The WordPress maintenance checklist, by how often each task matters

Most maintenance checklists are a list of forty tasks with no sense of which ones matter. In practice, four or five things prevent almost every problem, and the rest are housekeeping. Here is the honest version, ordered by frequency, with what it costs you to skip each one.

Every day

Check the backup ran. Not take a backup — check the automated one completed. A backup system that has been silently failing for three months is worse than no backup, because you think you are covered.

Time: 1 minute, or zero if you are alerted on failure. Skip it and one day you will need a backup that does not exist.

Watch uptime. You want to hear your site is down from monitoring, not from a customer. Free tools check every five minutes, which is enough for most sites.

Time: zero, once configured.

Every week

Apply updates — properly. This is the single most valuable task on the list, and the one most often done badly. Doing it properly means: backup first, update core, then plugins, then themes, then load your homepage, a product or service page, and any form or checkout to confirm nothing moved.

Time: 15–30 minutes. Skip it and you are running published vulnerabilities. Most hacked sites were breached through a flaw patched months before.

Scan for malware. Weekly is enough for a normal site, daily for a shop. What matters is that someone sees the result.

Time: 5 minutes.

Check for vulnerability disclosures. New flaws are published constantly. If one affects a plugin you run, you want to know within days, not at the next update cycle.

Time: 5 minutes, or zero if something watches it for you.

Every month

Test a restore. Actually restore a backup to a staging site and open it. An untested backup is a hope, not a plan, and restore failures are far more common than people expect.

Time: 30 minutes. This is the task everyone skips and everyone regrets skipping.

Review users. Remove accounts for people who have left, downgrade anyone who does not need administrator, and check nothing was added that you did not add.

Time: 10 minutes.

Check forms and email. Submit your own contact form. WordPress email breaks silently and often — a plugin update, a DNS change, a host tightening its mail rules — and you find out weeks later when someone asks why you never replied.

Time: 10 minutes. The quiet revenue killer on this list.

Look for broken links and 404s. Both from your own content and from Search Console.

Time: 15 minutes.

Review the security log. Blocked login attempts, file changes, new admin sessions.

Time: 10 minutes.

Every quarter

A speed pass. Sites get slower the way houses get cluttered: gradually, through accumulation. Clear expired transients, trim autoloaded options, compress new images, verify caching still works after all those plugin updates.

Time: 1–2 hours. Skip it and you lose conversions you never know about.

Prune plugins. Remove anything deactivated, unused, or unmaintained for over a year. Every plugin is code that runs on your site and a potential way in.

Time: 30 minutes.

Check your PHP version. PHP branches stop receiving security fixes on a schedule. Running an unsupported one means no amount of WordPress updating protects you.

Time: 10 minutes to check, an hour to upgrade with your host.

Review the database. Post revisions, spam comments, orphaned metadata from removed plugins.

Time: 30 minutes, carefully. Deleting the wrong rows breaks things.

Every year

• Renew domain and SSL — or better, confirm auto-renewal is genuinely on
• Review who has access to hosting, DNS, registrar and WordPress
• Check that your privacy policy and cookie banner still match what the site does
• Consider whether the theme is still maintained

What this adds up to

For a single site, about 3 to 5 hours a month if you do it properly and nothing goes wrong. The problem is not the hours — it is that the tasks are boring, invisible, and easy to defer, and they only announce themselves by failing.

That is the actual argument for a care plan: not that the work is hard, but that it is the kind of work that reliably does not get done. Ours starts at $79 a month, which is under an hour of most people's time.

If you would rather see where your own site currently stands, our free plugin runs this checklist against it and tells you what is outstanding, with no account and no obligation.