What is website maintenance, and what should it include?

Website maintenance is the regular checking and fixing that keeps a website working after it is built. For a small business, the most important parts are the ones that take a whole site down if they are missed: renewing the domain, keeping the security certificate current, keeping the hosting paid and updating the software. In October 2026, Cobalt Bloom checked the website link on the Google listings of small businesses in Los Angeles and Chicago. Of the ones it could check, 7.6% sent customers to a website that did not work.

Updated: October 23, 2026. Written by Eric Levine, founder of Cobalt Bloom.

What are the key findings?

• 7.6% of the websites did not work. Of 2,398 independent small-business websites linked from Google listings in Los Angeles and Chicago that Cobalt Bloom could check in October 2026, 5.6% were broken outright, 1.3% had lost their web address, and 0.7% showed a placeholder such as "coming soon."
• Four working sites had been hacked. Three law firms and an accounting firm had casino spam on their sites. On three it was hidden from visitors; on the fourth it was published as blog posts in the firm's name.
• Broken links were common. 13% of the 82 Los Angeles small-business home pages Cobalt Bloom could read had at least one link that led nowhere.
• Footers age. Of the sites with a fixed copyright year in the footer (not one filled in by a script), 22% still showed 2024 or earlier.

How did Cobalt Bloom check?

Cobalt Bloom opened the website link on each Google listing the way a browser would, in October 2026. The listings were for ten kinds of business, from dentists and plumbers to restaurants and law firms, within a little over a mile of ten neighborhoods in Los Angeles and Chicago. Chains, businesses Google lists as closed, and listings with no website were left out. A link that failed was tried twice more. That gave 2,398 websites to check; another 256 blocked the automated check and were left out.

Cobalt Bloom also checked every link on the home pages of 95 Los Angeles small-business websites from its earlier study (https://getcobaltbloom.com/guides/what-ai-tools-find-on-small-business-websites); 82 could be read. Links to Facebook, Instagram and Yelp were not checked, because those sites block automated checks.

These are one day of results in two cities, from an automated check rather than a person clicking, and "closed" means closed on Google's listing. The 7.6% could be off by about a point either way. The 95 sites were picked because their websites worked, so the real share with broken links is probably higher than 13%.

What should a business owner do before any website maintenance?

Get the logins for the domain, the hosting and the website itself, because almost every maintenance step starts with logging in. Three things to find and write down:

1. Who holds the domain. ICANN's lookup (https://lookup.icann.org/en) shows the registrar for any web address. Log in to that company to confirm the account is the owner's. If that isn't possible, the domain may be held by whoever built the site.
2. Who hosts the site. It is often on the same bill as the domain. Squarespace and Wix host the sites built on them.
3. How to log in to the site. For WordPress, it is usually the web address followed by /wp-admin.

If someone else built the site, ask them for these logins, or to add the owner as an owner. Without them, none of the other steps can be done.

What should website maintenance include?

Website maintenance should include eight things: renewing the domain, keeping the security certificate current, keeping the hosting paid, updating the software, watching for hacks, backing up, checking links, and keeping the Google listing's website link and business information current. This guide starts with the problems that take a whole site down, because those are what Cobalt Bloom found on real small-business sites.

1. Why does renewing the domain matter?

If a domain is not renewed in time, the web address stops working, and after a while anyone can buy it. A domain is a business's web address, such as yourbusiness.com, rented by the year from a registrar such as GoDaddy or Squarespace. ICANN says a domain that is not renewed or restored after it expires may be made available for registration on a first-come, first-served basis (https://www.icann.org/resources/pages/expired-2013-05-03-en).

That happened to about 3% of the sites Cobalt Bloom checked. For 1.8%, the address no longer led to any website at all. Another 1.3% had lost the domain: most showed a parking page (a page of ads that domain sellers put up) or were listed for sale, and some had been bought by gambling sites. Google treats buying an expired domain mainly to rank low-value content on it as spam (https://developers.google.com/search/docs/essentials/spam-policies). The Google listing keeps sending customers there until the owner changes it.

To act on it: log in to the registrar, turn on auto-renew, and check that the card on file has not expired. Note the renewal date somewhere visible.

2. What happens when a security certificate expires?

When a security certificate expires or does not match the web address, browsers show visitors a warning instead of the site. The certificate is what lets a browser open a site over a secure connection, the "s" in "https." 1.0% of the websites Cobalt Bloom checked showed a warning like that, or would not open a secure connection at all. Most hosting companies and website builders renew the certificate automatically.

To act on it: open the site in Chrome on a phone. If the address bar says "Not secure" or "Dangerous," something is wrong (https://support.google.com/chrome/answer/95617), and it is a job for whoever hosts the site.

