An Annual Website Review for Small Law Firms

An annual website review is a once-a-year check of your firm’s site that catches stale pages, lost logins, broken links and form problems before a client or a bar regulator does. Most small firms launch a site, then leave it alone for years. Nobody owns the job, so small problems pile up quietly.

You do not need a web manager to fix that. You need a calendar, a checklist and about one focused afternoon each quarter. Here is what to check, who should check it and how to spread the work across the year.

Key Takeaways

• Pick one person at the firm to own the review, even if a vendor does the technical work.
• Read every practice area page and attorney bio for outdated law, old fees and departed staff.
• Confirm the firm controls the domain, hosting and website admin accounts in its own name.
• Test every contact form on a phone and confirm the messages actually reach a monitored inbox.
• Know where backups live, who can open them and how long they keep client inquiries.
• Spread the work across four quarters so no single month feels heavy.

What Is an Annual Website Review for a Law Firm?

Think of it like a file audit for your website. Once a year, someone at the firm sits down and checks the site against a written list. The goal is not a redesign. The goal is to confirm the site is accurate, secure and still doing its job.

A good review covers six areas. Those are content age, credentials and access, broken links, mobile forms, backups and privacy tools. Each one takes less time than you might expect once you have done it the first time.

If your site already feels like it has bigger problems, read our guide on when a law firm website stops helping the practice first. A review works best on a site that is basically sound.

Who Should Own the Annual Website Review?

Name one person. In a solo practice, that is you. In a five-lawyer firm, it might be the office manager with a partner signing off on content changes.

The owner does not have to make every fix. They keep the checklist, book the time and make sure each item gets a yes, a no or a ticket to the vendor. Attorneys should still review anything that describes legal services, results or fees.

Content Age and Accuracy

Start with what visitors read. Old content is the most common problem on small firm sites, and it is the one with the clearest ethics angle.

How Do You Find Outdated Pages?

Open every page in the main menu and every blog post that still gets traffic. Ask three questions for each one. Is the law still correct? Are the people still here? Are the numbers still true?

Watch for these common examples.

• A DUI page quoting a fine schedule or license suspension period that the legislature has since changed.
• An estate planning page that mentions an exemption amount from several years ago.
• A family law page referencing local court procedures that the court has since updated.
• A team page showing a paralegal or associate who no longer works at the firm.
• An office address, parking note or phone number from before a move.

For older blog posts, you have three choices. Update the post, add a short note at the top saying the law has changed or remove it and redirect the address to a current page. Do not leave a confidently wrong post live.

What Do Bar Advertising Rules Require?

Your website counts as a communication about your services. ABA Model Rule 7.1 bars false or misleading statements about a lawyer or the lawyer’s services. A statement that was true when written can become misleading as facts change.

During your annual website review, read these items with that rule in mind.

• Case results and testimonials, along with any disclaimers your state requires next to them.
• Words like “specialist” or “expert,” which many states restrict unless you hold a recognized certification.
• Awards and badges, including whether the awarding group still lists you for the current year.
• Fee statements such as “free consultation” or “no fee unless we win,” which must match what you actually do.

Your state’s version of the rules controls, and some states add filing or retention requirements for advertising. Check your own state bar’s rules before relying on the model rule alone.

Should You Review Content Drafted With AI?

Yes. If anyone at the firm or your vendor used an AI tool to draft pages or posts, read them with extra care. Look for invented case names, wrong statute numbers and claims about the firm that nobody approved.

The lawyer remains responsible for the content no matter who or what drafted it. Many state bars have issued guidance on lawyer use of generative AI, so check whether yours has.

Credentials and Access

The second area is less visible but just as important. You need to know who can log in to your website and related accounts and whether the firm can get in without a particular person.

Which Accounts Should the Firm Control?

List every account tied to the site. A typical small firm list looks like this.

• Domain registrar, such as the company where you bought the firm’s domain name.
• Web hosting account.
• Website admin login, such as WordPress.
• DNS provider, if it differs from the registrar.
• Email service tied to the domain.
• Analytics and Google Business Profile.
• Form, chat or intake tools connected to the site.

For each one, confirm the account is registered to the firm and uses a firm email address. A domain registered to a former designer’s personal email is a real risk. Our guide on who owns your domain and law firm website accounts covers how to check and fix this.

How Do You Clean Up User Access?

Open the user list in your website admin. Remove anyone who has left the firm, finished a project or no longer needs access. Former employees and past vendors with admin rights are a common gap.

Then check the basics.

• Every remaining user has their own login. No shared “admin” account.
• Two-factor authentication is turned on for admin users where the platform supports it.
• Passwords live in a password manager, not a spreadsheet or a sticky note.
• The domain renewal date and payment card are current, with auto-renew on.

That last item matters more than it seems. An expired card on a domain renewal can take the site and firm email offline at the worst possible moment.

Broken Links and Dead Pages

Broken links frustrate visitors and make a firm look careless. They build up over time as you rename pages, remove posts or link to outside sites that later change.

How Do You Find Broken Links?

You have a few simple options. A free link checker tool can crawl a small site in minutes. Google Search Console, if your site is connected, reports pages Google tried to reach and could not find. You can also click through the main menu and footer by hand.

