WordPress maintenance checklist: what to do weekly, monthly and quarterly
A WordPress site is not finished when it goes live. Plugins release updates every week, certificates expire, forms stop sending email and databases grow. Most hacked WordPress sites we clean were not attacked in a clever way: they simply ran an outdated plugin with a known vulnerability. Here is the maintenance routine we follow for business sites.
Every day (automated)
- Backup of files and database, stored outside the hosting account.
- Uptime monitoring every minute, with an alert when the site is down.
- Security scan for malware and changed core files.
Every week
- Review available updates for WordPress core, plugins and themes.
- Update safely: first on a staging copy, then on the live site. Check the home page, contact form, checkout and any custom pages after updating.
- Check the form: send a test request and confirm the email arrives and is not in spam.
Every month
- Remove unused plugins and themes. Deactivated plugins can still be exploited.
- Review users: delete old accounts and make sure administrators use strong passwords and two-factor login.
- Check the SSL certificate and the redirect from HTTP to HTTPS.
- Look at speed on mobile with PageSpeed Insights. A new plugin or a large image can quietly slow the site down.
- Clean the database: spam comments, old revisions and expired transients.
- Write a short report: what was updated, what was found, what is recommended.
Every quarter
- Restore test: restore the latest backup to a test location and make sure the site works.
- Check the PHP version on the hosting and plan an upgrade before it reaches end of life.
- Review security headers and the hosting configuration.
- Check search visibility: sitemap, robots.txt, pages accidentally set to noindex and broken links.
How to update without breaking the site
- Take a fresh backup right before updating.
- Read the changelog of major updates, especially for page builders and WooCommerce.
- Update on staging first and click through the important pages.
- Update plugins one at a time on the live site if staging is not available.
- Keep the previous version ready to roll back.
Signs your site needs attention now
- Google Search Console shows “security issues” or “hacked content”.
- Visitors are redirected to strange sites, often only on mobile.
- The hosting provider suspended the account for sending spam.
- Contact form requests suddenly stopped.
If you would rather not do all of this yourself, our website administration plans cover it from €59 a month. The free audit includes an external check of your WordPress versions and known vulnerabilities.