WordPress maintenance should be a short, repeatable routine, not a random cleanup project after something breaks. This checklist separates the work into weekly, monthly, and quarterly tasks so you can protect the site, catch problems early, and avoid spending time on checks that do not need to happen every day.
The maintenance rule that matters most
Never start with updates. Start with a current backup and a clear recovery path.
A typical WordPress site has two separate parts that must be protected: the database and the site files. The database contains posts, pages, settings, users, orders, form entries, and other structured content. The files include themes, plugins, uploads, configuration, and custom code. The official WordPress backup guide explains why both parts are required for a complete restore.
A backup is only useful if you can retrieve it and restore it. A green checkmark in a hosting dashboard proves that a backup job ran. It does not prove that the archive contains everything you need or that the restore process works.
The practical order is simple: create a backup, verify it exists somewhere separate from the live server, then make changes.
For a small business site, use at least two backup destinations. Your host can keep one copy, but a second copy should live in independent storage controlled by you or your agency. If the hosting account is suspended, compromised, or deleted, a backup stored only inside that account may disappear with it.
Weekly WordPress maintenance checklist
The weekly routine should take about fifteen to thirty minutes for a healthy brochure site. Ecommerce, membership, and high-volume lead generation sites may need daily monitoring for orders, form submissions, and payment failures.
1. Confirm the site is reachable
Open the homepage, one important service page, the contact page, and the WordPress login screen. Test from a private browser window so an old cache or administrator session does not hide a problem.
Check the actions that create business value:
- Submit the main contact form with a test address.
- Confirm the notification email arrives.
- Complete a test checkout if the site sells products.
- Test appointment booking if scheduling is important.
- Open the site on a phone and inspect the navigation.
A monitoring service can tell you that the server returned a response. It cannot tell you that the quote form stopped sending email or that the mobile menu covers the checkout button.
2. Review backups and recent activity
Confirm that scheduled backups completed. Check the file size and date against previous backups. A sudden drop from a large archive to a tiny one can signal an incomplete job.
Review new administrator accounts, password reset emails, plugin installation notices, failed login alerts, and security scan results. You are looking for changes nobody expected. If a new administrator appeared without an approved request, treat it as an incident instead of deleting the account and moving on.
3. Apply low-risk updates
Open Dashboard > Updates and review WordPress core, plugin, theme, and translation updates. WordPress recommends keeping the platform and its extensions current, and the official update documentation says to create a backup before updating.
Low-risk updates are usually maintenance releases for established plugins, translation packages, and minor core security releases. Apply them after the backup completes, then repeat the basic site checks.
Hold a major ecommerce, page builder, membership, or theme update for staging if the release changes templates, checkout behavior, database structure, or PHP requirements. The goal is not to delay updates indefinitely. The goal is to test the changes that have the greatest chance of affecting revenue.
Routine checks keep small problems from turning into emergency repairs.
4. Clear obvious clutter
Delete spam comments, abandoned drafts that contain sensitive information, expired staging users, and old export files stored in public upload folders. Do not run aggressive database cleanup tools every week. Remove items you understand and can verify.
Also review disk usage. A broken backup job can create a new archive every day without deleting old copies. That can fill the account, stop email delivery, prevent uploads, and make the site appear broken even though WordPress itself is fine.
Monthly WordPress maintenance checklist
The monthly routine is where you look for trends, reduce attack surface, and verify that the site is still configured the way you think it is.
1. Run Site Health and investigate warnings
Go to Tools > Site Health. The Site Health screen groups findings into critical issues, recommended improvements, and passed tests. It checks items such as update status, PHP version, loopback requests, scheduled events, HTTPS, plugin state, and filesystem permissions.
Do not chase a perfect score without understanding each recommendation. Some hosts intentionally block features that your site does not use. Focus first on critical issues, update failures, old PHP versions, broken scheduled tasks, and problems that affect REST API or loopback requests.
Save the Site Health information before and after major infrastructure changes. It gives your developer or host a useful snapshot of versions and configuration without granting immediate server access.
2. Audit plugins, themes, and users
Review every installed plugin and ask three questions:
- Is it active and necessary?
- Is it still maintained?
- Does another plugin already provide the same feature?
Delete unused plugins rather than leaving them inactive. Inactive code still occupies the server and may become a future risk if someone activates it accidentally. Keep one current default WordPress theme for troubleshooting, then remove old themes you do not plan to use.
Review all users with Administrator, Editor, Shop Manager, or other elevated roles. Remove former employees and vendors. Reduce permissions for people who no longer need full access. Confirm that administrator accounts use unique passwords and two-factor authentication.
The official WordPress hardening guide treats security as risk reduction, containment, monitoring, and recovery. A monthly access review supports all four.
