WordPress maintenance checklist
The monthly WordPress routine that prevents 90% of emergencies: staged updates, tested backups, security scan, performance watch — in the order that matters.
17 checks · copy it, print it, argue with it.
WordPress rewards rhythm: sites maintained monthly rarely have emergencies; sites maintained never always do — usually the week of your biggest campaign. This is the monthly routine in priority order — the same one professional care plans run, and the honest companion to the maintenance agreement. If you do it yourself, do it in this order; the sequence protects you when a step breaks something.
Before anything — the safety net
- Verify last night's backup completed and landed off-sitethe update routine starts with a restore point that exists
- Confirm you can download the backup filea backup you cannot retrieve is a hope with a filename
- Snapshot staging or a copy of the current stateeven a quick duplicate gives you a same-day rollback
Updates — staged, not yolo
- Apply updates on staging first: WordPress core, then plugins, then theme — one at a time on major updatesbulk-updating production is how quiet conflicts become loud outages
- Click the critical paths after each update batch: home, a post, a page with forms, checkout if WooCommercetwo minutes of clicking catches what logs never show
- Apply to production, then re-click the critical pathsstaging and production differ exactly when it hurts
- Remove plugins and themes you do not use — inactive code still gets exploitedthe attack surface includes everything in /wp-content, active or not
Security & health
- Run a security scan; review any flagged file changesmonthly scans catch the quiet intrusions quarterly ones miss
- Check user list: remove stale accounts, confirm no unexpected adminsmost “hacks” are old contributor logins with weak passwords
- Confirm SSL certificate is valid and auto-renewingexpiry day is the loudest possible way to learn this lesson
- Review comment/moderation queue and form submissions for spam pattern changesa spam surge usually means a leaked key or a broken captcha somewhere
Performance & content watch
- Check Core Web Vitals for the home page and top landing pagestrends matter more than snapshots — a slow creep is a plugin bloating
- Review database size and autoload growthtransients and orphan tables grow silently until hosting complains
- Skim Search Console for new crawl errors or index dropsmaintenance is the right moment to catch technical SEO drift
- Broken-link check on top pages, fix or redirectinternal 404s waste crawl budget and customer patience alike
- Confirm the forms still deliver — send a test submission every monthsilent form failure is the most expensive failure a business site can have
- Note plugin end-of-life or replacement decisions for next month's planthe monthly review is where next quarter's rebuild gets spotted cheaply
Sixteen items, roughly an hour a month on a healthy site — or a care plan if an hour a month is not how you want to spend yours. Either way, the checklist beats the emergency.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.