A WordPress site is never finished. Plugins release updates, new vulnerabilities are published, backups pile up, content goes stale and pages slowly get heavier. None of it is difficult on its own; the problem is remembering to do it, every time, on every site.
This WordPress maintenance checklist breaks the work into what to do every week, month, quarter and year, then explains which tasks to automate so the schedule keeps running when you are busy. There is a printable checklist at the end.
Why maintenance is a schedule, not a task
Most WordPress problems are not caused by one big mistake. They come from small jobs that slipped: an update left for a month, a backup that stopped running in the spring, a plugin nobody remembers installing. Each one is harmless on its own until it is not.
Thinking of maintenance as a schedule changes the question from “is the site OK?” to “did this week’s checks run?”. That is easier to answer honestly, and easier to hand to someone else.
The tasks fall into six groups:
| Area | What can go wrong if it slips |
|---|---|
| Updates | Known vulnerabilities stay open; updates pile up and get riskier |
| Backups | No clean copy to go back to when something breaks |
| Security | A compromise goes unnoticed for days or weeks |
| Uptime | Clients or customers find the outage before you do |
| Speed | Pages get slower until they fail Core Web Vitals |
| Content and SEO | Broken links, outdated information and lost rankings |
The right frequency depends on the site. A brochure site that changes twice a year needs less than a busy WooCommerce store. Treat the lists below as a sensible default and adjust from there.
Every week
Weekly WordPress maintenance tasks are about catching problems while they are small.
- Review and apply updates. Check WordPress core, plugins and themes. Apply security releases straight away. For other updates, take a restore point first and check the site afterwards.
- Check backups ran. Confirm the latest backup completed, is stored off the server and is a sensible size. A backup that suddenly shrinks often means something is missing.
- Look at uptime and errors. Review any downtime alerts from the past week and what caused them. If you are not monitoring yet, our guide to WordPress uptime monitoring explains how to start.
- Review security alerts. Read through alerts for new administrators, failed and unusual sign-ins and changed files. Our article on WordPress security monitoring covers what each one means.
- Test the forms. Submit the main contact or enquiry form and check the message arrives. Forms break silently more often than anything else.
- Moderate comments and spam, if comments are open.
Every month
Monthly tasks look a little wider than the weekly checks.
- Scan for vulnerabilities. Compare installed plugin and theme versions against known vulnerabilities, and act on anything that affects the site.
- Check speed. Run the homepage and one or two key pages through PageSpeed Insights, and look at the Core Web Vitals report in Search Console. Look for trends, not one-off scores.
- Fix broken links. Run a quick crawl or a link checker and fix or remove links that return errors.
- Read Search Console. Check the Pages report for new indexing problems, and the Security Issues and Manual Actions reports.
- Review users. Remove accounts for people who have left, and make sure nobody has more access than they need.
- Clean up. Delete spam comments, old revisions and transients if the database is growing quickly.
- Report. Send the site owner, or yourself, a short summary: what was updated, any incidents, uptime and speed.
Every quarter
Quarterly tasks are the ones that are easy to skip because nothing seems wrong.
- Test a restore. Restore a recent backup to a staging site and check it works: pages load, images appear, forms send, people can sign in. This is the single most skipped task in WordPress maintenance and the one you will most regret skipping.
- Audit plugins and themes. Remove anything inactive or unused, and replace plugins that are no longer maintained. Every plugin is code that has to be kept up to date.
- Check PHP and server software. Make sure the site runs on a PHP version that is still supported, and plan an upgrade if not. Your host’s control panel will show the version.
- Review content. Update pages with outdated prices, opening hours, team members or offers. Check the most visited pages still say what you want them to.
- Check the user experience on mobile. Walk through the main journeys on a real phone: finding a service, getting in touch, buying something.
- Rotate important passwords and confirm two-factor authentication is on for every administrator.
Every year
Annual tasks are about the foundations.
- Renew the domain and check SSL. Confirm the domain renews automatically, the contact details are correct, and the SSL certificate renews without anyone needing to remember.
- Review hosting. Is the plan still the right size? Is the server response time acceptable? Are you paying for things you do not use?
- Review the theme. If the theme has stopped receiving updates, or the site has outgrown it, plan a replacement before it becomes urgent.
- Run a full technical SEO audit. Our technical SEO guide has a checklist you can work through.
- Check legal pages. Make sure the privacy policy, cookie consent and terms reflect what the site actually does today.
- Review access. List everyone with access to the site, the hosting, the domain and any connected services, and remove what is no longer needed.
What to automate
Looking at the lists above, a pattern stands out: most of the work is checking, not fixing. Checks are exactly what software is good at, and they are what slips first when people get busy. Automate the checks, and keep people for the decisions.
Good candidates for automation
- Updates, with safety checks. Automatic updates are only safe if something checks the site afterwards and can undo the update.
- Backups and restore tests. Scheduled, off-site and tested on a schedule, so you find out a backup is broken before you need it.
- Uptime checks. Every minute, from more than one location.
- Security monitoring. File changes, new administrators and sign-ins, with alerts as they happen.
- Speed tracking. Core Web Vitals and response time recorded over time, so a slowdown shows up as a trend.
- Reports. A monthly summary that writes itself.
How we automate it
We run the sites we look after on WPCentrify, our own WordPress management platform. It handles the checking side of this checklist across every site from one dashboard:
- Safe updates in seven stages: a risk score for the release, a restore point, the update applied on staging first, health checks, a visual regression test, functional tests of forms, cart, checkout and login, then ship or roll back.
- Bulk updates of plugins, themes and core across sites, with scheduling.
- Encrypted off-site backups with one-click restore and scheduled restore testing.
- Uptime checks every 60 seconds, confirmed from a second location before anyone is alerted.
- Vulnerability scanning across every site, ranked by exposure, and Sentinel alerts for file changes, new admins and sign-ins.
- Core Web Vitals and response time tracked over time.
- White-label client reports, sent automatically with a plain-language summary at the end of each month.
You can read more about how we use it on our WPCentrify page.
What still needs a person
Automation does not decide whether to replace an abandoned plugin, rewrite an outdated page or move to a better host. It does not notice that your opening hours changed. The quarterly and yearly tasks above are mostly judgment, and they are where a person adds the most value.
Checklist
Every week
- Apply security updates; review other core, plugin and theme updates.
- Confirm the latest backup completed and is stored off the server.
- Review uptime alerts and their causes.
- Review security alerts: new admins, sign-ins, changed files.
- Submit the main forms and check the messages arrive.
- Moderate comments and spam.
Every month
- Scan plugins and themes for known vulnerabilities.
- Check speed and the Core Web Vitals report.
- Find and fix broken links.
- Review Search Console: Pages, Security Issues, Manual Actions.
- Remove users who no longer need access.
- Clean the database if it is growing quickly.
- Send a short maintenance report.
Every quarter
- Restore a backup to staging and test it.
- Remove unused plugins and themes; replace abandoned ones.
- Confirm the PHP version is still supported.
- Update outdated content on key pages.
- Walk through the main journeys on a phone.
- Rotate admin passwords and confirm two-factor authentication.
Every year
- Check domain renewal and SSL auto-renewal.
- Review the hosting plan and server response time.
- Review whether the theme is still maintained and fit for purpose.
- Run a full technical SEO audit.
- Review the privacy policy, cookie consent and terms.
- Review everyone’s access to the site, hosting and domain.
If you would rather hand the whole schedule to someone else, that is what our WordPress management service does, with updates, backups, security and uptime running on WPCentrify and a person reviewing the results.