Use this as a starting point for your internal website operations review.
SSL certificate, admin access, MFA, unused accounts, malware scanning, firewall/WAF where appropriate.
CMS/core updates, themes, plugins, dependencies, compatibility testing and removal of unsupported software.
Backup frequency, off-site storage, retention, access and restore testing.
Uptime, SSL expiry, forms, booking flows, checkout and important integrations.
Mobile speed, images, caching, scripts, Core Web Vitals and hosting bottlenecks.
Request channel, response targets, emergency escalation, approvals and monthly reporting.