A solicitor’s website is a strange kind of publication. It is read by prospective clients, opposing parties, journalists, recruiters and sometimes a regulator, and nobody reads it for entertainment. They read it to decide whether the firm looks careful. A partner who left two years ago still listed on the team page, or an article about a law that has since changed, makes a firm look the opposite.
That is why law firm website maintenance has a slightly different centre of gravity from the same job for a shop or a cafe. The technical upkeep matters, but accuracy and confidentiality matter more. This guide is for partners and practice managers in the US, UK, Australia or elsewhere who want to know what actually needs attention.
Everything here is general information, not legal advice. Professional conduct and advertising rules for lawyers differ between countries, states and regulators, and some are strict. Before you rely on any point below for your own firm, check it against what your regulator or bar association says.
Credibility is the product
For many firms the website does not need to win a flood of traffic. It needs to hold up when somebody who has already heard of you checks you out. That changes what “healthy” means:
- The site loads properly with no browser warnings. A certificate warning on a law firm’s home page does real damage to trust.
- Names, titles, qualifications and contact details are right.
- Nothing on it contradicts your current practice. An old page offering a service you stopped providing is more than untidy; it can be taken as a promise.
- Email sent from your domain is believed. More on that below.
Speed and design come after those. The routine technical side is the same as for any business: updates, backups, uptime and security monitoring, and a report you can read. The page on how a website maintenance agency from India works with overseas clients spells out that monthly work, which is a fair yardstick for judging any proposal you are sent.
The attorney and team pages
These pages go stale more quickly than any other, and they are the ones people check hardest. Make one person responsible, and give them a trigger list: new hire, departure, promotion, change of title, change of office, a new qualification or admission, a retirement, a name change.
When someone leaves, three things need doing, not one. Remove the profile. Redirect its old address to the team page, so a link in an old directory does not land on an error. And remove that person’s access to the site’s admin area. Departed fee-earners keeping a login is surprisingly common and entirely avoidable.
Photos and biographies often exist in more places than the website: directories, press pages, official registers, social media. The site is only one of them, so it helps to keep a single master version of each biography and copy from it.
Practice area pages and the problem of old advice
Blog posts and news items are where law firms accumulate risk. An article explaining a procedure, written five years ago, sits on the site forever and keeps being found by search engines. If the rules have moved on, a reader may act on out-of-date information and then ring you, or worse, not ring you.
A workable routine:
- Date every article in plain view, both the first publication date and a “last reviewed” date.
- Once or twice a year, list every article and ask the responsible lawyer: still accurate, needs updating, or should come down?
- Where an article is withdrawn, think about whether it should redirect to the nearest current page, rather than disappear.
- Add a short, honest line on content pages saying that the article is general information and not advice on a particular situation. Your regulator may expect specific wording, so ask.
That review is a content task rather than a technical one. A web team can help with the mechanics (finding the pages, setting up redirects, adding the date field) but only a lawyer can judge whether an article is still right.
What an enquiry form should and should not collect
A visitor filling in a contact form on a firm’s site may well be a person in the middle of a divorce, a dispute or an arrest of a relative. They will type things. The question is what the form invites them to type, and where it goes.
- Keep the first message short. A name, contact details, the general area of law and a line or two is usually enough to start. Long free-text boxes encourage people to pour out detail before any relationship exists.
- Say clearly what the form is not. A short notice near the button explaining that sending a message does not create a lawyer-client relationship and that urgent matters need a phone call is common practice. The exact words are yours and your regulator’s to settle.
- Know where the entries live. Many form plugins store every submission inside the website’s database for as long as nobody deletes them. Decide how long you want to keep them and who may read them.
- Treat the notification email as sensitive. If it goes to a personal address, a shared mailbox with many readers or an assistant’s phone, think about whether that fits your confidentiality duties.
Spam is the other half. A form drowning in junk makes a real enquiry easy to miss, and the usual blunt fixes (aggressive filters) can swallow genuine messages. Our guide on stopping contact form spam without losing real leads covers the trade-offs.
