Most WordPress problems I get called about were not sudden. The plugin had been out of date for eight months, the backup had never been tested, the SSL certificate had been due for renewal for a fortnight, the contact form had been silently failing since an update in spring. None of it was dramatic until it was. A maintained site is boring in the best way, and this WordPress maintenance checklist is how I keep client sites boring: weekly, monthly and yearly, with clear notes on what an owner can do and what belongs with a developer.
It assumes a normal business site — brochure or WooCommerce, on a decent host. Speed has its own guides (the speed checklist and the store version); here it is a check, not a project.
Weekly (15 minutes)
- Look at the site as a customer. Home page, a service page, the contact page — on your phone. Anything odd, broken or slow?
- Submit the main form and confirm the email arrives and, if connected, the CRM entry appears. Forms fail silently more than anything else on a website.
- Check for updates. Note what is pending. Security releases (the changelog says so, or the plugin’s page shows a vulnerability notice) get applied this week. Everything else waits for the monthly window unless it is trivial.
- Confirm last night’s backup ran — a glance at the backup plugin or host panel. A backup that stopped running in March is a common discovery in October.
- Glance at the security log (login attempts, blocked requests) for anything unusual, and at uptime monitoring if you have it — you should; free tiers exist.
- Moderate comments and clear spam if comments are on. If they are not needed, turn them off.
Monthly (1–2 hours)
-
Updates, done safely.
Backup first, and know how to restore it. Update on staging if the host provides one (most managed hosts do); otherwise update one plugin at a time and check the site between them, starting with the ones least likely to break things. Read the changelog of anything major — page builders, e-commerce, form and SEO plugins — before updating; major versions of Elementor and WooCommerce are the ones that most often need a follow-up fix. Then update the theme (child themes make this safe) and core.
-
Test a restore.
Once a month, restore the latest backup to staging or a local copy and confirm it loads. An untested backup is a hope, not a backup. Check that backups are stored off the server too — a backup on the same disk as the site is lost with the site.
-
Security pass.
Remove plugins and themes you no longer use (deactivated is not removed — they are still attackable). Review user accounts; delete leavers, downgrade anyone who does not need admin, enforce strong passwords and two-factor for admins. Confirm the firewall or security plugin is active and its rules are current. Check the file-change scan for anything unexpected.
-
Speed check.
Run the home page and a key page through PageSpeed Insights on mobile and note the numbers in a spreadsheet. A slow drift downward means a plugin or images creeping in; a sudden drop means something changed this month. The Elementor fixes cover the usual suspects.
-
Forms, buttons and integrations.
Every form, not just the main one. Phone and email links. Booking calendar. Any webhook to the CRM. Payment test on a store (a real small order, refunded). Tracking events firing in GA4’s real-time view.
-
SEO health.
Search Console: new coverage errors, manual actions, pages dropped from the index, Core Web Vitals status (what the report means). Run a broken-link check. Confirm the sitemap is reachable and current. Look at which pages lost traffic month on month.
-
Database and media tidy.
After the backup: clear expired transients, trim post revisions, empty trash, delete spam. On a store, clean expired sessions. Delete unused media (carefully — a media cleaner shows what is unreferenced; check before deleting). Optimise database tables.
-
Content freshness.
One thing: update a price, a team photo, an out-of-date statement, the copyright year. Sites that are touched monthly stay accurate; sites that are not accumulate small lies.
Quarterly
- Review every plugin: still needed, still maintained (last update within a year, compatible with the current WordPress), still the best option. Replace abandoned ones before they become the problem.
- PHP version: run on a supported version; hosts flag this. Test on staging first — old plugins sometimes break on newer PHP.
- Accessibility and mobile pass on the main pages: contrast, tap targets, forms usable with a keyboard.
- Analytics review: which pages bring enquiries, which bring nothing, what to improve next quarter.
- Legal pages: privacy policy, cookie notice and terms match what the site actually does (new tracking, new forms, SMS consent).
Yearly
| Task | Why it bites if missed |
|---|---|
| Domain renewal (set auto-renew, check the card) | Expired domain = site and email offline, sometimes lost |
| SSL certificate | Browser warnings; most hosts auto-renew, confirm it |
| Plugin and theme licences | Updates stop silently when licences lapse — security exposure |
| Hosting plan review | Traffic grew; the plan did not. Or you are overpaying |
| Full backup archive off-site | A yearly snapshot outside the rotating backups |
| Admin credential rotation | Passwords shared with past contractors |
| Content audit | Old services, old prices, old staff, dead pages to redirect |
| Design and conversion review | The site should reflect the business as it is now |
What breaks when maintenance is skipped
In rough order of frequency from the sites I have rescued: forms failing silently (lost leads for weeks); hacked sites via an old plugin (spam pages, blacklisting, days of clean-up); “white screen” after a bulk update with no backup; expired SSL or domain; a store that stopped taking a payment method after a gateway update; and slow drift until the site is losing rankings and nobody knows when it started. All preventable with the weekly and monthly lists above.
Do it yourself or hand it over?
Do it yourself if you are comfortable with the weekly checks and you have staging, a tested backup and the patience to update one plugin at a time. Budget two hours a month and expect an occasional evening.
Hand it to a maintenance plan if the site produces enquiries or orders you would miss, if nobody in the business enjoys this, or if the first broken update has already happened. A good plan includes updates on staging, tested off-site backups, security monitoring, uptime alerts, a monthly report and a person to call — and it is priced well below the cost of one lost week.
A minimal toolkit
- Backups: the host’s daily backups plus a plugin backup to off-site storage.
- Security: one reputable security or firewall plugin, two-factor authentication, a host with server-level protection.
- Uptime monitoring: a free external monitor that emails or texts when the site is down.
- Staging: the host’s one-click staging, or a local copy.
- A log: a simple document of what was updated when, and what broke. It turns “the site is weird” into “it started after the form plugin update on the 12th”.
Further reading: WordPress documentation · Hardening WordPress.
FAQ
How often should you update WordPress?
Check weekly and update promptly — security releases the same week, other plugin and theme updates within a couple of weeks after a backup and a quick check of the changelog. Core minor releases can auto-update; major releases are better done deliberately.
What does WordPress maintenance include?
Updates to core, plugins and themes; backups that are tested; security monitoring and hardening; speed checks; testing forms and key pages; database and media cleanup; SEO health (broken links, sitemap, search console errors); and licence, domain and SSL renewals.
Can I do WordPress maintenance myself?
The weekly checks, yes, in fifteen minutes. Updates are safe to do yourself if you have a backup you have tested and a staging site to try them on. Most owners hand it to a maintenance plan after the first update breaks something on a Friday afternoon.
Is a WordPress maintenance plan worth it?
For a site that brings in enquiries or orders, almost always. The cost of a plan is a fraction of one lost week of leads or one emergency clean-up after a hack, and it includes someone who notices problems before customers do.
Would rather the site just stayed boring? See the WordPress care and maintenance service — updates on staging, tested backups, monitoring, a monthly report, and a person who answers when something looks wrong.
