Website Maintenance and Rescue Checklist for Malaysian SMEs

A website can look unchanged while a form stops delivering, a renewal notice goes to a former employee, a component becomes vulnerable or an old price keeps generating unsuitable enquiries. Maintenance is a repeatable check of availability, accuracy, ownership and recovery.

1. Create a website ownership register

Store this register in a restricted business-controlled location, not in a public document or one person's inbox. MYNIC advises .my registrants to renew before expiry and keep contact information current.

2. Run a monthly 20-minute owner check

• Open the homepage and key service pages from a phone on mobile data.
• Click navigation, WhatsApp, call, map, booking and payment links.
• Submit each important form with a labelled test and confirm actual delivery.
• Verify services, hours, address, phone, prices and time-sensitive notices.
• Review domain, hosting, email and third-party renewal alerts.
• Check platform security notices and schedule safe updates.
• Review Search Console messages and confirm the latest backup job.
• Record faults, owner, priority and next action in one log.

3. Perform a quarterly technical and content review

• Review administrator access, recovery details, API keys and integrations; remove access no longer needed.
• Apply supported updates through a tested process and confirm HTTPS behaviour.
• Verify backups include required files, data, media and configuration; test a restore safely.
• Check services, prices, licences, locations, policies, downloads and complete customer journeys.
• List the personal data each form collects, remove unnecessary fields and confirm access and retention.

4. Review ownership and continuity annually

1. Verify the business-controlled holder of every critical account and subscription.
2. Confirm renewals, payment methods and appropriate notification contacts.
3. Export approved copy, original media, configuration and platform data where supported.
4. Plan replacements for unsupported components.
5. Confirm privacy, terms, services and business identity remain accurate.
6. Run a documented restore, DNS-contact and form-delivery exercise.
7. Record risks, owners and next review dates.

5. Triage rescue urgency by consequence

6. Preserve context before a rescue change

• Record when the fault began, affected URLs, devices, errors and recent changes.
• Capture evidence without exposing credentials or personal data.
• Confirm who can approve access, downtime, restoration and deployment.
• Avoid random plugins, repeated DNS changes or unplanned backup restores.
• Use named, time-limited access where possible and request a written diagnosis, backup plan and approval point.
• After repair, rotate affected credentials, remove temporary access and retest the customer journey.

7. Decide whether to maintain, repair or assess a rebuild