This checklist is designed for WordPress site owners and developers who want a systematic approach to maintenance. Use it to build your own maintenance schedule or evaluate what a maintenance service should be doing for you.
Weekly tasks
Update WordPress core, plugins, and themes
Check for and apply available updates. Security-critical updates should be applied within 24 hours of release. Wordfence and Patchstack can alert you when plugins you’re using have new CVEs, often before the update is published. Always have a recent backup before applying updates, plugin conflicts after updates are uncommon but do happen.
Verify backups are completing successfully
Check that your backup plugin or service completed its last scheduled backup without error. Backup systems can fail silently, the backup runs but produces a corrupt file, or the storage destination fills up. Log into UpdraftPlus, BlogVault, or your host’s backup panel and confirm the last backup timestamp and file size are what you’d expect.
Check uptime monitoring alerts
Review your uptime monitoring dashboard for any downtime incidents in the past week. UptimeRobot and Betteruptime track uptime every 1-5 minutes. Weekly review catches recurring issues, a site that goes down for 2 minutes every Tuesday night has a scheduled task or cron job that’s failing.
Monthly tasks
Database optimization and cleanup
WordPress databases accumulate overhead over time. Post revisions, spam comments, transients, and orphaned metadata all add to database size without adding value. WP Optimize (free) cleans revisions, transients, and draft content. Check the wp_options autoloaded data size, if it’s over 1MB, identify and remove the plugins or processes bloating it.
Security scan
Run a Wordfence malware scan or equivalent. Wordfence compares your WordPress core files, themes, and plugins against known-good checksums and flags files that have been modified. Also review the Wordfence security events log for failed logins, blocked IPs, and any suspicious activity patterns.
Broken link audit
Internal links break when you change URLs, delete pages, or restructure content. External links break when the sites you link to change their URLs or go offline. Broken Link Checker (plugin) or Screaming Frog can crawl your site and report 404 links. Fix internal ones; update or remove broken external ones. Broken links affect both user experience and SEO.
Review Google Search Console
Check for: new crawl errors (404s, 5xx errors, redirect chains), manual actions, Core Web Vitals failures, and indexing issues. The Coverage report shows which URLs are indexed and which are excluded, unexplained exclusions can indicate technical SEO problems. Performance data shows search impression and click trends.
Speed test on key pages
Run PageSpeed Insights on your homepage and highest-traffic pages. Speed degrades over time as content is added, images are uploaded without optimization, and scripts accumulate. A monthly baseline makes regressions visible before they become ranking problems. Track Core Web Vitals scores (LCP, INP, CLS) as your primary metrics.
Test forms and conversion paths
Submit each contact form on your site and verify you receive the notification email. Test any booking systems, quote calculators, or other conversion tools. Plugin updates can break form functionality silently, the form appears to work, but submissions aren’t delivered or saved. Monthly testing catches this before it costs you inquiries.
Quarterly tasks
Restore test from backup
Restore your most recent backup to a staging environment and verify it works. This is the only way to know your backup is actually usable. Corrupted backup files, missing database tables, and configuration issues all prevent a backup from restoring cleanly. Finding this during a test is much better than finding it during an actual emergency.
Plugin audit
Review every installed plugin. For each one, ask: Is this still being used? Has the plugin been updated in the past 6 months? Is there a better alternative that’s been introduced since we installed this? Remove plugins that are deactivated, outdated, or replaced by newer options. Fewer plugins means a smaller attack surface and often better performance.
User account review
Review the list of WordPress admin and editor users. Remove accounts for former employees, contractors, or clients who no longer need access. Check that all remaining admin accounts have strong passwords and 2FA enabled. Admin accounts with weak credentials that haven’t been used in months are a prime target.
Content review and update
Review your main service pages, about page, and team pages for accuracy. Business details change, team members, services offered, phone numbers, business hours. Outdated content is both a trust signal issue for visitors and a potential compliance problem if pricing or capabilities have changed. Review your top-performing blog posts to see if they need updates.
Annual tasks
SSL certificate renewal check
Most SSL certificates renew automatically via Let’s Encrypt, but not always. An expired SSL certificate causes browser security warnings that immediately destroy trust and conversions. Check your SSL expiry date and set a calendar reminder 30 days before. Use SSL Labs’ free test to verify your certificate and configuration are correct.
Domain and hosting renewal verification
Verify domain registration expiry dates and hosting renewal dates. Domain expiry is one of the most preventable ways to take a site offline. Check that the email address associated with your domain registrar account is current, expiry warnings go to the registrant email, and if that email address no longer exists, you won’t get the warning.
Comprehensive SEO audit
Run a full technical SEO audit with Screaming Frog or Semrush’s site audit. Review Core Web Vitals trends over the year, check for crawl budget issues on larger sites, audit your internal linking structure, and identify content that’s accumulated but no longer serves a purpose. Annual SEO audits surface problems that monthly monitoring misses because they develop gradually.
Hosting plan review
Review whether your current hosting plan still fits your needs. Has traffic grown to where you’re hitting resource limits? Has the host introduced better plans that would improve performance? Are you paying for resources you’re not using? Hosting is often a “set and forget” expense, but annual review catches mismatches between what you’re paying and what you need.
Don’t want to do this yourself?
Our WordPress maintenance plans cover updates, backups, security, uptime monitoring, and monthly reporting. From $79/month depending on the site.
