How to check your website still works
Loading is not working. The failures that cost money happen one step inside, where nothing shows from the outside.
In short
Check the things that fail without saying so. Send your own contact form from a phone and confirm the email arrives. Look up the certificate expiry, because the maximum lifetime dropped to 200 days in March 2026 and drops again in 2027. Look your domain up in a public WHOIS and see whose name it is in and where the renewal notice goes. Restore a backup somewhere and watch it come up. Those four take under an hour and they cover most of what actually goes wrong.
Work it out in a minute
Eight questions naming the one unattended thing most likely to cost you, from the form that stopped sending to the domain nobody can prove they own.
What we take on
Send your own form
From a phone, on mobile data rather than the office network, and check the email arrives somewhere a person reads. A form that stops delivering shows no error to anybody. It just produces a quiet month.
Look at the certificate expiry
Click the padlock and read the date. Since 15 March 2026 the maximum lifetime is 200 days, falling to 100 in 2027 and 47 in 2029, so anything renewed by hand now needs doing several times a year rather than once.
Look up your own domain
A public WHOIS lookup shows the registrant and the expiry. Two things to confirm: that it is your company, and that the contact address is one somebody still opens. This is the only failure here that can end a business.
Restore a backup somewhere
Anywhere. A spare subdomain, a local copy, it does not matter. Until a backup has been restored once, nobody knows whether it is a backup or a file that looks like one.
Why the obvious check is the wrong one
The check everybody makes is loading the home page, and that is the one thing that almost never fails. Hosting is reliable now, and when a site does go down it tends to come back quickly and somebody notices. The failures that persist are the ones that leave the page looking exactly as it did yesterday.
The contact form is the worst of them, because the failure is invisible from both ends. The visitor sees a thank you message, so they do not chase. You see nothing, and nothing looks like a slow fortnight rather than a fault. It commonly breaks for dull reasons: a plugin update, a change of mail provider, a spam filter deciding your own website is a stranger.
Certificates changed quietly this year and it is worth knowing about. The maximum lifetime used to be over a year, which made renewal an annual thing somebody remembered. It became 200 days in March, becomes 100 days in 2027, and 47 days in 2029. Anything on automatic renewal is fine. Anything renewed by hand has become a recurring job that nobody has scheduled yet, and a lapsed certificate puts a full page browser warning in front of your site.
Then the domain, which deserves ten minutes today rather than a plan for later. Look it up publicly and read two fields: who it is registered to and which address the renewal notice goes to. Companies do lose domains, and it is almost never because somebody decided not to pay. It is because the notice went to an inbox nobody had opened since the person left.
The eight question checker on our website maintenance page scores these in about a minute and names the one most likely to hurt you first, which is rarely the one people expect.
Questions we get
How often should any of this be checked?
The form monthly, because it is the one that costs money and the one that fails most often. The rest quarterly is fine.
Domain and certificate expiry can be watched automatically rather than remembered, which is the better answer for anything with a date on it.
My form uses a third party service. Is it still worth testing?
Yes, and arguably more so. There are more places for the message to stop.
The submission can succeed at the service and still fail to reach you, because delivery to your inbox is a separate step with its own ways of going wrong. Test the whole path, ending at the inbox a human opens.
How do I look up a domain?
Any public WHOIS lookup, including the ones registrars run for free. Search for your own domain and read the registrant organization and the expiry date.
If privacy protection is on you will see the proxy rather than your name, which is normal. In that case the answer is in the registrar account, and if nobody knows which registrar it is, that is itself the finding.
What if nothing has gone wrong in years?
Then you have been lucky and probably well set up, and the checks will take twenty minutes and confirm it.
The one worth doing regardless is the form. It is the item on this list that fails most often, costs the most when it does, and takes the least time to test.
Is there anything I should not do myself?
Restoring a backup over a live site. Restore to a spare location instead, because a failed restore on top of the real thing turns a drill into an outage.
Everything else on this page is safe to do on a normal working day with no special access beyond the accounts you should already hold.
What actually breaks a site that is left alone?
Usually an unpatched piece of software with a fix that has been public for months, rather than anything targeted at you.
Automated scanning finds known holes at scale, which is why patching on a schedule matters more than it feels like it should for a small site. Nobody chose you.
More in the guides and every answer in one place.
Shaheer Shaikh, operations lead at LARVOL, a San Francisco AI company working with global pharma on clinical trial data and model benchmarking. Six Sigma on the process side, Anthropic certified on the Model Context Protocol, ten years across eight industries. More about the firm