A maintenance checklist should cover the site’s actual business functions alongside updates, access, backups and renewals. Assign owners, record exceptions and escalate incidents outside routine review. Include form delivery and representative mobile checks. The checklist should lead to tested work, not a collection of vague assurances that somebody is looking after the website.

Managed SSL can reduce some certificate-operation work when its scope and platform eligibility fit the website. Verify who handles installation, validation, renewal and monitoring. Compare that with any service already included. Managing HTTPS does not automatically include all application-security tasks, and purchasing a duplicate certificate may solve nothing.

A security handover should identify asset ownership, named access, maintenance, backups and incident contacts. Confirm the recipient can operate the recovery process and remove obsolete permissions. Keep credentials separate from general notes. An agency’s continued involvement should have a defined scope rather than an informal assumption that every problem remains its responsibility.

Website login protection should use appropriate named access, available multifactor controls and sensible recovery. Review permissions and obsolete users, and consider supported rate limits without blocking legitimate access. Maintain the application and investigate suspicious activity. A single login feature is not a guarantee against every account or software threat.

Before installing a plugin, review its legitimate source, current maintenance, compatibility and purpose. Test away from production where practical and remove unused components. Consider permissions and ongoing responsibility, not merely installation count. No extension can be assumed safe forever because it was once popular or because its name sounds reassuring.

Verify an unexpected renewal or hosting invoice through the known provider account and established contact route. A familiar logo or urgent deadline is not proof of authenticity. Check domain and subscription status independently, preserve suspicious evidence and follow the business’s payment-approval process before sending money.

An old backup can overwrite new orders if production data is replaced indiscriminately. Validate recovery separately, identify newer transactions and choose a method suited to the fault. Reconcile related records with application expertise where necessary, and prevent duplicate payment or message actions. Full database replacement is not a universal safe repair.

Avoid certificate-expiry interruption by assigning renewal ownership and checking the live connection after renewal. Monitor the relevant hostnames and validation dependencies. Automation can fail if access or DNS changes, so review alerts rather than relying solely on billing status. Verify the current managed-service scope before assuming renewal work is covered.

Form protection should combine maintained code, validation and appropriate abuse controls with usability. Test mobile and keyboard access, notification delivery and invalid input handling. Review data retention and access. A control that blocks every enquiry is not a useful victory over spam, and public disruptive testing is not a safe diagnostic method.

Shop backup frequency should follow transaction activity and the business’s acceptable recovery gap. Consider database consistency, stock changes and newer orders as well as archive schedules. Test the actual recovery path without replaying payments. A nightly backup may not protect every order created during the following day.