Pay special attention to these links.

• Links to court websites, statutes and government forms, which move often.
• Links from old blog posts to practice pages you have since renamed.
• Phone number links. Tap each one on a phone and confirm it dials the right line.
• Map and directions links after an office move.

What Should You Do With Removed Pages?

When you delete or rename a page, set up a redirect from the old address to the closest current page. Ask your vendor to do it if your platform makes this hard. A visitor who clicks an old link from a referral source should land somewhere useful, not on an error page.

Mobile Forms and Intake

Many potential clients find your firm on a phone. If your contact form fails there, you may never know. The inquiry simply never arrives.

How Do You Test Your Contact Forms?

Pull out your own phone and fill out every form on the site as if you were a new client. Use a test name that makes the message easy to spot. Then check each step.

• Does the form display correctly and let you type in every field?
• Does the submit button work, and does a thank-you message appear?
• Does the message reach the right inbox within a few minutes?
• Does it land in spam?
• Does anyone actually monitor that inbox every business day?

Repeat the test on a desktop browser. Then fix anything that fails before you move on.

What Confidentiality Risks Do Forms Create?

Prospective clients often type sensitive details into a contact form. They may describe an arrest, a medical condition or a divorce. Under most state rules, information from prospective clients deserves protection even if they never hire you.

ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. Apply that thinking to your forms.

• Ask only for what you need at first contact. A name, phone, email and short description usually work.
• Add a short note telling visitors not to share confidential details until the firm confirms there is no conflict.
• Find out where form entries are stored. Many form plugins keep a copy of every message inside the website database.
• Delete stored entries on a schedule your firm sets, rather than keeping them forever by default.
• Confirm the site uses HTTPS on every page, including the form page.

If you use a chat widget or an AI intake tool, ask the vendor where conversations are stored, who can read them and whether they train on your data. Get those answers in writing.

Backups and Recovery

Every firm assumes its site is backed up. Fewer firms have confirmed it. A backup you cannot restore does not help much.

What Should You Ask About Backups?

Ask your host or vendor these questions and write down the answers.

• How often does the site get backed up?
• Where are backups stored, and is that location separate from the live site?
• How long are backups kept?
• Who can download or restore them?
• When did someone last test a restore?

If the answer to the last question is “never,” ask the vendor to restore a copy to a test location once a year. That is the only real proof the backup works.

Do Backups Contain Client Information?

Often, yes. If your form plugin stores entries in the database, every full backup holds a copy of those inquiries. The same goes for chat logs and uploaded files.

That means backups need the same care as the live site. Limit who can download them. Ask whether they are encrypted. Make sure old backups expire instead of piling up for years on a vendor’s server. When a vendor relationship ends, confirm in writing that they deleted any copies they held.

Privacy Tools and Notices

The last content area covers your privacy policy, cookie tools and the outside services that load on your pages.

Is Your Privacy Policy Still Accurate?

Read your privacy policy against what the site actually does today. Many firm policies were copied from a template at launch and never touched again. If you have added analytics, a chat tool, a scheduling widget or ad tracking since then, the policy may not mention them.

State privacy laws vary, and some apply only above certain size thresholds. Your annual website review is a good time to ask whether any new state law now reaches your firm.

What Tracking Tools Load on Your Site?

Make a list of every outside script on the site. Common ones include analytics, advertising pixels, chat widgets, embedded videos and map tools. Remove any you no longer use.

Be careful with advertising pixels on pages where visitors describe legal problems. A pixel on a form confirmation page can send data about that visit to an ad platform. Talk with your vendor about where each tool loads.

For guidance on consent tools, see our post on whether your law firm website needs a cookie banner.

A Simple Annual Website Review Calendar

You can do the whole review in one long session. Most busy firms find it easier to split it into four quarterly blocks of about two hours each.

First Quarter Content and Advertising

• Read every practice area page and attorney bio.
• Update laws, fees, addresses and staff listings.
• Check case results, testimonials, awards and disclaimers against your state’s rules.
• Flag old blog posts to update, mark or redirect.

Second Quarter Credentials and Access

• Confirm the firm owns the domain, hosting and admin accounts.
• Remove former staff and vendors from every account.
• Turn on two-factor authentication and check renewal dates.

Third Quarter Links and Forms

• Run a broken link check and fix or redirect what you find.
• Test every form on a phone and a desktop.
• Review form wording, stored entries and deletion settings.

Fourth Quarter Backups and Privacy

• Confirm backup frequency, storage and retention with your vendor.
• Request a test restore.
• Update the privacy policy and remove unused tracking tools.
• Write a short note of what changed this year for next year’s reviewer.

Put each block on the calendar now as a recurring appointment. Treat it like a court deadline you set for yourself.

If a review turns up enough problems that a rebuild seems likely, start with our guide on what to decide before changing a law firm website.

An annual website review will not make your site flashy. It keeps the site accurate, keeps the firm in control of its own accounts and protects the people who reach out to you through it. For a small firm without a web manager, that is the part that matters most.

The information here is general and educational. It is not legal advice, and rules vary by state. Check your own state bar’s rules and guidance before making changes.