The WordPress maintenance checklist: weekly, monthly, quarterly

Weekly

The weekly part is where most of the protection comes from. On a typical company website it takes less time than people expect, as long as nothing is waiting from previous weeks.

• Confirm last night's backup exists and is stored off the server. Why: a backup on the same hosting account disappears with the site if the account is compromised.
• Read the changelogs of pending updates. Why: major versions and "breaking changes" notes tell you which updates need extra care or a test on staging.
• Take a fresh backup, then update plugins, the theme and WordPress core. Why: you want a restore point from just before the change, not from yesterday.
• Open the homepage and the key pages after updating, on desktop and mobile. Why: layout problems after an update are often visible only on certain templates or screen sizes.
• Submit a test enquiry through every important form. Why: forms can stop sending email without any error on the page.
• On a store or course platform, place a test order or purchase. Why: checkout is the path that earns money, and it is the one most likely to break after a payment or WooCommerce update.
• Check uptime and security alerts from the past week. Why: a short outage or a flagged file can be the first sign of a bigger problem.
• Look through new comments, user registrations and failed login reports. Why: a sudden wave of spam accounts or login attempts often comes before an attack, and spam comments left online hurt the site's credibility.

Monthly

Once a month, step back from individual updates and look at the health of the site as a whole.

• Review the list of administrator and editor accounts. Why: former employees and old agency logins are a common way into a site.
• Remove deactivated plugins and unused themes. Why: inactive code can still contain vulnerabilities and adds work to every update.
• Check for plugins that have not been updated by their authors for a long time. Why: abandoned plugins stop receiving security fixes and should be replaced before they become a problem.
• Run a speed test on the homepage and one key landing page. Why: speed tends to degrade slowly as images, scripts and plugins are added, and a monthly check catches the trend early.
• Look at Google Search Console for new errors, coverage problems or security messages. Why: indexing issues and manual actions show up here before you notice a drop in traffic.
• Check the PHP error log for repeated warnings. Why: recurring warnings often point to a plugin that will fail after the next update.
• Check disk space and database size on the hosting account. Why: backups, logs and uploaded images grow every month, and a full hosting account can stop backups or break the site without warning.
• Test the site's contact details: phone links, email addresses, maps and opening hours. Why: these change in the business more often than on the website, and outdated details cost enquiries quietly.
• Write a short log of what was done. Why: when something breaks in three months, a record of changes shortens the search for the cause.

If this list already looks like more than your team can keep up with, a free website review will show which items are overdue on your site and which ones matter most.

Quarterly

Every three months, test the things you hope you will never need.

• Restore a backup to a staging or test environment. Why: a backup that has never been restored is not proven to work. This is the most skipped item on any checklist and the most important one.
• Check that staging still matches the live site. Why: a test copy that is months out of date gives false confidence when you test updates on it.
• Review the forms' email delivery settings, including SPF, DKIM and DMARC records for the sending domain. Why: changes in mail provider rules can push form notifications into spam.
• Click through the main user journeys as a visitor would: from the homepage to an enquiry, a booking or a purchase. Why: weekly checks focus on individual pages; this one catches broken links and steps between them.
• Look for broken internal and external links. Why: they frustrate visitors and waste search engine crawling.
• Review redirects and the 404 report. Why: pages removed or renamed during the quarter may need redirects to keep their search traffic.
• Check the cookie banner and analytics tags still fire as intended. Why: theme and plugin updates can move or remove scripts, and you only notice missing data when you need a report.
• Clean up the database: old revisions, expired transients and spam. Why: a bloated database slows down the admin and the front end, and makes every backup larger and slower to restore. Take a backup before you start.

Once a year

The yearly items are mostly about ownership and the platform the site runs on.

• Check renewal dates for every premium plugin and theme licence. Why: an expired licence stops updates, including security fixes, often without a visible warning.
• Check the domain renewal date and that it is registered to your company. Why: a domain registered to a former agency or employee is hard to recover when it matters.
• Check the PHP version your hosting runs and whether it is still supported. Why: unsupported PHP versions no longer receive security fixes, and newer plugin versions eventually stop working on them. Test the upgrade on staging first.
• Run a full access review: hosting, domain registrar, DNS, Google Analytics, Search Console, Tag Manager, email. Why: access accumulates over the years, and you should know who can change what.
• Confirm the hosting account and licences are in your company's name. Why: ownership on your side makes changing providers simple.
• Revisit the plugin list as a whole. Why: features you once needed may now be handled by WordPress itself or no longer used.
• Update the site documentation: where it is hosted, who has access, which plugins are paid and what custom code does. Why: if the person who maintains the site changes, this one page saves days of investigation.

If you are still deciding whether WordPress is the right platform to maintain long term, I compare it with the alternatives in why I recommend WordPress.

What to do when a check fails

Sooner or later a check will fail: a form stops sending, a page looks broken after an update, a security alert appears. The order of what you do next matters more than speed.

• Do not keep clicking. Further updates or random plugin deactivations make the cause harder to find.
• Note what changed. Which updates ran, when, and what exactly is broken. A screenshot and the time help.
• Check whether the problem is on the live site only or also on staging. If staging works, the difference between the two is a clue.
• If an update caused it and the site earns money, restore the pre-update backup or roll back the specific plugin, then investigate on staging.
• Read the PHP error log. It usually names the plugin or theme file that failed.
• For a security alert, change the passwords of administrator accounts and hosting first, then investigate. Do not restore an old backup blindly; it may contain the same vulnerability.
• Write down the cause and the fix. Why: the same conflict often comes back with the next version.

Get the WordPress maintenance checklist done for you

This WordPress maintenance checklist is what I do for the websites in my care. In the Care plan (€190 a month minimum, hours at €49/h) the weekly items, off-server backups, monitoring and the monthly log are included. Growth (€390 a month with 4 hours) adds testing on staging and checks of forms and key journeys. Partner (€690 a month with 15 hours) adds rollback and monitoring of the checkout or course purchase, which matters most for stores and LMS platforms.

Prices exclude VAT, contracts are monthly with one month's notice, and you keep your own hosting and domain. You can compare the plans on the WordPress care page, or start with a free review of your site and see which items on this list are currently overdue.