3. What happens when hosting lapses or the site goes down?

When hosting lapses or the hosting company's computers fail, visitors get an error page, or a "this account has been suspended" page, instead of the business's site. Hosting is the service that stores a website and shows it to visitors. 2.3% of the websites Cobalt Bloom checked showed an error page, most often "page not found." Another 0.5% did not load at all, and 0.7% showed a placeholder page. Google removes pages that show "not found" from its results, and eventually drops pages that keep showing other errors (https://developers.google.com/crawling/docs/troubleshooting/http-status-codes). Cobalt Bloom's guide to why websites don't show up on Google is at https://getcobaltbloom.com/guides/why-isnt-my-website-showing-up-on-google.

To act on it: keep the hosting on auto-renew with a current card, and open the site once a month, including the link on the Google listing.

4. How do you keep a website's software updated?

Turn on automatic updates, or update the main program and plugins every month. A site built on WordPress or a similar system has a main program plus plugins, small add-ons that handle things like contact forms and galleries, and each gets updates that close security holes. WordPress says to always run the latest version (https://wordpress.org/documentation/article/updating-wordpress/). Website builders such as Squarespace and Wix usually handle updates themselves. Delete unused plugins, and use a strong, unique password for every account that can log in. If nobody has updated the site in years, back it up first and update it with care, because a big jump can break things.

5. How do you spot a hacked website?

Check Google Search Console's Security issues report and search Google for spam on the site, because a hacked site can look completely normal to its owner. The four hacked sites Cobalt Bloom found were all built on WordPress, and all four still looked like the business's own site. Someone had broken in and added links to online casinos, which are meant to help the casino sites rank higher on Google. On three of the sites, the links were pushed off the edge of the screen or tucked inside a hidden box, so visitors never saw them; on the fourth, they were published as blog posts in the firm's name. Older copies of these sites saved by the Internet Archive, a free library of saved web pages, did not have the spam. Google's spam policies describe both kinds (https://developers.google.com/search/docs/essentials/spam-policies).

1. Set up Google Search Console (https://search.google.com/search-console), Google's free tool for site owners. Its Security issues report says if Google finds the site has been hacked (https://support.google.com/webmasters/answer/9044101).
2. Search Google for site:yourbusiness.com casino, with the business's own web address and no "www," then with "slot" instead of "casino." Pages the owner did not write mean the site has probably been hacked. No results is a good sign, but not proof.
3. Google's guide to fixing a hacked site is at https://web.dev/articles/hacked. It is a job most owners hand to a professional.

6. How should a small business back up its website?

Turn on automatic backups, keep copies in more than one place, and know how to restore one before it is needed. A backup is a copy of the site that can be brought back after a bad update, a hack or a mistake. WordPress says to back up regularly, and always before an update (https://developer.wordpress.org/advanced-administration/security/backup/). Most hosting companies offer automatic backups.

7. How common are broken links on small-business websites?

13% of the small-business home pages Cobalt Bloom could read had at least one broken link, and 8.5% had one pointing to their own site, such as a contact or booking page. A broken link sends a visitor to a page that no longer exists. Pages often break when a site is redesigned; Cobalt Bloom's guide to redesigning without losing Google rankings is at https://getcobaltbloom.com/guides/how-to-redesign-a-website-without-losing-seo. Once a month, click through every menu item and the buttons on the home page.

8. Why keep the Google listing's link and business information current?

The website field on a Google Business Profile is how many customers reach a business's site, and every broken site in Cobalt Bloom's study was one a Google listing linked to. A Google Business Profile is the free listing that shows a business on Google Maps and in Google's local results (https://getcobaltbloom.com/glossary#google-business-profile). When the web address changes, or the page it points to moves, the listing has to be updated too (https://support.google.com/business/answer/3039617). Hours, prices, services, staff, photos and the footer's copyright year go out of date as well, and an old year is one of the easiest signs for a visitor to spot that nobody has looked at the site in a while.

To act on it: search the business name on Google, tap "Website" on the listing, and make sure it opens the site. Once a quarter, read the site as a customer would and fix what has changed.

How often should each maintenance task be done?

Should a small business do website maintenance itself or pay someone?

Once the logins are in hand and the auto-renewals are on, the monthly checks are short, and an owner can do them. The parts worth paying for are software updates on WordPress sites, fixing a hack, and anything that needs the hosting account.

What should you ask before paying for a website maintenance plan?

1. Is my domain registered in my name, and will you renew it and the security certificate?
2. How often do you update the software and plugins, and will you test the site afterward?
3. Where are the backups kept, and have you ever restored one?
4. Will you watch Google Search Console for security issues, and is fixing a hack included?
5. Do I get a report each month on what you checked and changed?
6. If I leave, do I keep all the logins?

Cobalt Bloom is being built to watch for the problems in this guide, with daily checks, changes on request and a monthly report. It has not launched yet; its waitlist is open at https://getcobaltbloom.com/#waitlist.