WordPress website maintenance: a weekly, monthly and yearly checklist

WordPress website maintenance is like a car's regular service: done on time, it is cheap and painless; forget it, and it usually shows up at the worst possible moment. In this article you'll find a practical checklist that splits the work into weekly, monthly, quarterly and yearly tasks, so you know exactly what to do, when and how. At the end we also look at which parts you can do yourself and where handing the work to a support team makes more sense.

Why WordPress maintenance isn't a one-off job

WordPress is made of three layers that each change on their own: the WordPress core, the theme and the plugins. Beneath these three layers sit the PHP version, the database and the hosting server. Each of them receives security updates, sometimes becomes incompatible with another, and sometimes is abandoned by its developer. A site that hasn't been touched for months isn't necessarily healthy; maybe nobody has found its problem yet.

Common problems that regular maintenance prevents:

• A break-in through an old plugin or theme with a known vulnerability.
• The contact form or email sending stops working without anyone noticing, and customer requests get lost.
• The domain or SSL certificate expires and visitors see a security warning.
• A backup that exists but can't be restored when you need it.
• The site gradually slows down as plugins, heavy images and extra data pile up in the database.

The good news is that most of these tasks are repetitive and can be scheduled. Once you set up the plan, running it doesn't take much time each week.

Before you start: the access and tools you need

Before running the checklist, get these ready and record them somewhere safe:

1. WordPress administrator access with a strong password and two-factor authentication.
2. Access to the hosting control panel (such as cPanel or DirectAdmin) and FTP or SFTP; if the WordPress dashboard becomes unreachable, this is the only way you can rescue the site.
3. Access to the domain registrar panel and to the email address that receives renewal notices.
4. A backup tool that saves a full copy (files plus database) to a location separate from the host itself.
5. An uptime monitoring service that checks the site every few minutes and notifies you if it goes down.
6. Google Search Console, to see crawl errors, removed pages and indexing issues.
7. Ideally, a staging copy (a test copy of the site) so you can try risky updates there first.

Also create a simple document listing your plugins, the PHP version, the domain and hosting renewal dates and where your backups are kept. On the day of a crisis, this document alone saves hours.

Weekly WordPress maintenance checklist

Weekly tasks are light, but they play the biggest role in your site's security.

1. Updates, but always after a backup

The golden rule is: no update without a fresh backup. Suggested order:

1. Take a full manual backup, even if you have automatic backups.
2. Read the release notes (changelog) of your important plugins. If the major version has changed, try the update on staging first.
3. Update plugins one at a time or in small groups, not all at once; if something breaks, you know which one is to blame.
4. After each update, open the home page, an inner page, the contact form and, if you have a store, the cart.

Don't put off security updates. If a plugin developer has released a security patch, install it the same day or, at the latest, the same week.

2. Confirm your automatic backups actually run

Having a backup plugin isn't enough. Every week, check that the latest backup was actually created, that its size makes sense (it hasn't suddenly become much smaller) and that it was stored on an external destination. A backup that lives only on the same host disappears if you lose the host.

3. Review the security and uptime reports

Go through your security plugin's report and watch for these signs: many failed login attempts, modified core files, or an administrator account you don't recognize. Check the uptime service's report too; short but repeated outages usually point to a lack of hosting resources or a problem with a plugin.

4. Test forms and critical paths

Go once through the contact form, the consultation request form and, on stores, the path from adding to cart through to the payment page, and make sure the message or email really reaches its destination. A broken form is one of the quietest problems: the site is up, but no requests reach you.

Monthly checklist: tasks that need more care

Test restoring a backup

Once a month, restore one of your backups to staging or a test host. The only way to be sure a backup is sound is to restore it. Note how long the restore takes, too.

Find broken links and 404 errors

Use the Pages report in Google Search Console and a link-checking tool to find broken internal and external links. For pages that have been removed or moved, set up a 301 redirect to the closest replacement page. Broken links both hurt the user experience and waste Google's crawler time.

Speed check

Measure the home page and one or two high-traffic pages with PageSpeed Insights and compare the results with the previous month. The goal isn't a perfect score; the goal is to spot a sudden drop early. If you see one, the culprit is usually the most recently installed plugin, heavy images or a cache that has stopped working. We cover more detailed fixes in our guide to improving website speed and Core Web Vitals.

Review user accounts

Open the WordPress user list and ask yourself:

• Is the account of a former colleague, freelancer or company whose work has finished still active?
• Does anyone have the Administrator role when they only need the Editor or Author role?
• Is there an administrator account with a guessable username such as admin?

Delete the extra accounts, transfer their content to another user, and make two-factor authentication mandatory for all administrators.

Clean up unused plugins and themes

A deactivated plugin still sits on the server, and if it is vulnerable it can become a way in. Delete every plugin and theme you don't use, and keep only one default WordPress theme as a fallback.

