On this page
Most WordPress sites that get hacked or break weren’t unlucky. Somebody stopped doing the boring monthly tasks. Here’s the full checklist, monthly, quarterly and yearly, whether you do it yourself or want to know what a maintenance plan should cover.
The monthly WordPress maintenance checklist
Do these in order. The order is the point: a fresh backup before any update, and a test after it.
- Take a full off-site backup. Files and database, stored away from your server, before you touch anything else.
- Update WordPress core, then themes, then plugins. One plugin at a time, on a staging copy first if your host provides one, so you know which update caused a problem.
- Test what earns you money. Submit each contact form, log in, search, and on a store, run a test order through the checkout.
- Run a security scan. Check for malware, unknown admin users and spikes in failed logins.
- Review uptime and errors. Look at last month’s downtime alerts, new 404 errors and broken links, and fix the ones that matter.
- Check speed. Run your key pages through PageSpeed Insights on mobile and look at Core Web Vitals in Google Search Console.
- Check Search Console for problems. Indexing errors, security issues and manual actions all show up there first.
- Clean up. Delete spam comments and old form entries, empty the trash and clean the database of old revisions.
- Make the small fixes. Text changes, new images and anything that has been waiting since last month.
Extra monthly checks for WooCommerce stores
A store has more to break and more at stake, so add these:
- Place a real test order with each payment gateway and confirm the order emails arrive
- Check for failed or stuck orders, and payment gateway warnings in the WooCommerce dashboard
- Confirm stock levels, shipping rates and tax still calculate correctly after updates
- Check that WooCommerce’s database updates have run after a WooCommerce update
Quarterly tasks
Every three months, step back from routine updates:
- Test a restore. Restore a recent backup to a staging site. A backup you’ve never restored hasn’t been proven to work.
- Audit your plugins. Remove plugins you don’t use and replace any that haven’t been updated in a year: abandoned plugins are a common way in for attackers.
- Review user accounts. Remove old staff and contractor logins, check admin roles and turn on two-factor authentication.
- Check your PHP version. Make sure your host runs a version of PHP that’s still supported.
- Check your tracking. Confirm analytics, conversion tracking and form notifications still work.
- Spot-check on a phone. Go through your main pages and forms on a real mobile device.
Yearly tasks
Once a year:
- Renew what expires. Your domain, premium plugin and theme licences, and any paid services the site depends on.
- Review hosting. Is the plan still right for your traffic, and is the server close to your customers?
- Update outdated content. Prices, team pages, dates and anything that says last year.
- Review legal pages. Privacy policy and cookie notices, especially if you’ve added tracking or new forms.
- Check your theme. Make sure it’s still maintained; an abandoned theme is a security risk and blocks future updates.
- Run a full SEO check. Titles, descriptions and pages that have dropped in Google.
What a monthly maintenance plan should include
A WordPress maintenance package should cover this checklist and say how often each task runs. Here’s how the work splits across typical plan levels, using my own maintenance plans as the example:
| What’s included | Essential | Business | Store |
|---|---|---|---|
| Core, theme and plugin updates | Monthly | Monthly | Monthly |
| Off-site backups | Weekly | Daily | Daily |
| Security monitoring and malware scans | ✓ | ✓ | ✓ |
| Uptime monitoring | ✓ | ✓ | ✓ |
| Speed check and report | — | Monthly | Monthly |
| Updates tried on a staging copy first | — | — | ✓ |
| Checkout and payment tested after updates | — | — | ✓ |
| Time for small changes | 30 min | 1 hour | 2 hours |
| Response time | — | Next business day | Same day for urgent issues |
| Price (NZD per month) | $200 | $299 | $499 |
Essential suits small business sites, Business suits sites that change often, and Store is for WooCommerce stores and larger sites. Full details are on the maintenance plans page.
Questions to ask before you sign up for a plan
Whoever maintains your site, ask:
- Which of the tasks above are included, and how often do they run?
- Where are backups stored, how long are they kept, and when was a restore last tested?
- Are updates tested before they reach the live site?
- What happens if the site is hacked: is the clean-up included?
- How much change time is included each month, and how fast are urgent problems fixed?
If the answer to most of these is vague, the plan is probably just automatic updates. For what plans cost and the other running costs of a WordPress site, see how much WordPress maintenance costs per month.