Use this checklist to keep your WordPress site secure, recoverable and fast. First, confirm your automated backups actually succeeded in the last 24 hours and that uptime monitoring is switched on and alerting the right person. Everything else on this list matters, but those two checks decide whether a bad day becomes a minor inconvenience or a genuine crisis. Follow the frequency schedule below to know what to do next.
TL;DR:
- Regular restore testing and offsite backups are critical, with quarterly restore drills being the only way to ensure backup reliability.
- Updating WordPress core, themes, and plugins in the correct order and testing in staging can prevent most site-breaking errors.
- Security measures like two-factor authentication, minimal user permissions, and weekly malware scans significantly reduce vulnerability to cyberattacks.
- Monitoring core Web Vitals monthly helps track trends in page speed and identify issues before they impact visitors.
- A comprehensive disaster recovery plan with clear ownership, failover steps, and routine testing minimizes downtime during unforeseen outages.
Table of Contents
- WordPress maintenance checklist by frequency
- Backups: the 3-2-1 rule and why restore tests matter more than the backup itself
- Updating WordPress core, themes and plugins without breaking things
- Security hardening and how often to scan for threats
- Speed and Core Web Vitals: what to check and how often
- Database cleanup that actually improves load times
- Uptime monitoring and what to do when an alert fires
- Content, SEO and broken link maintenance
- The essential toolset and what you can safely automate
- How a managed provider runs this checklist in practice
- Data privacy and cookie compliance checks
- Disaster recovery: failover planning and recovery time objectives
- Documenting every maintenance task and change
- Testing plugin and theme compatibility before you update
- Auditing user roles and permissions
- SSL certificate monitoring and renewal
- Why maintenance is really risk management, not admin work
- Get TechBug to run this checklist for you
- Sources
- FAQ
WordPress maintenance checklist by frequency
A maintenance checklist only works if it tells you what to do and when. Spreading tasks across daily, weekly, monthly, quarterly and annual slots stops any single day from becoming a four-hour chore, and it means nothing critical gets forgotten because it “felt like a monthly thing.”
Daily (5-10 minutes):
- Check the uptime monitor dashboard for outages or slow response times overnight.
- Confirm last night’s backup completed and shows the expected file size.
- Scan security alert emails from your scanner or host for flagged malware or login attempts.
- Do a quick visual check of the homepage and one key page to catch obvious breakage.
Weekly (20-30 minutes):
- Apply WordPress core, theme and plugin updates in the correct order.
- Clear page and object caches after updates, then spot check load speed.
- Review any failed cron jobs or scheduled task errors.
Monthly (1-2 hours):
- Run a full malware and vulnerability scan.
- Optimise database tables and clear old transients and spam comments.
- Scan for broken links and 404 errors, then fix or redirect them.
- Batch-compress and convert new images to WebP or AVIF.
Quarterly (half a day):
- Restore a backup to staging and verify it actually works.
- Audit user accounts and role permissions.
- Run a deeper security review, including file permission checks.
Annually:
- Renew domains, SSL certificates and licences before they lapse.
- Refresh outdated content and review meta titles across top pages.
- Audit every installed plugin and theme, and remove anything unused.
Backups: the 3-2-1 rule and why restore tests matter more than the backup itself
A backup you have never restored is a theory, not a safety net. The 3-2-1 backup strategy means three copies of your data, on two different types of storage, with one copy kept offsite. For WordPress, that typically looks like a local backup on your host, a cloud copy on a separate provider, and a third stored somewhere immutable that ransomware can’t touch or overwrite.
Frequency should match how often your site changes. An online store or membership site taking daily orders needs automated daily backups, while a static brochure site updated once a month can usually get away with weekly snapshots. Store at least one copy with a cloud provider outside your hosting account, so a compromised host doesn’t take your only backup down with it.
Testing the restore is the step most site owners skip, and it’s the one that actually matters. Duplicator’s guidance recommends this quarterly process:
- Spin up a staging copy of your site.
- Restore your most recent backup into that staging environment.
- Confirm the database loaded correctly and media files display.
- Log into the admin area and check core functionality.