3. Measure performance from the outside
Test the homepage and two important landing pages from an incognito window on desktop and mobile. Record the result so you can compare it next month.
Focus on changes rather than one impressive score. If a service page becomes noticeably slower after a plugin update, new video, tracking script, or image upload, investigate the change. The official WordPress optimization guide points to hosting, software configuration, plugins, caching, and image size as common performance factors.
Check these items:
- Oversized images uploaded during the month
- New third-party scripts for chat, analytics, ads, or booking
- Slow database queries reported by the host
- Cache errors or pages that bypass caching unexpectedly
- Broken images, fonts, or JavaScript requests
- Plugins that load assets on every page when needed on only one page
Performance maintenance is usually removal and correction, not adding another optimization plugin.
4. Check forms, email, analytics, and search visibility
Send a test through every important form. Verify both the user confirmation and internal notification. Check that the submission is stored somewhere besides email when the form handles leads or applications.
Review analytics for sudden traffic drops, missing conversion events, or pages that no longer receive visits. Open Google Search Console or your preferred search monitoring tool and look for indexing errors, security warnings, and large changes in clicks or impressions.
This is also a good time to confirm the privacy policy, consent tools, business address, phone number, hours, team information, and service descriptions are still accurate.
Quarterly WordPress maintenance checklist
Quarterly work tests recovery, compatibility, ownership, and long-term health. Schedule it on the calendar. Do not wait for a quiet week, because quiet weeks rarely announce themselves.
1. Perform a real restore test
Restore a recent backup to staging or a temporary environment. Confirm that the database, media library, theme, plugins, custom code, and configuration all load correctly.
Test login, forms, checkout, scheduled tasks, and integrations. Record how long the restore took and which credentials were required. If recovery depends on one person remembering a sequence of undocumented steps, the recovery plan is incomplete.
Backups become a recovery system only after a successful restore test.
2. Review hosting and software requirements
Check your PHP, database, WordPress, and server versions against current requirements from WordPress, your host, and critical plugin vendors. Review storage, bandwidth, memory, and error logs.
Ask your host what it manages automatically. Some hosts handle backups, malware scanning, caching, core updates, and Web Application Firewall rules. Others provide tools but leave configuration and testing to you. Write down where the host's responsibility ends and your responsibility begins.
3. Test updates on staging
Use staging to test major releases, page builder changes, PHP upgrades, and critical plugin replacements. A practical test covers more than loading the homepage.
Use this order:
- Clone production to staging.
- Create a staging backup.
- Apply one group of related updates.
- Clear all relevant caches.
- Test the front end and administrator screens.
- Test forms, checkout, login, search, and scheduled actions.
- Review browser console and server logs.
- Document conflicts before touching production.
If the staging site contains customer information, protect it with access controls and disable outgoing email, payments, and search indexing.
4. Review ownership and emergency access
Confirm that the business controls the domain registrar, DNS, hosting, WordPress administrator, analytics, Search Console, email delivery service, payment processor, backup storage, and plugin licenses.
At least two trusted people should know where emergency access is stored. That does not mean sharing passwords in a spreadsheet. Use a password manager with controlled sharing and recovery procedures.
Check renewal dates and billing contacts. A site can be technically healthy and still go offline because a domain, card, license, or hosting plan expired.
A simple schedule by site type
| Site type | Backups | Update review | Functional tests | Restore test |
|---|---|---|---|---|
| Brochure site | Daily or weekly | Weekly | Weekly | Quarterly |
| Lead generation site | Daily | Weekly | Forms weekly | Quarterly |
| Ecommerce site | Near real time plus daily | Daily to weekly | Checkout daily | Monthly or quarterly |
| Membership site | Daily or more often | Weekly | Login and access weekly | Quarterly |
| High-change publication | Daily | Weekly | Publishing workflow weekly | Quarterly |
Your schedule should follow how quickly the site changes and how expensive downtime would be. A five-page site that changes twice a year does not need the same backup frequency as a store processing orders all day.
Turn the checklist into an operating system
Assign an owner, a recurring date, and a place to record results. A maintenance log can be a shared document, project board, or ticketing system. Each entry should include the date, backup confirmation, updates applied, tests completed, warnings found, and follow-up work.
Use automatic updates selectively. The WordPress plugin and theme auto-update documentation recommends regular backups and notes that scheduled updates depend on WordPress Cron working correctly. Enable auto-updates for trusted, low-risk extensions when you have monitoring and rollback. Use staging for changes that affect checkout, layout, authentication, or custom integrations.
A good maintenance process produces boring months. Backups complete. Updates install. Forms deliver. Pages remain fast. Problems appear in the log while they are still small.
The checklist is not about doing more work. It is about doing the right work on a schedule, proving that recovery works, and keeping ownership clear before an emergency tests all three.