In this guide · 7 sections
Short answer
Each month: apply and verify updates, confirm firewall, malware scan and brute-force protection are still on, test a restore from the off-site backup, check disk space and certificate expiry, review who has access, and write a short report. Quarterly, add an access review and a full restore drill.
Why a monthly routine matters for a small server
Automatic tools cover a lot. On Ubuntu, the unattended-upgrades package is installed by default and applies security updates automatically, as Ubuntu's automatic updates documentation explains. It can also reboot when needed, but only if you configure it, and it does not touch your website code, plugins, containers or anything installed outside the package manager.
The monthly routine fills those gaps and, just as important, checks that the automatic tools are still running. A firewall rule changed during a late-night fix or a backup job that silently failed in March will not announce itself. Our guide to automatic security updates on Linux covers the daily layer; this page is the human check on top.
The monthly server maintenance checklist
Block out one hour in a quiet window. Do the items in this order, because a restore test or a reboot can expose problems that later items depend on.
Monthly (about one hour)
If the server runs Docker, remember that container images do not update through the OS package manager. Pull new images, rebuild and redeploy as part of the update step.
How to do the key monthly steps
These are the steps people skip most often. Each takes a few minutes once you have done it twice.
Patch, then prove the app still works
After updates and any reboot, load the site, log in, place a test booking or order, and check the background jobs ran. An update that breaks checkout is worse than no update.
Restore, do not just check the backup exists
Download last night's backup from the off-site location to a test folder or spare server, open the database and a few uploaded files. Note how long it took. Our guide to snapshots vs file backups explains which backup types you need.
Check certificates and domains
Read the expiry date on the live certificate in the browser, and confirm auto-renewal ran. The maximum public TLS certificate lifetime is now 200 days and falls further in 2027, as our 200-day SSL guide explains.
Check disk before it fills
Run a disk usage check and look at the trend. A server above 80% full usually has growing logs, old backups stored locally or unused Docker images.
Review access
List users with login or sudo rights and the SSH keys in each authorized_keys file. Anything you cannot match to a current person or system should go.
What to add every quarter
Some checks are too slow for every month but too important to leave for a year.
| Quarterly task | What it catches |
|---|---|
| Full restore drill on a spare server | Missing config, secrets or steps that a file-level restore hides; gives you a real recovery time |
| Firewall and open-ports review from outside | Database or admin ports opened during troubleshooting and never closed |
| Full access review across server, hosting panel and DNS | Old contractors with hosting or DNS access, shared passwords |
| OS and runtime version check | An Ubuntu release, PHP, Node or database version nearing end of support |
| Compare settings with a hardening baseline | Drift from a known-good configuration |
For the baseline, the CIS Benchmarks are free consensus configuration guides for common operating systems and software. You do not need to apply every item; use them to spot settings that have drifted. Our open ports check shows how to test the firewall from outside.
The one-page monthly report
A short written record turns maintenance from "we think it's fine" into evidence. It also helps if you change providers, apply for Cyber Essentials, or need to explain an incident to a customer or the PDPC.
- Date and who did the work.
- Updates applied (OS, app, plugins, images) and anything deferred, with the reason.
- Restore test result: what was restored, how long it took, any problems.
- Disk use, certificate and domain expiry dates.
- Access changes: accounts or keys removed or added.
- Anything unusual in logs or alerts, and what was done about it.
- What is due next month or next quarter.
Do it yourself or get help?
If someone on your team is comfortable on the command line, an hour a month with this checklist is enough for most single-server apps. The risk is that it slips when that person is busy or leaves, and nobody notices until something fails.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Server Protection Care (S$149 a month per server) applies the updates in a monthly patch window, checks that malware scans, firewall rules, brute-force protection and backups are still on, runs a monthly restore test with proof, tracks certificate and domain renewals and sends a plain-English report. Server Protection Care Plus (S$290 a month) adds weekly patching, quarterly firewall and access reviews, a quarterly full restore drill and planned major upgrades. Both need the initial protection set-up in place first, and neither is round-the-clock monitoring.
Frequently asked questions
Security updates should apply automatically every day; on Ubuntu, unattended-upgrades does this by default. On top of that, do a monthly maintenance window to apply remaining updates, reboot if needed, update your app, plugins and container images, and confirm everything still works. Critical vulnerabilities in internet-facing software should be patched as soon as a fix is available.
Testing a restore. Many small businesses only discover their backups are incomplete or corrupted when they need them. Each month, restore the latest off-site backup to a test location, open the database and files, and note how long it took. A backup that has never been restored cannot be relied on.
Not by default. Ubuntu's documentation explains that unattended-upgrades can reboot the system when an update requires it, but you need to enable that option and choose a time. Many kernel and library fixes only take effect after a reboot, so either schedule automatic reboots in a quiet window or reboot during your monthly maintenance.
A full restore drill on a spare server, a check of open ports from outside, a review of everyone with server, hosting panel and DNS access, a check that the operating system and runtimes are still supported, and a comparison of key settings against a hardening baseline such as the CIS Benchmarks.
Because automatic renewal can fail silently, for example after a DNS or firewall change. Public certificate lifetimes are getting shorter: the maximum has been 200 days since March 2026 and Let's Encrypt moves to 64-day certificates by default from February 2027. A monthly look at the live expiry date catches a broken renewal in time.