The Short Answer
There is no single cadence, and any answer that gives you one number is wrong.
A website is six systems on six different clocks. Your hours and prices need to be right the same day they change. Security patches need to run continuously, without you. Content runs monthly. A redesign is a three-to-five-year event. Treating those as one task called "updating the website" is why the task never gets done — it is too big to schedule and too vague to finish.
Split it into six and the honest answer for each one is short.
The Cadence, Part by Part
| What | How often | What actually triggers it |
|---|---|---|
| Hours, phone, address, prices, staff, services | Same day | The real thing changing |
| Holiday hours (site + Google Business Profile) | Per holiday | The calendar, a week ahead |
| SSL certificate | Automatic | Nothing you do |
| Security patches and plugin updates | Weekly at the slowest, automatic ideally | Vendor disclosures |
| Framework and runtime major versions | Every 12-30 months | Support end-of-life dates |
| New content pages or posts | 1-4 a month | The size of your topic list |
| Expired facts in existing pages | Quarterly audit | A price, year or name going stale |
| Photos, testimonials, portfolio | Quarterly, or when new work lands | Having something new worth showing |
| Broken links and 404s | Quarterly | Other people's sites moving |
| Full redesign | 3-5 years | A real trigger, not the date |
Everything below explains which of those are urgent, which are automatic, and which you can safely leave alone longer than you think.
1. Facts That Can Be Wrong — Same Day
This is the only row on the table with a hard deadline, and it is the one most often missed.
A wrong phone number, a price that went up in March, a service you stopped offering, a team member who left, closed-on-Monday hours that are now open-on-Monday. None of this is an SEO issue. It is a trust issue, and it is measurable.
BrightLocal's Local Citations Trust Report, a 2018 survey of 1,025 US consumers, found that 80% lose trust in a local business when its contact details or business name are incorrect or inconsistent online, 68% would stop using a business after finding incorrect information, and 93% are frustrated by incorrect information in directories. The study is old enough that the specific percentages deserve a grain of salt; the direction has not changed, and nothing since has suggested buyers got more forgiving about being sent to a closed storefront.
Two practical notes. First, the same fact usually lives in more than one place — the site, Google Business Profile, and whatever directories picked it up. Changing one is not changing it. Second, holiday hours are the version of this that catches everyone, because the trigger is a date rather than an event. Put them in the calendar a week ahead, both on the site and on the profile.
2. Security and Dependencies — Continuous, and Not Your Job
The right cadence here is "constantly," which really means "automatically," because no owner is going to hand-patch a plugin stack every week for three years.
Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% increase over 2024. 91% were in plugins, 9% in themes, and only 6 in WordPress core. Of the total, 4,124 (36%) were judged a real threat requiring a mitigation rule, and 1,966 (17%) scored high severity — likely to be hit by automated mass-scale scanning. That is the actual shape of the risk: not the platform, the add-ons you installed and forgot.
If you run WordPress with a plugin stack, weekly is the slowest defensible patch cadence and automatic minor updates should be switched on. The trade-off is real and worth stating: automatic updates occasionally break a layout, which is why the same plan that applies them should also be the one watching the site afterward. We cover what that split looks like on website maintenance services.
Three things on this clock are genuinely out of your hands and should be:
- SSL certificates. These renew themselves, and the window is shrinking industry-wide. The CA/Browser Forum's ballot SC-081v3, adopted in April 2025, cuts the maximum certificate lifetime from 398 days to 47 days in stages "starting in March 2026 and concluding in March 2029." Any setup that depends on a human remembering to renew is already broken.
- Runtime versions. Node.js, which most modern sites run on, states plainly that long-term support "typically guarantees critical bug fixes for a total of 30 months" and that "production applications should only use Active LTS or Maintenance LTS releases." That is a once-every-year-or-two job with a published date on it, not a surprise.
