Website Maintenance Checklist

Patch Shopify apps, theme version, and any custom-app dependencies. Review each app's changelog before updating — payment, shipping, and tax apps have caused checkout regressions in the past, so stage non-trivial updates on an unpublished theme copy first.

Scan the public storefront and any custom subdomains (blog, help center, landing pages). Triage findings by severity; CVSS 7+ goes to the dev team same day. Watch for indicators of card-skimming injection (Magecart) on checkout-adjacent pages.

Confirm certificate expiry on the apex and all subdomains via SSL Labs or Qualys. HSTS preload should still be active. Shopify-managed certs auto-renew, but custom domains pointed at non-Shopify subpaths (help.example.com on Zendesk, etc.) often slip.

Pull the current staff list from Shopify admin and from each connected app (Klaviyo, Gorgias, Recharge). Remove anyone who left the company; downgrade contractors to least-privilege; confirm 2FA is enforced. Attach the exported staff list as evidence.

Test homepage, top-3 collection pages, and top-5 PDPs by traffic. Use the field-data tab (CrUX) when available, not just lab data. Capture LCP, INP, and CLS so the trend is visible month over month.

Run new homepage and PDP imagery through TinyPNG, ShortPixel, or Shopify's built-in image optimizer. Above-the-fold hero is the usual LCP culprit — keep it under 200KB and serve in WebP or AVIF with a JPEG fallback.

Open Tag Assistant or the GTM debug console on the storefront. Disable tags not used in the last 90 days — old retargeting pixels, replaced analytics, abandoned A/B-test scripts. Each tag costs INP; the cleanup is the highest-leverage perf work most months.

On a real iOS and Android device, complete a test order with Shop Pay, Apple Pay, and a credit card. Confirm shipping rates, tax, and discount codes apply correctly. Mobile is 70%+ of sessions for most DTC brands; a broken checkout there overshadows everything else.

Verify Safari iOS, Chrome Android, and the latest Edge desktop. Theme updates and new apps frequently break Safari first. Capture screenshots of any visual regressions for the dev queue.

Walk every header, footer, and homepage CTA link. Common gotchas: deleted collection pages still linked from menus, expired sale pages still hero-banner-promoted, broken "As seen in" press logos linking to dead articles.

Pull current keyword positions in Ahrefs or SEMrush for the top-20 commercial pages. Refresh title tags and meta descriptions where intent or volume has shifted. Keep titles under 60 characters; the brand suffix is optional on long titles.

Run Screaming Frog or Sitebulb against the full sitemap. Pay special attention to discontinued PDPs — they're the most common 404 source on a maturing catalog. Export the broken-link list before moving to the redirect step.

Map each dead URL to its closest live equivalent and add the 301 in Shopify's URL Redirect manager (Online Store → Navigation → URL Redirects) or your platform equivalent. Avoid blanket redirects to the homepage — Google treats those as soft 404s and link equity is lost.

In GA4 DebugView, confirm view_item, add_to_cart, begin_checkout, and purchase events fire with correct revenue and currency. If using Conversions API for Meta or enhanced conversions for Google, validate server-side parity. Attribution accuracy in Triple Whale or Northbeam depends on this firing cleanly.

Run a full backup in Rewind, BackupMaster, or your platform equivalent (UpdraftPlus on WooCommerce). Shopify itself does not give merchants a self-serve full-site restore — third-party backup is the only path back from a theme or product-data disaster.

Confirm backups land in a separate cloud account (S3 with object lock, or backup vendor's storage) — not the same admin as the storefront. Retention should cover at least 30 daily and 12 monthly snapshots so a compromised admin can't wipe all history at once.

Pick a non-critical resource — a single product, a collection, or a theme asset — and restore it into a development store. Untested backups fail in the worst moments; a monthly drill is the only way to know recovery actually works.

File a ticket with the backup vendor and escalate internally. Do not close out the maintenance run with a known-bad backup state — a failed drill means the business has no recovery posture until it's resolved. Capture the failure mode in the runbook so the next on-call recognizes it.