The Agency Website Maintenance Checklist (85 Points)

Most agency website maintenance checklists read like a college syllabus: update plugins, check backups, review analytics. Useful in theory. Ignored in practice. And when a client’s SSL certificate expires on a Friday afternoon or their Core Web Vitals tank after a CMS update, that checklist sitting in a Google Doc does not help anyone.

The real problem is not that agencies lack checklists. It is that maintenance tasks are scattered, inconsistent, and reactive. You find out about broken pages when a client emails you, not when the issue appears.

This guide covers an 85-point maintenance framework organized into 7 categories. Each section explains what to check, why it matters for client retention, and how often to run each review.

Why Maintenance Fails at Agencies

Agency maintenance programs break down for predictable reasons:

No single source of truth. One person checks SEO. Another handles security headers. A third monitors uptime. Nobody owns the full picture, and things fall through the gaps between roles.

Reactive, not scheduled. Maintenance happens when something breaks or when a client complains. By then, the damage (lost rankings, security exposure, downtime) has already occurred.

Scale kills consistency. The checklist that works for 3 client sites falls apart at 15. At 30 or more, manual reviews become physically impossible without automation.

No evidence trail. When a client asks “what have you been doing for my site?” and the answer is a verbal summary, trust erodes. Documented evidence of regular checks is what justifies retainer pricing.

The 7-Category Framework

Organizing checks by category makes delegation and prioritization simpler. Here is how we break it down, with specific items in each bucket.

1. SEO (Page-Level)

These checks should run on every client page you manage, not just the homepage.

• Title tags: Present, under 60 characters, unique per page. Missing or duplicate titles are the most common SEO issue we see across agency client sites.
• Meta descriptions: Present and under 160 characters. Not a ranking factor directly, but they affect click-through rates from search results.
• Heading hierarchy: One H1 per page, logical H2/H3 nesting. Screen readers and search engines both use heading structure to understand page organization.
• Image alt text: Every non-decorative image needs descriptive alt text. This is both an SEO signal and an accessibility requirement.
• Canonical tags: Present and pointing to the correct URL. Incorrect canonicals can silently remove pages from search indexes.
• Open Graph and Twitter Card tags: Check that social sharing metadata is present and correct. Clients notice when their shared links look broken on LinkedIn.
• Structured data: Valid JSON-LD markup where applicable. Check for Organization, LocalBusiness, FAQPage, and BreadcrumbList schemas.
• Broken links: Internal and external links returning 4xx or 5xx responses. A monthly broken link scan prevents the slow accumulation of dead ends.
• Robots.txt and sitemap.xml: Both present, valid, and consistent with each other. A misconfigured robots.txt can block an entire site from indexing.

Frequency: Run page-level SEO checks weekly for active client sites. Monthly is acceptable for sites with infrequent content changes.

2. Speed

Performance degrades gradually. A site that loaded in 1.2 seconds six months ago might load in 3.8 seconds today after a few plugin updates, unoptimized hero images, and third-party script additions.

• Response time (TTFB): Under 600ms is good. Over 1.5 seconds is a problem that affects both user experience and search rankings.
• Page size: Monitor total page weight. Image-heavy redesigns often double page size without anyone noticing.
• Compression: Verify gzip or Brotli compression is enabled on the server. Missing compression is one of the easiest performance wins.
• Text-to-HTML ratio: Low ratios often indicate bloated markup from page builders or excessive inline styles.

Frequency: Weekly for e-commerce and lead-generation sites. Monthly for informational sites.

3. Security

Security checks are non-negotiable for agencies. A compromised client site does not just affect that client. It affects your reputation with every prospect who Googles your agency name.

• HTTPS enforcement: Every page must load over HTTPS. Check that HTTP requests redirect properly.
• SSL certificate validity: Monitor expiration dates. Set alerts for 30 days before expiry. Expired certificates display browser warnings that immediately destroy visitor trust.
• HSTS header: Present with a max-age of at least 6 months. This tells browsers to always use HTTPS, preventing downgrade attacks.
• Content-Security-Policy: Reduces XSS risk. Even a basic CSP is better than none.
• Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy. Each one closes a specific attack vector.
• Mixed content: HTTPS pages loading HTTP resources (images, scripts, stylesheets). Active mixed content (scripts, iframes) is critical severity. Passive mixed content (images) is a warning.
• Unsafe external links: External links with target="_blank" should include rel="noopener" to prevent reverse tabnapping.