Whenever a team in another country has access to the site, it also raises a question of who can see those stored entries. We cover that in more depth in a separate piece on customer data when your website team is overseas.
Security: your domain is also your reputation
Law firms handle money, deeds, disputes and identity documents, and criminals know it. Two threats are worth understanding without needing to be technical.
Someone breaks into the website
Out-of-date plugins, weak passwords and unused admin accounts are the common doors. Monthly updates, a tested backup, two-step login for every admin and a scan that someone actually reads close most of them. A defaced or redirected firm site is a bad day; one quietly serving spam pages is worse, because you may not notice for weeks. Our page on website security maintenance sets out what that monthly security work includes.
Someone pretends to be you
Fraudsters write to clients, in your name, with changed bank details. A genuine-looking website helps them, and a firm whose own email is poorly protected helps them more. Ask whoever manages your domain whether your email setup uses the standard checks that let receiving mail systems tell real messages from forged ones (SPF, DKIM and DMARC are the names to look for). This is not strictly website work, but the same people often hold the DNS settings, and it is worth a ten-minute conversation.
It also helps to tell clients, in writing and on the site, how you will and will not communicate changes to payment details. A plain sentence on the contact page is enough.
The footer: notices that must stay current
Privacy policy, terms of use, cookie notice, complaints procedure, regulatory statements: the small print at the bottom of the site is the content most likely to be copied from a template and forgotten. Give it an annual review date. Check that the cookie banner reflects the tools the site really loads, that the privacy policy names the right contact for questions, and that any registration or regulatory wording your regulator expects is present and current. Which statements are required, and how they must be worded, depends on where and how you practise, so your regulator or your own adviser decides that. The maintainer’s role is to make sure the page is easy to find, loads, and is changed only when the firm says so.
Who can change what
The editing permissions on a law firm’s site deserve more thought than on most. Consider three roles:
| Role | Typical tasks | Should not be able to |
|---|---|---|
| Lawyer or marketing contact | Approve wording, review articles, confirm profiles | Install plugins or change settings |
| Content editor | Publish approved text, swap images, edit hours | Publish a new article without sign-off |
| Technical maintainer | Updates, backups, security, fixes | Change legal wording on their own judgement |
For attorney website maintenance handled by an outside team, whoever does the work should be able to tell you who holds each role, in writing. If an outside team keeps your site running, the practical version is a short list of what they are allowed to do without asking, and what always comes to you first. The wording on a practice area page is a good example of the second kind.
Law firm website maintenance with a team overseas
Plenty of firms in the US, UK and Australia use India-based teams for routine technical upkeep, and the arrangement can suit a small firm well. The questions that matter are the ones above: who has admin access, where backups are stored, what the team can see inside form entries, and how changes are approved. Ask for them in writing, before work begins. If the answers are vague, that tells you something.
A firm’s confidentiality duties do not stop at the office door, so it is reasonable to ask the team to agree to confidentiality terms in whatever contract you sign. Whether that is enough, or whether something stronger is needed, is a question for your own counsel. Medical practices face a similar question about patient information, which we looked at in clinic website maintenance.
A quarterly review for the managing partner
Put thirty minutes in the diary each quarter and go through this list with whoever maintains the site:
- Open the site on a phone and on a desktop. Does anything look broken or odd?
- Read the team page against the firm’s current staff list.
- Pick three articles at random. Are they dated and still correct?
- Submit the contact form. Who received it, and how fast?
- Ask for the latest maintenance report. Were updates and backups done?
- List everyone with a login. Does each person still need one?
- Check the renewal dates for the domain, hosting and certificate.
None of this is glamorous, and none of it needs a technical background. Good law firm website maintenance is mostly habit, and done quarterly this list catches the problems that harm a firm’s standing before a client or a regulator does.
Next in this series: Restaurant Website Maintenance: Menus, Hours, Orders
