WordPress Maintenance Checklist: What to Do and When

A healthy WordPress site doesn't stay that way by accident — it needs a small but consistent set of maintenance tasks run on the right schedule. This guide gives you a realistic, prioritised checklist organised by frequency: daily, weekly, monthly, and annually, with honest notes on what actually matters and what you can safely skip.

Why Most Maintenance Advice Fails Site Owners

Most maintenance guides hand you a wall of tasks with no sense of priority. You end up either ignoring the list entirely or spending hours on things that barely move the needle. The goal here is different: every task below has a clear reason behind it, a realistic time estimate, and an honest note on what breaks if you skip it.

The underlying principle is simple. WordPress maintenance exists to prevent three categories of failure: security compromise, data loss, and silent performance decay. Every task maps to one of those categories. If a task doesn't, it probably isn't worth your time.

Before You Start: The Non-Negotiable Foundation

No maintenance routine works without two things in place first.

• Automated off-site backups. Your backup must be stored somewhere separate from your host — not just a copy on the same server. If your host has a bad day, so does an on-server backup. Plugins like UpdraftPlus or Jetpack Backup can push copies to cloud storage automatically. Daily backups for active sites, weekly for low-traffic ones.
• A staging environment. Testing updates on a live site is how sites break in front of real visitors. Most managed hosts provide one-click staging. If yours doesn't, it's worth switching or using a service that does.

With those in place, the rest of this checklist becomes much lower risk.

Daily Tasks (5 Minutes or Less)

Check uptime and error alerts

Use a free uptime monitor (UptimeRobot has a free tier) to alert you by email or SMS if your site goes down. Five minutes of checking a dashboard is not a daily task — the point is that the monitor does the work and only contacts you when something is wrong. If you're getting alerts and the cause isn't obvious, a 500 error or database connection failure are the most common culprits.

Glance at spam comment queues

If comments are enabled, a quick daily review prevents spam from aging into a moderation backlog or, worse, slipping through to published status. Akismet handles most of this automatically — your daily task is just confirming nothing legitimate got caught.

Weekly Tasks (20–30 Minutes)

Run updates — but in the right order

Update WordPress core, themes, and plugins at least once a week. The order matters: plugins first, then themes, then core. That way, if a plugin update introduces a conflict, you catch it before a core update layers on top of it and makes the root cause harder to isolate.

Before updating anything on a live site, confirm your backup ran successfully. A backup you can't restore from is not a backup. After updates, do a quick front-end check: load the homepage, a post, the checkout page if you run WooCommerce, and any form that matters. If something breaks, you'll know within two minutes rather than two days.

If you're not sure what to do when an update breaks something, see our guide: WordPress Site Broke After an Update? Here's What Happened and How to Fix It.

Review security scan results

If you have a security plugin like Wordfence or Solid Security installed, it runs scans automatically — but the results sit in a dashboard no one reads. Set a weekly reminder to open the scan report and review flagged items. Most flags are false positives, but the one week you skip it is often the week something real shows up. For more detail on what a compromised site actually looks like, see WordPress Site Hacked? Here's How to Clean It Up — Safely.

Check form submissions are arriving

Broken contact forms are a silent killer for small businesses — you don't notice until a client tells you they sent three messages and heard nothing. Send a test submission to yourself weekly. If it doesn't land in your inbox, check your spam folder and your form plugin's log before assuming the worst.

Monthly Tasks (1–2 Hours)

Audit installed plugins

Open your plugins list and ask one question about each: is this still needed? Deactivated plugins that haven't been deleted still sit on your server and can still be exploited if they contain vulnerabilities. Delete anything you aren't using. For anything you are using, confirm it's been updated in the last six months — a plugin that hasn't received an update in a year or more is a growing liability.

If you want to understand what the plugins you do keep are actually doing to your server resources, the post What Plugins Actually Do to Your Server (Not Just Speed) is worth reading.

Check Core Web Vitals and load time

Run your homepage through Google PageSpeed Insights or GTmetrix once a month. You're not chasing a perfect score — you're watching for regressions. A score that was 80 last month and is now 55 tells you something changed. Common culprits are new plugins adding scripts, images added to the homepage without compression, or a caching configuration that got reset after an update.

Review user accounts and access

Go to Users → All Users and look for anything unfamiliar. Dormant admin accounts from old contractors or test accounts left over from setup are a common entry vector in compromised sites. Delete what you don't recognise, and downgrade anything that doesn't need full admin access to a lower role. An Editor role can manage content perfectly well without the ability to install plugins or modify theme files.

Test your backup restore

This is the task everyone skips and the one that matters most. A backup is only valuable if you can actually restore from it. Once a month, download your backup archive and confirm the files are intact. Every quarter, do a full restore to a staging environment. If the restore fails, you want to find out now — not during an actual emergency.

Clear transients and review database size

WordPress stores temporary data called transients in the database. Plugins and themes can accumulate thousands of expired transient rows over time, bloating the wp_options table and slowing queries. A plugin like WP-Optimize can clear these safely. Check your database size in your host's control panel — if it's grown significantly since last month without a matching growth in content, something is generating unnecessary data.

Annual Tasks (Half a Day)

Review and test your disaster recovery plan

Once a year, walk through what you would actually do if your site was down, hacked, or deleted. Where are your backup credentials stored? How long would a full restore take? Who would you call? If the answer to any of those is "I'm not sure," now is the time to document it while there's no pressure.

Audit your hosting plan

Hosting needs change. A site that outgrows shared hosting shows symptoms gradually — slow admin, intermittent timeouts, failed cron jobs — rather than all at once. Once a year, check whether your resource usage (CPU, memory, disk) is consistently near the limits of your plan. If it is, upgrading or moving to a better-matched host is a maintenance task, not a luxury.

Review PHP version

WordPress works best on a supported PHP version. Check what your host is running (it's usually visible in cPanel or the hosting dashboard) and compare it against the current PHP supported versions list. Running end-of-life PHP means no security patches. Test any upgrade on staging before applying it to the live site.

Full theme and customisation audit

Over the course of a year, themes accumulate changes — sometimes made directly in theme files rather than via a child theme or the Customizer, which means they'll disappear on the next theme update. Once a year, audit what customisations exist and make sure they're stored safely. If you're not sure how to protect those changes, see Why Direct Theme Edits Break Sites — And the Safe Way.

When to Hand This Off

If this list feels like more than you want to manage yourself — or if you've already fallen behind and something has broken — that's a completely reasonable place to be. WordPress maintenance is genuine technical work, and doing it inconsistently is often worse than having someone else handle it consistently.

If something is already broken, a free Mend Diagnosis will tell you exactly what's wrong and quote a flat price before any work starts. If you'd rather hand off the ongoing routine entirely, the Mend Care Plan covers managed updates, backups, security scanning, and uptime monitoring for $99/month — with senior engineers watching your site instead of you.

The sites that never have emergencies aren't the ones with the most sophisticated setups — they're the ones where someone ran this list every week without drama. The maintenance itself isn't complicated. The hard part is doing it consistently.