WordPress Maintenance Checklist: 15 Weekly, Monthly and Quarterly Tasks

A WordPress maintenance checklist keeps four things in order: a backup you can restore, up-to-date software, forms and checkout that still work, and a site cleared of things you no longer use. The 15 tasks below are grouped by how often they need doing: four every week, eight every month and three every quarter.

How often should you do WordPress maintenance?

Do updates and the tests that follow them every week, most checks every month, and the clean-ups every quarter. Updates are weekly because a month is a long time to leave a known flaw open. WordPress installs its own minor and security releases automatically on most sites, but plugins and themes only update when you (or an auto-update you switched on) do it, and that is where most of the risk sits: Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins.

Backups need their own schedule. WordPress.org suggests weekly backups for smaller sites and daily backups for busy ones, plus a fresh one before every update. A store that takes orders every day belongs in the daily group.

Before your first session, make sure you have an administrator login, access to your hosting account, and automatic backups that store copies away from your server.

What should a WordPress maintenance checklist include?

Every week

• 1. Update WordPress, plugins and themes. Take a fresh backup, update one item at a time, and look at the site after each one. On a store, try the updates on a staging copy (a private copy of the site) first, as WooCommerce recommends. Why: one at a time shows you which change caused a problem, and our guide to WordPress update failures explains how to recover.
• 2. Review security scans and logins. Read your security plugin's latest scan (Wordfence's free scanner, for example, compares your core, theme and plugin files with the official copies and looks for malware). WordPress keeps no login history, so an activity log plugin such as Simple History helps you spot logins and new users you did not expect. Why: a break-in that goes unnoticed for weeks ends up in your backups too.
• 3. Send a test entry through every form. Submit each contact, quote and booking form, then confirm the notification email arrives (check spam too). WordPress hands mail to your web server, and a successful send only means the server accepted it, not that it arrived. If messages go missing, an SMTP plugin such as the free FluentSMTP sends them through a real email service and logs each one. Why: a broken form loses leads without showing you any error.
• 4. Place a test order (stores only). Go from product page to confirmation email. WooCommerce recommends doing this on a staging site with the payment gateway in its test mode, then deleting the test orders so nobody ships them and they stay out of your reports. Why: checkout can fail quietly after an update to a payment, shipping or tax plugin.

Every month

• 5. Check your backups and restore one. Confirm they ran on schedule, include the database as well as the files, and are stored away from your server; WordPress.org suggests keeping three to five recent copies in different places. Then restore the latest one to a staging copy. Why: a backup you have never restored is a guess.
• 6. Review user accounts and roles. Under Users, remove former staff, past developers and test accounts, look for administrators you do not recognize, and give each person the lowest role that fits. An Editor can manage everyone's posts; an Author only their own. Why: every unused login, especially an administrator's, is another way in.
• 7. Check uptime and your SSL certificate. Look over your uptime monitor's outage record (Jetpack's free Monitor, for example, checks your homepage every five minutes and emails you when it is down). Then check when your security certificate expires and that it renews on its own: since March 15, 2026, new certificates last at most 200 days, and the limit falls to 47 days in 2029. Why: an expired certificate puts a browser warning in front of every visitor.
• 8. Read Site Health and check your PHP version. Tools > Site Health lists critical issues, such as an outdated PHP version, plugins waiting for updates or background updates that are not working. The Info tab shows your PHP version under Server. WordPress recommends PHP 8.3 or newer, and PHP 8.2 stops receiving security fixes on December 31, 2026. Why: a PHP upgrade is easier to test on staging now than to discover when your host makes it for you.
• 9. Check Google Search Console. Open the Security issues and Manual actions reports first, then the Page indexing report for important pages that have dropped out, including "Not found (404)" and "Server error (5xx)" entries. Why: Google can warn searchers about a hacked site before you notice anything wrong.
• 10. Run a speed check. Test your homepage and one key page in PageSpeed Insights on mobile. A page passes Core Web Vitals when, for at least three in four real visits over 28 days, the main content appears within 2.5 seconds (LCP), taps get a response within 200 milliseconds (INP) and the layout barely shifts (CLS under 0.1). A small site may only get lab results; compare them with last month's. Why: sites slow down one plugin or oversized image at a time.
• 11. Clear spam and moderate comments. Approve or delete pending comments, and use Empty Spam in the Spam view of the Comments screen. If you use Akismet, it already deletes spam older than 15 days. If you never use comments, untick "Allow people to submit comments on new posts" under Settings > Discussion. Why: a real question from a customer gets lost in a queue nobody reads.
• 12. Delete plugins and themes you do not use. Deactivated code still sits on your server, and Site Health itself calls inactive plugins tempting targets for attackers. Keep one default WordPress theme, which WordPress falls back to if your theme breaks. Why: fewer plugins mean fewer updates and fewer places for a flaw to hide.

Every quarter

• 13. Find and fix broken links. Search Console shows the 404s Google has found. For a full scan, use the Broken Link Checker plugin (by WPMU DEV), which can scan from WPMU DEV's servers with a free account, or Screaming Frog's SEO Spider, a desktop app that crawls up to 500 URLs free. Fix each link, or redirect a removed page to its closest replacement. Why: a dead link is a dead end for a visitor who was ready to act.
• 14. Clean up the database, after a backup. WordPress keeps every revision of every post and page by default, and deleted plugins can leave their data behind. A cleanup plugin such as the free WP-Optimize removes old revisions, trashed items, spam comments and expired transients (temporary data that plugins store) and optimizes the tables. WordPress already empties the trash after 30 days and clears expired transients daily, so on a small site the gain is modest. Why: a tidy database means smaller backups, and the backup comes first because a cleanup cannot be undone.
• 15. Review your content. Read your key pages as a customer would: prices, hours, phone numbers, service areas, staff and offers, plus your privacy policy. Update posts that have gone out of date, or redirect them to a current one. Why: visitors act on what the page says, so a wrong phone number or price costs you real leads.

Can WordPress maintenance be automated?

Partly. WordPress installs its minor and security releases on its own, and you can switch on auto-updates plugin by plugin and theme by theme; they run twice a day and email the site's admin address after each attempt. Backups, uptime checks, security scans and database cleanups can all run on a schedule too.

What automation cannot do is judge the result. It will not notice that an update moved your layout, that a form stopped emailing, or that checkout fails for one payment method. So keep the weekly tests, and update plugins that run your checkout, payments, forms or page layout by hand after a staging test.

What does a WordPress care plan take off this list?

A care plan takes the core of this routine off your list: updates, backups, malware scans and uptime monitoring. WP Resolve's care plans are month to month, with no minimum term:

• Essential Care, $79 a month: weekly core, theme and plugin updates with visual checks; daily off-site backups kept 30 days; malware scanning and uptime monitoring; basic hardening (login protection and firewall rules); a monthly report; 30 minutes of small fixes a month.
• Business Care, $149 a month: everything in Essential, plus updates tested on a staging copy first, malware cleanup, a quarterly speed tune-up and 2 hours of edits and fixes a month.
• Commerce Care, $199 a month: for WooCommerce stores, everything in Business, plus WooCommerce, payment and shipping plugins tested on staging, checkout and order-flow monitoring, a weekly performance check and 3 hours of edits and fixes.

Anything not listed above, such as the content review, stays on your own calendar: only you know when your prices, hours or offers change.

Not sure where your site stands today? Ask for a free site health check covering updates, backups, security and speed, or text (916) 209-0917.

Frequently asked questions