- Run through a real transaction (checkout, form submission, or login) end to end.
Common failure points include WP-Cron silently not firing the backup job, expired storage credentials, and cloud storage quotas quietly filling up.
Pro Tip: Automated backup systems fail silently more often than you’d expect. Manual verification once a quarter is the only way to know your safety net is real rather than assumed.
Updating WordPress core, themes and plugins without breaking things
Update order matters more than most people realise. The safest sequence is WordPress core and your active theme first, then major frameworks like WooCommerce or Elementor, then the remaining plugins one at a time. This ordered workflow exists because framework plugins often depend on core behaviour, and updating them out of sequence is a common cause of white screens.
Before touching anything, mirror your production site in staging and test the journeys that actually make you money: checkout, contact forms, login, and any custom integrations.
- Delay auto-updates on plugins tied to payment processing or custom functionality until you’ve reviewed the changelog.
- Never run a major PHP or core upgrade directly on a live site.
- For high-traffic or ecommerce sites, add basic visual regression checks before and after updates.
- Schedule updates right after a fresh backup completes, never before.
Pro Tip: Updates and staging aren’t optional extras for busy sites. Skipping staging on a major core upgrade is one of the most preventable causes of downtime, and it usually happens on a Friday afternoon.
Security hardening and how often to scan for threats
Hardening WordPress isn’t about buying more software. It’s about closing the doors that don’t need to be open. Start with two-factor authentication for every admin account, assign the lowest role that lets each person do their job, and remove any plugin or theme you’re not actively using, since dormant code is still exploitable code.
- Turn off the built-in file editor in wp-admin so a compromised login can’t rewrite theme files directly.
- Set file permissions correctly (typically 644 for files, 755 for directories) and lock down wp-config.php.
- Restrict or disable XML-RPC if you don’t need it for remote publishing or Jetpack.
- Run a malware scan weekly for standard sites, and consider server-level scanning for ecommerce or membership sites handling sensitive data.
Roughly 42% of cyberattacks target small businesses, largely because attackers know smaller operators run leaner defences and slower patch cycles than enterprise IT teams. A single unpatched plugin with a known vulnerability is often all it takes; the NVD’s CVE-2025-5071 entry is a reminder that these flaws get catalogued publicly the moment they’re found, which means attackers are scanning for them too.
Security logs will flag failed logins and blocked requests constantly, most of it noise from bots. Escalate when you see a pattern: repeated attempts from the same IP range, a spike in admin-ajax.php requests, or any successful login outside business hours. And remember that a scanner reporting “all clear” every week can still be misconfigured. Verify it’s actually running against a real threat feed, not just checking file checksums against a stale baseline. Our website security checklist walks through the hardening steps in more depth if you want a longer reference.
Speed and Core Web Vitals: what to check and how often
Page speed maintenance is mostly about catching drift before visitors notice it. Confirm page caching, object caching and browser caching are all still active after any plugin update, since some plugins disable caching plugins without warning during their own update process.
- Check your CDN is still serving assets correctly, and purge the cache manually after any theme or plugin change.
- Run new images through a bulk WebP or AVIF conversion, add lazy loading, and clean out the media library of unused files.
- Track Core Web Vitals monthly rather than just once, since a single good score doesn’t tell you if load times are trending up.
- Bring in a developer when you hit render-blocking JavaScript or CSS issues that caching and image fixes can’t resolve.
If your homepage load time has crept up over three consecutive months, that’s the trend to fix, not the single bad reading. Our guide on speeding up small business websites covers the fixes that don’t need a developer, and when it’s time to call one in.
Database cleanup that actually improves load times
WordPress quietly accumulates weight over time. Post revisions, expired transients and spam comments all sit in your database taking up space and slowing queries, even though none of it does anything useful for visitors.
- Delete old post revisions and expired transients, then run a table optimisation.
- Clear spam and trashed comments in bulk rather than letting them build up.
- Once a year, audit which plugins autoload large data arrays on every page load, since this is a common hidden cause of slow admin and front-end performance.
- Always back up before running any database operation, and test cleanup plugins on staging first.
