □ Sample public responses for privacy and tone. □ Check that review invitations remain neutral and incentive-free. □ Confirm profile photos and service information still represent the location accurately. □ Share recurring experience themes with the operational owner.

□ Create a dated maintenance record with evidence links. □ Rank findings by patient impact, privacy or security risk and effort. □ Assign one owner and due date to every accepted fix. □ Verify completed work instead of closing an item on a promise. □ Record intentional deferrals with a reason and review date. □ Compare key indicators with prior months without claiming causation from simple correlation.

Google Search Console tasks: https://support.google.com/webmasters/answer/10351509 Google Core Web Vitals: https://developers.google.com/search/docs/appearance/core-web-vitals DOJ web accessibility guidance: https://www.ada.gov/resources/web-guidance/ CISA Secure Our World resources: https://www.cisa.gov/secure-our-world CISA backup guidance: https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf