# Website maintenance tools: 12 free checks, and what they found on 370 local business sites

> 12 free website maintenance tools for uptime, security, speed, broken links, backups and updates, and what they found on 370 local business websites.

Canonical: https://primilink.com/website-maintenance-tools/
Last updated: 2026-11-06

If your website was built a few years ago and hasn't had much attention since, a handful of free tools will tell you what's wrong in about an hour: whether it's up, whether the padlock works, whether Google can see it, whether it's quick on a phone and whether anything is broken. To show what they catch, we ran the same checks on 370 Big Island service business websites on November 6, 2026. Half of them had at least one problem these tools would have flagged, from pages nobody had changed in years to a contact link that went nowhere.

By [Elijah Ching](https://primilink.com/about-me/) · Published Nov 6, 2026 · 14 min read · Sites checked Nov 6, 2026

![A laptop showing a simple website with a green check, surrounded by a magnifying glass over a broken link, a stethoscope, a padlock with a shield, a stopwatch, a heartbeat monitor and a wrench.](https://primilink.com/assets/img/blog/website-maintenance-tools.webp)

What the checks found on 370 working websites

Of 370 homepages that loaded normally: 34% of the 262 sites whose sitemap lists dates hadn't changed a page in over a year. 31% of the 366 homepages with images had at least one image with no description for screen readers. 28% of the 255 sites showing a copyright year showed 2024 or earlier. 27% of the 106 WordPress sites showing their exact version weren't on the current release. Of all 370, 16% still carried Universal Analytics code, 12% had a broken link or image on the homepage, 9% had no padlock or an http:// address that doesn't redirect to the secure version, and 9% loaded a version of jQuery older than 3.5.0.

## How we checked

We used the list from our [440-site phone test](https://primilink.com/how-to-increase-website-conversion-rate/): every website listed on the Google profiles of 690 service businesses around Hilo and Kona, from plumbers and electricians to dentists, law firms and charters. On November 6, 2026, a script opened each homepage in Chrome on a phone-size screen and ran the checks the tools below run: the security certificate, the software versions the page gives away, analytics code, up to 20 links and 10 images on the homepage, and the sitemap that tells Google when pages last changed. WordPress versions were compared against WordPress.org's own list of current and insecure versions. 370 homepages loaded normally. We only checked homepages, and we don't name any business.

## Start here: the 15-minute check

1. Open your site on your phone, on cell data. Is there a padlock, or "Not secure"? Tap the phone number.
2. Send yourself a message through your contact form. Did it arrive?
3. Run your homepage through [PageSpeed Insights](https://pagespeed.web.dev/).
4. Paste your web address into [Sucuri SiteCheck](https://sitecheck.sucuri.net/).
5. Add /sitemap.xml to the end of your web address and look at the newest date.

Or get most of it in one report from our [free website score](https://primilink.com/free-website-score/), which checks phone speed, SEO basics, whether AI tools can read your site, and your Google listing.

Then work through the tools below in order. The first five matter for every website. The rest matter most on WordPress or on a site nobody has looked after in a while.

## 1. Is it up? UptimeRobot or Better Stack

**What it does:** visits your site every few minutes and emails you when it stops answering, so you hear about an outage from a robot instead of a customer.

**Cost:** [UptimeRobot](https://uptimerobot.com/pricing/)'s free plan watches 50 sites every 5 minutes, and its terms allow business use. [Better Stack](https://betterstack.com/pricing)'s free tier watches 10, every 3 minutes, and is meant for personal projects.

**What we found:** Five days earlier, in our phone test of the same list, 39 of the 440 websites listed on Google profiles, about 9%, didn't work for anyone who tapped the link: web addresses that no longer exist, error pages and sites that never answered. Nothing tells the owner when that happens. An uptime monitor would have emailed them the day it did.

**How often:** set it up once and leave it running.

## 2. Does the padlock work? Your browser and SSL Labs

**What it does:** the padlock means your site has a valid security certificate and uses current encryption. Click it in your browser to see who issued the certificate and when it expires. For a full grade, run [Qualys SSL Labs](https://www.ssllabs.com/ssltest/)' free test: A is good, and a site still accepting the old TLS 1.0 or 1.1 encryption is capped at B.

**Why it matters:** Chrome shows a full-page warning on sites that only offer TLS 1.0 or 1.1, and Safari marks them "Not Secure." That warning is the first thing a customer sees, before your site.

**What we found:** The padlock itself is mostly a solved problem: most hosts now renew certificates automatically, and none of the secure sites had an expired certificate or outdated encryption. The gaps were elsewhere. 9 sites (2%) don't use the secure version at all, so browsers mark them "Not secure," and two of those have a certificate that expired years ago, in 2018 and 2021, so anyone who types https:// gets a full-page warning. Another 25 (7%) have a padlock, but the plain http:// address doesn't redirect to it, so people following an old link or typing the address land on the version without one.

**How often:** once a year, or whenever you change hosting. Certificates from good hosts renew themselves.

## 3. Can Google see it? Google Search Console

**What it does:** Google's free service shows which of your pages are in Google, which searches you appear for, and what's stopping other pages. It also emails you if Google spots signs of hacking or indexing problems, which is the most useful email you'll never want to get.

**Cost:** free. You prove you own the site once.

**How often:** a look once a month, plus reading its emails. If pages are missing, [here's how to find out why your site isn't showing up](https://primilink.com/website-not-showing-up-on-google/).

## 4. Is it fast on a phone? PageSpeed Insights

**What it does:** Google's free speed test combines real visits from Chrome users (when your site has enough traffic) with a test load of the page. The three Core Web Vitals to pass: the main content shows within 2.5 seconds, the page responds to a tap within 200 milliseconds, and nothing jumps around while it loads.

**What we found:** In our November 1 test of the same websites, the typical homepage took about 3 seconds to finish loading on a fast office connection, 17% took over 5 seconds, and 18% weighed more than 3 MB, mostly photos that were never shrunk for the web.

**How often:** monthly, and after any change to the homepage. Google retired its separate Mobile-Friendly Test in December 2023 and points people to Lighthouse, the test built into Chrome, which PageSpeed Insights runs for you.

## 5. Is anything broken? Screaming Frog or Ahrefs Webmaster Tools

**What it does:** follows every link on your site and lists the ones that go nowhere, plus broken images and redirect chains.

**Cost:** [Screaming Frog SEO Spider](https://www.screamingfrog.co.uk/seo-spider/) is a free download that crawls up to 500 URLs, enough for most small business sites. [Ahrefs Webmaster Tools](https://ahrefs.com/webmaster-tools) is free for sites you verify and runs in the browser, with a site audit that lists broken internal and external links.

**What we found:** We checked up to 20 links and 10 images on each homepage, and only counted one as broken if it led to "page not found" or a web address that no longer exists. 45 sites (12%) had at least one. On 8 of them, the broken link was the contact, quote or booking page, the one link a homepage most needs to work. A full crawl of every page would find more.

**How often:** monthly, and after you remove or rename a page.

## 6. Is the software current? WordPress Site Health

**What it does:** on WordPress, Tools > Site Health lists what's out of date, from WordPress itself to plugins, themes and the PHP version underneath. Since version 5.5 you can switch on automatic updates for each plugin and theme from the Plugins and Themes screens.

**Why it matters:** WordPress.org's release page puts it plainly: "Only the most recent in the 7.1 series is safe to use and actively maintained." PHP, the language WordPress runs on, has its own clock: versions 8.1 and older no longer get security fixes, and 8.2 stops getting them on December 31, 2026.

**What we found:** 141 of the sites run on WordPress, and 106 show their exact version. 29 of those, 27%, weren't on the current release, 7.1.4, which came out October 28. 16 (15%) were still on version 6 or older, including one on 5.0, released in 2018. Of the 26 sites whose server announces its PHP version, 7 run versions that no longer get security fixes, four of them on PHP 7.4, which lost support in 2022. And 34 sites (9%) load a copy of jQuery, a common JavaScript library, older than version 3.5.0, the 2020 release that fixed two known security flaws.

**How often:** weekly, or let automatic updates handle it and check monthly. On Squarespace, Wix, GoDaddy and Duda the platform updates the software for you.

## 7. Is it hacked or blocked? Sucuri SiteCheck and Google Safe Browsing

**What it does:** [Sucuri SiteCheck](https://sitecheck.sucuri.net/) is a free scanner that looks at your site from the outside for known malware, malicious code, out-of-date software and whether Google or others have blocklisted it. [Google's Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search) tells you whether Chrome is warning visitors away.

**Know the limit:** Sucuri says so itself: a remote scan can't see files on the server. A clean result is good news, not a guarantee. If you see spam pages in Google for your web address, or visitors report strange redirects, call someone.

**How often:** monthly, and right away if anything looks odd.

## 8. Is anyone counting? Google Analytics 4 and Microsoft Clarity

**What it does:** [Google Analytics 4](https://marketingplatform.google.com/about/analytics/) counts visits and where they came from. [Microsoft Clarity](https://clarity.microsoft.com/) is free and shows recordings and heatmaps of what people actually tap, which is often more useful for a small business.

**Why it matters:** Google's older Universal Analytics stopped recording on July 1, 2023, and Google began deleting the old properties and their data in July 2024. A site with only the old code has been counting nothing for more than three years.

**What we found:** 61 sites (16%) still carry Universal Analytics code. Most also have the newer GA4 tag, so the old code is just clutter. But on 7 sites it's the only Google Analytics on the page, so their Google Analytics hasn't counted a visit since July 2023.

**How often:** a monthly look at what brought calls and messages. To check your own site, open your Google Analytics account: if it only has a property ID that starts with "UA-", you need a new GA4 property and new code on the site.

## 9. Can everyone use it? WAVE

**What it does:** WebAIM's [WAVE](https://wave.webaim.org/) checker (online, or as a Chrome, Firefox or Edge extension) marks accessibility errors right on your page: images with no description for screen readers, low-contrast text, form boxes with no label.

**Why it matters:** people with disabilities are customers too, and website accessibility demand letters reach small businesses. WebAIM's 2026 study of the top million homepages found detectable failures on 95.9% of them.

**What we found:** 113 of the 366 homepages with images (31%) had at least one image with no description at all, and 22 (6%) don't tell browsers what language the page is in, which screen readers rely on. WAVE flags both in seconds.

**How often:** once a year, and after a redesign.

## 10. When did it last change? Your sitemap and the Wayback Machine

**What it does:** most websites publish a sitemap, a list of pages with the date each last changed. Add /sitemap.xml to your web address to see it. The [Wayback Machine](https://web.archive.org/) shows saved copies of your site over the years, which can also help you recover old text and photos if a site is lost.

**What we found:** 309 of the sites (84%) publish a sitemap, and 262 list dates in it. The typical one last changed a page about five months ago, but 34% hadn't changed one in over a year, 20% in over two years, and the oldest not since 2012. Don't trust the footer year: 23 sites showed 2026 in the footer but hadn't changed a page in over a year. The year in many footers updates itself. The pages don't.

**How often:** a look every few months. If the newest date is over a year old, see [the maintenance checklist](https://primilink.com/website-maintenance-checklist/).

## 11. Can you get it back? UpdraftPlus and your platform's history

**What it does:** a backup is a copy of your whole site stored somewhere else. On WordPress, the free [UpdraftPlus](https://wordpress.org/plugins/updraftplus/) plugin (over 4 million sites use it) backs up on a schedule to Google Drive, Dropbox and other storage. Many hosts also keep daily backups. Wix's Site History restores earlier versions of your site. Squarespace has no full-site backup or revision history, only a 30-day restore for deleted pages and posts, so keep your own copies of your words and photos.

**How often:** automatic, daily or weekly. Test a restore every few months; a backup you've never restored is a guess.

## 12. Who has the keys? ICANN Lookup and a password manager

**What it does:** [ICANN Lookup](https://lookup.icann.org/) shows which company your web address is registered with and when it expires. If you don't recognize the company, or can't log in to it, fix that before anything else. A password manager such as [Bitwarden](https://bitwarden.com/pricing/) (free for one person, and free to share with one other person) keeps the logins for your registrar, hosting, website and Google accounts in one place you control.

**Why it matters:** one of the most common stories in small business forums isn't a hacked site. It's a web designer who stopped answering while holding every login. If that's you, [how to hire a web designer](https://primilink.com/how-to-hire-a-web-designer/) covers getting your logins back.

**How often:** once a year, at renewal time, and whenever someone leaves.

## All 12 at a glance

Every tool here is free, or has a free version that covers a small business site.

| Tool | Checks | How often |
|---|---|---|
| UptimeRobot or Better Stack | Site down | Always on |
| Browser padlock, SSL Labs | Certificate and encryption | Yearly |
| Google Search Console | Indexing, hacking alerts | Monthly |
| PageSpeed Insights | Speed on a phone | Monthly |
| Screaming Frog or Ahrefs Webmaster Tools | Broken links and images | Monthly |
| WordPress Site Health | Out-of-date software | Weekly |
| Sucuri SiteCheck, Safe Browsing | Malware, blocklists | Monthly |
| Google Analytics 4, Microsoft Clarity | Visits and what people tap | Monthly |
| WAVE | Accessibility | Yearly |
| Sitemap, Wayback Machine | When it last changed | Every few months |
| UpdraftPlus, host or platform backups | Getting it back | Automatic |
| ICANN Lookup, Bitwarden | Ownership and logins | Yearly |

## What to do with what you find

- **Fix it yourself:** wrong prices or hours, the copyright year, broken links to pages you renamed, image descriptions, large photos, and switching on automatic updates.
- **Call someone:** certificate errors, a malware or blocklist warning, a WordPress site several major versions behind, a PHP upgrade, or logins you can't get into.
- **Consider a rebuild:** when several of these show up at once on a site that's years old. Patching an abandoned theme and a stack of old plugins can cost more than starting over. [Website redesign cost](https://primilink.com/website-redesign-cost/) has real prices, and [the maintenance checklist](https://primilink.com/website-maintenance-checklist/) has the safe order for catching up a site you'd rather keep.

## Where Primilink fits

Every site we build launches with backups switched on, and when a price, a photo or your hours change, you send a quick request and we take care of it. You own the site, the words, the photos and the logins, and your web address is registered in your name. If these tools turned up more than you want to fix, our [free website score](https://primilink.com/free-website-score/) is a good next step, and plans for a new site start at $249 a month.

## Where this comes from

Checked November 6, 2026.

- **The website check:** Primilink's own check of the 440 homepages listed on 690 Google Maps profiles of service businesses around Hilo and Kona, Hawaii (the same list as our [November 1 phone test](https://primilink.com/how-to-increase-website-conversion-rate/), which also measured load times). 370 loaded normally. Up to 20 links and 10 images per homepage were checked; a link counts as broken only if it returned "not found" (404 or 410) or its web address no longer exists. WordPress versions were compared with [WordPress.org's version list](https://api.wordpress.org/core/stable-check/1.0/).
- **Tools and prices:** UptimeRobot [pricing](https://uptimerobot.com/pricing/) and [terms](https://uptimerobot.com/terms/), Better Stack [pricing](https://betterstack.com/pricing), Screaming Frog [pricing](https://www.screamingfrog.co.uk/seo-spider/pricing/), [Ahrefs Webmaster Tools](https://ahrefs.com/webmaster-tools), [Sucuri SiteCheck](https://sitecheck.sucuri.net/), [Microsoft Clarity](https://learn.microsoft.com/en-us/clarity/faq), [UpdraftPlus](https://wordpress.org/plugins/updraftplus/) and [Bitwarden](https://bitwarden.com/pricing/).
- **Google:** [Universal Analytics shutdown](https://support.google.com/analytics/answer/11583528), [the Mobile-Friendly Test's retirement](https://developers.google.com/search/blog/2023/04/page-experience-in-search), [Search Console](https://support.google.com/webmasters/answer/9128668), [PageSpeed Insights](https://developers.google.com/speed/docs/insights/v5/about) and [Core Web Vitals](https://web.dev/articles/vitals), and [Chrome's TLS 1.0 and 1.1 warnings](https://chromestatus.com/feature/5759116003770368).
- **Security and software:** [SSL Labs' rating guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), [Apple on "Not Secure" warnings](https://support.apple.com/en-us/102279), [WordPress releases](https://wordpress.org/download/releases/), [PHP supported versions](https://www.php.net/supported-versions.php) and jQuery's advisories for [CVE-2020-11022](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2) and [CVE-2020-11023](https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6).
- **Accessibility:** [The WebAIM Million, 2026](https://webaim.org/projects/million/).
- **Backups:** [Wix Site History](https://support.wix.com/en/article/viewing-and-managing-your-site-history) and [Squarespace on lost content](https://support.squarespace.com/hc/en-us/articles/206543417-Troubleshooting-lost-content).
- **Owners' experiences:** r/smallbusiness on [a web designer who vanished](https://www.reddit.com/r/smallbusiness/comments/17efe2x/) and r/Wordpress on [out-of-date sites a "website guy" wouldn't touch](https://www.reddit.com/r/Wordpress/comments/1lif3ny/) and [an accessibility demand letter](https://www.reddit.com/r/Wordpress/comments/1xmdbtw/).

## Frequently asked questions

### What tools do I need to maintain a website?

For most small business sites: an uptime monitor, Google Search Console, PageSpeed Insights, a broken link checker and backups. On WordPress, add Site Health and automatic updates. Every tool in this guide has a free version.

### Is there free website maintenance software?

Yes. UptimeRobot (50 sites, every 5 minutes), Google Search Console, PageSpeed Insights, Screaming Frog (up to 500 URLs), Ahrefs Webmaster Tools, Sucuri SiteCheck, WAVE and UpdraftPlus all have free versions that cover a small business site.

### How do I check if my website is outdated?

Look at the copyright year in the footer, the newest date in yoursite.com/sitemap.xml, and whether your prices, hours and photos are current. Then run PageSpeed Insights and Sucuri SiteCheck. In our check of 370 local business websites, a third hadn't changed a page in over a year.

### How do I monitor my website for free?

Sign up for UptimeRobot's free plan, add your web address, and it checks every 5 minutes and emails you when the site stops responding. Add Google Search Console for indexing and hacking alerts.

### What's the best free tool to find broken links?

Screaming Frog SEO Spider, a free download that crawls up to 500 URLs, or Ahrefs Webmaster Tools, free in the browser once you verify your site. Either lists every link that returns an error and the page it's on.

### Does my old Google Analytics still work?

No. Universal Analytics, the version with IDs starting "UA-", stopped recording data on July 1, 2023. If that's all your site has, set up a Google Analytics 4 property and add its code. Of the 370 local business websites we checked, 16% still had the old code, and on seven it was the only Google Analytics on the page.

### Do Squarespace and Wix sites need maintenance tools?

Fewer of them. The platform handles software updates, hosting and the certificate. You still want Search Console, PageSpeed Insights, a broken link check and an uptime monitor, and on Squarespace your own copies of your words and photos, since it has no full-site backup.

## Related
- [Home](https://primilink.com/)
- [Blog](https://primilink.com/articles-and-resources/)
- [Elijah Ching](https://primilink.com/about-me/)
- [440-site phone test](https://primilink.com/how-to-increase-website-conversion-rate/)
- [free website score](https://primilink.com/free-website-score/)
- [here's how to find out why your site isn't showing up](https://primilink.com/website-not-showing-up-on-google/)
- [the maintenance checklist](https://primilink.com/website-maintenance-checklist/)
- [how to hire a web designer](https://primilink.com/how-to-hire-a-web-designer/)
- [Request a proposal](https://primilink.com/request-your-proposal/)
- [Contact](https://primilink.com/contact/)

Primilink · Kailua-Kona, Hawaii · (213) 776-3217 · elijah@primilink.com