Automated database cleaner plugins are useful, but don’t trust them blindly on a live site. Run the first pass on staging to confirm nothing critical gets swept up with the junk.
Uptime monitoring and what to do when an alert fires
External uptime monitoring checking every five minutes, with SMS or email alerts, catches outages long before most visitors would report them. It’s one of the cheapest insurance policies available for a WordPress site.
- Set up monitoring from outside your own hosting infrastructure, so a server-wide failure doesn’t also take down your alerting.
- On low-traffic or mission-critical sites, replace WP-Cron with a real server cron job, since WP-Cron only fires when a visitor loads a page, and a quiet site can miss scheduled tasks entirely.
- When an alert comes in: confirm your most recent backup, pull server and error logs, and switch on maintenance mode if the issue is visible to visitors.
- Contact your host or managed provider immediately if the issue looks server-side rather than application-side.
Pro Tip: A cron job that silently stops firing looks identical to one that’s working, right up until a scheduled backup or newsletter simply doesn’t happen. Check cron execution logs as part of your regular server maintenance routine, not just your uptime dashboard.
Content, SEO and broken link maintenance
A technically healthy site can still lose traffic if the content on it is stale or broken. Review your top-performing pages monthly against analytics data to spot traffic drops early, before they compound into a bigger ranking problem.
- Run a broken link scan monthly and either fix or 301-redirect any 404s you find.
- Test every form, the checkout path, and third-party integrations (payment gateways, booking widgets) after any update.
- Refresh outdated content and review meta titles and descriptions annually on pages that still get search traffic.
- A tool like AmmarAI’s SEO analyser can give a quick score on individual pages if you want a fast health check between full audits.
The essential toolset and what you can safely automate
You don’t need dozens of plugins to run this checklist properly. You need one solid tool in each of six categories: backups, uptime monitoring, security scanning, caching, image optimisation and database cleanup.
- Trust automation for the repetitive, low-risk work: scheduled backups, cache clearing, and routine scans.
- Never fully trust automation for anything with a silent failure mode. Verify backups and scan results manually at least once a quarter.
- If you’re spending more than a few hours a month on this checklist, managed hosting or a maintenance provider usually pays for itself in time saved.
- Keep a written copy of this checklist, whether as a shared document or spreadsheet, so tasks don’t rely on one person’s memory.
Digital agencies offering broader website support, like HarbourSide Digital’s services, can also handle ongoing content and SEO work alongside technical maintenance if that’s part of what you need.
How a managed provider runs this checklist in practice
A vendor-agnostic managed IT provider runs most of this checklist as a background process rather than a monthly scramble. That typically means continuous uptime and security monitoring, ransomware-resistant backups stored offsite, and scheduled quarterly restore tests logged with a timestamp and outcome, not just assumed to have worked.
- Monitoring flags issues before a client notices, often before an outage even shows up on a public status page.
- Escalation follows a clear path: automated alert, technician review, client notification, fix or rollback.
- Vendor-agnostic decision making means recommending the right backup, hosting or security tool for the site, not whichever vendor pays the biggest referral fee.
- Documentation of every restore test and security incident gives an audit trail if something does go wrong later.
If you’d rather hand this whole checklist to a team than run it yourself, our guide on securing your small business IT environment explains what a properly managed setup looks like end to end.
Data privacy and cookie compliance checks
Legal compliance sits outside the technical checklist, but it’s just as easy to let slip. If your WordPress site collects any personal data through forms, comments, ecommerce checkout, or analytics, you need a clear, current privacy policy that explains what you collect and why.
Cookie consent needs periodic review too, not just a one-time setup. Analytics platforms, advertising pixels and embedded videos from third parties (YouTube, social media widgets) often set cookies you may not have audited recently. A quarterly check of your cookie consent tool against what’s actually loading on the site catches new trackers added by plugin updates or marketing tags nobody remembered to review.
Keep these compliance checks on the calendar:
- Confirm your privacy policy still matches what you actually collect and how you use it.
- Audit cookie consent banners against a live scan of what scripts are actually setting cookies.
- Check data retention settings on forms plugins, since many keep submissions indefinitely by default.
- Review any data processing agreements with third-party plugins or services handling customer information.
Compliance requirements vary depending on where your customers and business are based, so treat this as a standing item rather than a set-and-forget task. When in doubt on a specific legal threshold, a professional with expertise in your jurisdiction’s privacy law is worth the consultation.
Disaster recovery: failover planning and recovery time objectives
A maintenance checklist prevents most problems. A disaster recovery plan is what you fall back on when prevention fails anyway, whether that’s a hosting outage, a botched update, or a successful attack.
Start by defining your recovery time objective, the maximum time you can tolerate the site being down before it seriously hurts the business. An ecommerce store might set that at under an hour; a brochure site for a local trade business can usually tolerate half a day.
Your disaster recovery plan should cover:
- Where the most recent verified backup lives and who has access to restore it.
- A documented failover step, such as switching DNS to a staging environment or backup host, if the primary server is unreachable.
- Clear ownership: who declares an incident, who executes the restore, and who communicates with customers if the outage is visible.
- A tested timeline showing how long a full restore actually takes in practice, not just in theory.
The quarterly restore test covered earlier in this checklist doubles as your disaster recovery rehearsal. If a restore takes four hours in staging and your recovery time objective is one hour, that gap is the thing to fix, either through faster backup infrastructure or a standby environment ready to switch to immediately.
Documenting every maintenance task and change
Undocumented maintenance is maintenance that only exists in one person’s head. When that person is unavailable during an incident, the site is effectively unmanaged, regardless of how well the actual tasks were performed.
A simple maintenance log should record, at minimum, the date of each update, what was changed, who performed it, and the outcome. This doesn’t need to be elaborate: a shared spreadsheet or a dedicated changelog plugin is enough for most small business sites.
Documentation earns its value the day something breaks. If a plugin update causes a conflict three weeks later, a log showing exactly which plugins were updated and when turns a guessing game into a five-minute fix. It also matters for compliance and insurance purposes, since some cyber insurance policies now ask for evidence of regular patching and backup practices before paying out on a claim.
Record restore test results here too, including which backup was used and how long recovery took, so trends in backup reliability become visible over time rather than getting forgotten between quarters.
Testing plugin and theme compatibility before you update
Not every update is safe just because it’s available. Compatibility issues between plugins, or between a plugin and your active theme, are one of the most common causes of a broken site after what looked like a routine update.
Before applying any major plugin or theme update, check the plugin’s own changelog and support forum for compatibility complaints from other users. A flood of one-star reviews posted right after a new version ships is a reliable early warning sign.
- Test the update in staging first, particularly for plugins that touch checkout, forms or custom post types.
- Check the plugin’s listed “tested up to” WordPress version before updating core and plugins in the same window.
- Watch for conflicts between page builders and third-party blocks, a frequent source of layout breakage.
- Hold off on updating a plugin the same week WordPress core ships a major release, and let other users find the bugs first.
If your site relies on several plugins working together for a critical function, like a booking system feeding into a payment gateway, treat that combination as a unit. Test all of them together in staging, not one at a time, since compatibility problems often only surface when several pieces interact.
Auditing user roles and permissions
Every extra admin account is another door into your site, and most WordPress sites accumulate accounts nobody remembers granting. A quarterly audit of user roles and permissions closes off privilege escalation before it becomes a real problem.
Start by listing every user account and matching it against who actually still needs access. Former staff, old contractors and one-off developers are the most common accounts left active long after they should have been removed.
- Assign the lowest role that still lets each person do their job. Not everyone needs Administrator.
- Remove or downgrade any account that hasn’t logged in for 90 days.
- Check for accounts with Administrator access created outside your normal onboarding process, a common sign of a compromise.
- Review which plugins have created their own user roles, since some quietly grant broader access than intended.
This audit pairs naturally with the security hardening review, since privilege escalation and weak role assignment are two sides of the same risk.
SSL certificate monitoring and renewal
An expired SSL certificate turns your site into a browser warning page overnight, and it’s one of the most avoidable outages in this entire checklist. Most certificates now auto-renew through the host or a service like Let’s Encrypt, but auto-renewal fails more often than people expect, usually due to DNS changes or expired domain validation records.
Set a calendar reminder to manually check certificate expiry dates at least 30 days before renewal, even on sites with auto-renewal configured. That gives enough buffer to fix a failed renewal before it goes live as an outage.
- Confirm the certificate covers all the subdomains your site actually uses, not just the primary domain.
- Check for mixed content warnings after any migration or major update, since these often indicate leftover HTTP references breaking the secure connection.
- Verify auto-renewal actually ran successfully rather than assuming it did, the same principle that applies to backups.
- Keep a record of certificate expiry dates alongside your other maintenance documentation.
Why maintenance is really risk management, not admin work
Most of what breaks a WordPress site isn’t a sophisticated attack. It’s a missed update, an untested backup, or an assumption that automation is still running when it quietly stopped weeks ago. Treating this checklist as risk management rather than admin work changes how you prioritise it: the backup and uptime checks come first because they determine how bad every other failure gets.
Run the daily and weekly items yourself if you have the time and a reasonable technical comfort level. Hand off anything involving staging environments, restore testing, or security incident response to a provider once the stakes get high enough that a mistake would genuinely hurt the business. Either way, go check your backups and uptime alerts today. That’s the one task on this whole list you can’t afford to skip.
— Ru
Get TechBug to run this checklist for you
Managed IT services are an alternative to piecing together a dozen plugins and hoping they all keep working. Instead of you manually chasing backup logs, uptime alerts and update conflicts every week, our managed IT services handle continuous monitoring, ransomware-resistant backups and quarterly restore testing as a standing part of the service, not an occasional afterthought.
Because a vendor-agnostic approach is used, the tools recommended for your site are chosen on merit, not on which vendor pays the best referral. That means a caching setup, backup provider or security scanner picked because it actually fits your site, not because it’s the only option on offer. Onboarding can start with a review of your current setup, covering backup strategy, outstanding updates and open security gaps, to ensure nothing on this checklist gets missed in the handover.
If you’d rather have a team confirm your backups succeeded and your uptime alerts are live than check it yourself every Monday morning, get in touch about our managed IT services and we’ll walk you through what a fully managed maintenance plan looks like for your site.
Sources
For the technical detail behind this checklist, WordPress.org’s official maintenance documentation covers the maintenance calendar and dead link checks in full. Pantheon, Kinsta and Duplicator each go deeper on update workflows, automation limits and restore testing procedures. For specific vulnerability details, the National Vulnerability Database catalogues CVE records worth checking whenever a plugin you use reports a security fix.
- WordPress maintenance tasks that actually matter | Pantheon
- WordPress
- WordPress maintenance checklist: 20 essential tasks | Duplicator
- WordPress maintenance checklist: What to do (and when) to keep your site running smoothly | Kinsta
FAQ
Is WordPress outdated in 2026?
No. WordPress still powers a large share of the web and receives regular core security updates, but a site is only as secure and current as its maintenance schedule. Outdated plugins and themes, not the platform itself, cause most of the problems people blame on WordPress.
How do I create a maintenance checklist for my WordPress site?
Start by listing every task by how often it needs doing (daily, weekly, monthly, quarterly, annually), then assign an owner to each one and log outcomes as you go. The frequency-based checklist earlier in this article is a ready-to-use starting template.
What are five items regular WordPress maintenance should check?
A solid baseline covers backup success, uptime status, pending core/theme/plugin updates, security scan results, and page load speed. Database cleanup and broken link checks round out a more complete monthly routine.
How do I put a WordPress site into maintenance mode?
Most caching or maintenance plugins add a one-click maintenance mode toggle, or you can add a temporary redirect rule at the server level for major updates. Always confirm the mode is switched off again once the update or restore is complete, since a site stuck in maintenance mode is its own outage.
How often should I run a full WordPress backup?
Sites with frequent transactions, like ecommerce or membership platforms, need automated daily backups, while low-change brochure sites can typically run weekly. Either way, test a full restore quarterly to confirm the backup actually works.