- Custom software. If you own a tool rather than rent one — a custom CRM, a client portal, a quoting system — it sits on the same dependency clock as the site. Ownership does not remove the clock; it just means the maintenance line is visible instead of buried in a subscription. We price that explicitly on custom business software.
Sites with no CMS and no plugin layer have much less of this exposure, because there is no login screen in front of the public to attack. The update clock moves to build dependencies, which are patched when the site is next built.
3. Content — Monthly, Capped by Your Topic List
One to four pieces a month covers almost every small business, and the limiting factor is supply, not ambition: you can only publish as many useful pages as you have real questions to answer. We work through the survey data and the time math in how often you should blog for SEO, so this section stays short.
The part that belongs here rather than there is the quarterly fact audit on pages you already have. Once a quarter, walk the site looking for things that expire:
- Prices and package contents.
- Team members, titles and photos.
- Service lists — anything added or dropped.
- Any year written into copy ("as of 2025", "this year's").
- Screenshots and product shots of things that have since changed.
- Outbound links to other people's sites, which move without telling you.
This is usually an hour, and it is the highest-return hour in the whole article, because the pages being corrected already have traffic.
4. What Not to Update on a Schedule
Two moves look like diligence and are not.
Re-dating a page you did not meaningfully change. Google's documentation on creating helpful, reliable, people-first content lists this among the questions that identify search-engine-first content: "Are you changing the date of pages to make them seem fresh when the content has not substantially changed?" The same list asks whether you are "adding a lot of new content or removing a lot of older content primarily because you believe it will help" rankings by making the site seem fresh, and answers itself: "(No, it won't)".
Rewriting the identity of a page that already ranks. Adding a missing section or a current price to a ranking page is low risk. Changing its title, H1, URL or opening section to chase a different keyword is not — it resets trust the page spent months earning, and you wait weeks to learn whether the gamble paid. This is a line we hold on client sites: new queries get new URLs. The same instinct applies to AI-assisted rewrites done at volume, which we cover against Google's published wording in is AI content bad for SEO?
The structural end of the spectrum — when the layout, navigation or platform itself has aged out — runs on its own multi-year clock and its own set of signals, covered in how often you should redesign your website.
What This Actually Costs, and Three Ways to Cover It
Add up the honest total for a small business site: roughly an hour a quarter for the fact audit, a few minutes per same-day correction, whatever your content cadence costs, and a patch routine that should be automated. Small numbers — which is exactly why they get skipped. Nothing on this list is hard. It is that every item arrives on a Tuesday when something else is on fire.
There are three ways to cover it, and we compare the real costs of each in how to update a website without a CMS:
- Do it yourself in a CMS or builder. Free in cash, not free in hours, and it only works if the hours exist every month, not just in month one.
- Pay a developer per change. Fine for rare edits. Expensive and slow for a wrong phone number, because the minimum billable unit is bigger than the job.
- Put it on a plan. Our own lineup prices the change requests and the content separately: Host ($20/mo) covers hosting, SSL, monthly security updates, 2 content updates and 1 change request; Maintain ($99/mo) adds same-business-day turnaround with 3 change requests and 4 content updates; Grow ($249/mo) runs 5 and 6; Scale ($499/mo) runs 10 and 8 plus one custom data tool. Full detail on pricing, and how the recurring content and scheduled updates actually ship on website automation.
We are not neutral about the third option, so take the recommendation accordingly. The point that holds regardless of who you hire is that the clocks are different lengths, and a plan priced as one monthly "update" rarely makes that clear.
If You Only Do One Thing
Pick the same-day row. Make a short list of every fact on your site that could become wrong — hours, phone, address, prices, named staff, services — and decide today who changes each one, where, and how fast. That single decision prevents the failure that costs real customers, and it takes an afternoon.
Then set a quarterly reminder for the fact audit and make sure security patching is somebody's explicit job. Everything else on this page is optimization.
If you want an outside read on which clocks your site is currently missing, request a free consultation — we will tell you plainly if the answer is "none of them." Our other free guides work through the costs, timelines and trade-offs with the same math.