WordPress maintenance checklist: weekly, monthly, yearly

WordPress powers a huge share of the web, and that popularity is exactly why it needs regular care: plugins update constantly, and outdated sites are the main target of automated attacks. This checklist is what a professional care plan covers. Use it to look after your own site, or to check what your developer actually does.

Before anything else: make sure you have a working, off-site backup and know how to restore it. Every other task is safer with one.

Weekly tasks (15 minutes)

• Check backups ran. Daily automated backups stored off the server (e.g. cloud storage), kept for at least 30 days.
• Update plugins and themes. Update on a staging copy first if your host offers one, or one at a time on live, checking the site after each.
• Apply WordPress minor (security) updates. These are usually automatic. Make sure they are.
• Test your contact form. Send a test enquiry. Broken forms are the most common silent failure.
• Scan for malware. Use a security plugin or your host's scanner.

Monthly tasks (1 hour)

• Run a speed test (PageSpeed Insights) on the homepage and your top page. Watch LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1.
• Review Search Console: coverage errors, manual actions, security issues and Core Web Vitals.
• Remove unused plugins and themes. Deactivated isn't enough. Delete them.
• Review admin users. Remove old accounts, check roles, enforce strong passwords and 2FA.
• Check uptime reports and fix recurring downtime (often a hosting problem).
• Clean the database: spam comments, post revisions, expired transients.
• Fix broken links and 404s reported in Search Console.

Quarterly tasks

• Test a full restore from backup on a staging site. A backup you've never restored is a hope, not a plan.
• Check PHP version with your host and upgrade to a supported version.
• Update key content: prices, opening hours, team, offers and service areas.
• Review conversions in GA4: which pages bring enquiries, and which don't.

Yearly tasks

• Renew the domain (turn on auto-renew) and check the SSL certificate is auto-renewing.
• Review licences for premium plugins and themes.
• Refresh your top pages and cost/pricing content with the current year's information.
• Do an accessibility check: colour contrast, focus states, form labels and alt text.
• Decide whether the site needs a refresh or a redesign.

Signs something is already wrong

• Visitors are redirected to spam sites, or Google shows "This site may be hacked".
• Your host suspends the account or sends malware warnings.
• New admin users you didn't create.
• A sudden drop in traffic or a spike in strange pages indexed in Google.

If you see any of these, act quickly: see WordPress malware removal.

DIY or care plan?

If you're comfortable with the tasks above and will actually do them every week, DIY is fine. Most business owners would rather spend that time on their business. That's what WordPress care plans are for: from $29/month for updates, daily backups, monitoring and a monthly report, with higher plans adding edits and priority fixes. If your site is slow as well as unmaintained, start with speed optimization.

Frequently asked questions

How often should WordPress be updated?

Check weekly. Security releases should be applied within days; plugin updates weekly after a quick test.

Can updates break my site?

Occasionally, usually from plugin conflicts. That's why you update with a fresh backup, ideally on staging first.

How much does WordPress maintenance cost?

Typically $29–$150 per month depending on what's included. See small business website costs for the full picture.