Frequency: Weekly. Security issues have the shortest window between “minor concern” and “active incident.”

4. Accessibility

Accessibility issues create legal exposure for your clients and usability problems for their visitors. Frame this as risk reduction and inclusive design, not compliance certification. Automated tools flag common issues, but they are a starting point for review, not a substitute for manual testing.

• Image alt text: Missing alt attributes on non-decorative images.
• Form labels: Every form input needs an associated label element.
• Color contrast: Text and background color combinations must meet minimum contrast ratios (4.5:1 for normal text, 3:1 for large text).
• Heading order: Skipped heading levels (H1 to H3 with no H2) confuse assistive technology.
• ARIA attributes: Check for invalid or misused ARIA roles and properties.
• Link text quality: “Click here” and “Read more” links lack context when read out of order by screen readers.
• Language attribute: The lang attribute on the HTML element tells assistive technology which language to use for pronunciation.

Frequency: Monthly, plus a review after any significant design or content changes.

5. Technical Health

These are the structural checks that keep a site functioning correctly.

• Robots.txt: Present and not accidentally blocking important pages.
• Sitemap.xml: Present, valid XML, and listing current pages. Stale sitemaps with removed URLs waste crawl budget.
• Favicon: Present and loading correctly. A missing favicon generates console errors and looks unprofessional in browser tabs.
• Viewport meta tag: Required for correct mobile rendering.
• DOCTYPE declaration: Must be present for standards-mode rendering.
• Trust signals on homepage: Contact information, privacy policy link, and terms of service link. These matter for both user trust and search engine quality signals.

Frequency: Monthly. These items change infrequently but have outsized impact when they break.

6. Uptime

• HTTP status: Every monitored page should return 200. Track non-200 responses over time to catch intermittent issues.
• Response time trends: A single slow response is noise. A pattern of increasing response times is a hosting or code problem.
• Redirect chains: More than 2 redirects in a chain wastes crawl budget and adds latency. Each hop costs time.

Frequency: Weekly at minimum. Daily monitoring through automated tools is ideal.

7. AI Readiness

Search is changing. AI tools like ChatGPT, Perplexity, and Google’s AI Overviews pull information from websites and present it directly in answers. Sites that structure their content for machine readability are more likely to be cited.

• Structured data: Valid schema markup helps AI systems understand page content.
• Content structure: Clear heading hierarchy, concise paragraphs, and direct answers to common questions make content easier for AI systems to extract and cite.
• FAQ markup: FAQPage schema gives AI systems pre-structured question-answer pairs.
• Topical authority signals: Consistent coverage of a subject area across multiple pages strengthens a site’s authority signal.

Frequency: Monthly. AI search is evolving quickly, but the underlying signals (structured data, content clarity) change slowly.

Turning Checklists Into Systems

A checklist is only useful if it actually runs on schedule. Here are three ways to make that happen:

Assign ownership by category, not by client. Instead of one person owning all maintenance for Client A, have your SEO specialist own SEO checks across all clients. This builds expertise and consistency.

Automate the repeatable checks. The items above that check for the presence or absence of specific HTML elements, headers, and status codes can be automated entirely. Reserve human review for content quality, design decisions, and strategic recommendations.

Create an evidence trail. Every maintenance cycle should produce a dated report showing what was checked, what passed, and what needs attention. This is what transforms maintenance from a cost center into a visible, valued service.

Tools like SiteCurl run these 85 checks automatically across multiple client sites, generating shareable reports with pass/fail results, severity ratings, and fix-it guidance for each finding. The Studio plan covers up to 50 sites with weekly or monthly scheduled scans, white-label reports, and email alerts when scores drop or critical issues appear.

What to Do This Week

Pick the category where your agency has the least visibility today. For most agencies, that is security headers or accessibility. Run a manual review of your top 5 client sites in that category. Document what you find.

That single exercise will likely surface issues you did not know existed. And it will make the case for systematic, automated monitoring better than any article can.