Define maintenance owners, prioritize updates, check essential journeys and prepare recovery, with clear actions when something goes wrong.
Launch ends when the website works; maintenance begins when something changes afterward. A component is updated, a colleague leaves, a certificate approaches expiry or a form stops reaching the team. Business owners need a short plan connecting each task to a responsible person and evidence of completion. The aim is to reduce problems, detect them and recover. No checklist provides absolute security.
Record what you operate and who owns it
List the domain, hosting, application, database, email, payment services and analytics. For each, record the account owner, technical contact, renewal date and recovery method. Separate content editing from user and server administration where the system allows it. When a colleague leaves, review their accounts, sessions and accessible keys through an explicit handover process.
OWASP's multifactor authentication guidance discusses additional authentication and carefully designed recovery. Enable available protection on registrar, hosting and administration accounts, and store recovery codes securely. Do not assume every system offers the same features; establish alternatives and emergency access arrangements where needed.
Set a schedule around business impact
Consider a fictional service company dependent on contact requests. A meaningful check sends a test enquiry and verifies its agreed destination. Looking at the homepage would miss that failure. Adjust this starting schedule to workload and data sensitivity; urgent security alerts should not wait for a monthly review.
| Suggested timing | Task and evidence |
|---|---|
| Weekly | Check contact, login and service links; record results |
| Monthly | Review access, renewals, storage and planned updates |
| Before major changes | Prepare recovery, a separate trial and written rollback steps |
| On a security alert | Promptly assess exposure, impact, treatment and ownership |
Update with checks that protect everyday work
OWASP's vulnerable dependency guidance covers remediation and testing fixes. Identify the components and versions actually affected. Prioritize exposure of data or accounts. If immediate updating is blocked, agree an interim measure and a dated plan to address the cause.
- Record why the update is needed, expected changes and potentially affected functions.
- Confirm recovery readiness using the backup checklist; a successful copy job alone is insufficient.
- Trial the update separately using test data, with messages and real charges disabled.
- Check login, requests, forms, images and languages according to the site's actual functions.
- After deployment, watch results and record the version, date and person accepting the change.
Understand what each protection covers
OWASP's TLS guidance addresses protecting HTTPS connections. This does not establish encryption of stored files or databases, or independently prevent incorrect permissions. Ask for documentation of actual controls. For shops, include success, failure and server verification checks from the secure checkout guide.
Prepare a response when something fails
Record the time, symptoms and recent changes, then contact the agreed technical owner. Preserve relevant investigation records with restricted access. A qualified responder should determine what to isolate, disable or rotate, and address the cause before restoring a service that could repeat the problem. After recovery, record the incident and changes to the plan.
Use contact to agree support hours, incident priorities, included work and separately quoted tasks. Buying a website does not automatically activate every maintenance service described here. Reuse the launch checklist after major changes and keep a concise record of what was actually verified.