Quarterly tasks: a deeper review every three months

Every three months, set aside more time and look at the deeper layers of the site:

• Spot abandoned plugins: check in the WordPress plugin directory when each plugin was last updated and whether it has been tested with recent versions of WordPress. A plugin that hasn't been updated for a long time is a candidate for replacement.
• PHP version: check the PHP version in the WordPress Site Health tool and in your hosting control panel. If the current version no longer receives security support, upgrade, but on staging first.
• Database optimization: clean out old post revisions, spam comments and expired temporary data. Don't forget a backup first.
• Disk space and hosting resources: if you are close to your storage limit, backups may fail silently.
• Change sensitive passwords: if you have shared the hosting, FTP or database password with outside people during this period, change them.
• Review Google Search Console: check indexing errors, mobile issues and security warnings.
• Full recovery drill: once, bring the whole site back up on a test environment using only the backup and your access document. If you get stuck anywhere, your document or your backup isn't complete.

Yearly tasks: dates you must not miss

Some of the worst outages start with a simple date being forgotten. Every year, review these items and set a reminder in your calendar for each one:

• Domain renewal: check the expiry date in the registrar panel and, if possible, turn on auto-renewal or renew for several years. Make sure the email address registered in the domain panel is still one you can access; renewal notices go to that address.
• Hosting renewal: check the due date and the payment method.
• SSL certificate: most hosts renew free certificates automatically, but this renewal sometimes fails because of a DNS change or server settings. Check the expiry date in your browser, and if you have a paid certificate, note its renewal separately.
• Licenses for paid plugins and themes: when a license ends, security updates usually stop too.
• Update your access document: who has access to the hosting, the domain and the dashboard, and is all of that access still needed?

If you still don't know exactly where your domain and hosting are registered and in whose name, make that your first priority; the domain should be owned by the business itself, not by the person or company that built the site.

WordPress maintenance schedule at a glance

Print this table or add it as recurring tasks in your task management tool:

What to do when an update breaks your site

Even if you follow every tip, an update sometimes takes the site down. Follow this order:

1. Stay calm and don't repeat the update. Pressing the update button again usually makes things worse.
2. Check the administrator's email. For many serious errors, WordPress sends the site administrator an email with a "recovery mode" link that lets you log in to the dashboard and deactivate the faulty plugin.
3. Deactivate the faulty plugin from outside. If you can't reach the dashboard, use FTP or the host's file manager to rename that plugin's folder in wp-content/plugins so WordPress deactivates it.
4. Restore the backup if necessary. If the problem isn't solved quickly, restore the backup from before the update, then find the cause calmly on staging.
5. Report the problem to the plugin developer, and keep automatic updates for that plugin turned off until a fixed version is released.

Do maintenance yourself or get a support plan?

The answer depends on the size and sensitivity of your site and on how much free time you have. Doing the work yourself makes sense when:

• The site is a simple company website with only a few plugins and no online sales.
• Someone on your team is comfortable with the WordPress dashboard and the hosting control panel and has regular weekly time for this.
• A one- or two-day outage isn't a disaster for your business.

But handing the work to a support team is usually the better choice if:

• The site is an online store, or a large share of your customers reach you through the site's forms.
• You have many plugins or custom code, and updates carry a risk of incompatibility.
• You have been hacked before or have had repeated outages.
• Nobody on your team has enough time or technical knowledge, and in practice the checklist doesn't get done.

To be honest: the worst case is neither doing the work yourself nor making anyone responsible for it. Even running half of this checklist regularly is much better than having no plan at all. If you hand the work over, ask which tasks are done and how often, and where the backups are kept. On our website care & maintenance services page we have clearly listed the tasks MyTarh performs in each plan, so you can compare them with this checklist.

Frequently asked questions

How often should you back up a WordPress site?

It depends on how often your content changes. A company website that changes a few times a month is covered by a weekly backup plus a manual backup before each update. A store that takes orders every day needs at least a daily database backup, so that restoring it doesn't lose recorded orders.

Should I turn on automatic plugin updates?

For simple, reputable plugins that rarely make big changes, automatic updates can be useful, provided daily backups and uptime monitoring are active so you spot any breakage early. For sensitive plugins such as store builders, page builders or payment plugins, it is better to update manually and with a review.

Is a security plugin enough on its own?

No. A security plugin is one layer of protection, but it doesn't replace regular updates, strong passwords, two-factor authentication, removing unused plugins and external backups. Most break-ins happen through old plugins and weak passwords, and no plugin fully makes up for those two.

What should I do first if my site is hacked?

First, change the passwords for all administrator, hosting, FTP and database accounts and close any unknown accounts. Then restore from a backup you are sure was taken before the break-in, and close the way in (usually a vulnerable plugin or theme); otherwise the break-in will happen again. If you don't have enough experience, hand the job to an expert.

How much does WordPress maintenance cost?

It depends on the amount of work, the number of plugins, whether the site is an online store and how fast you expect responses. Some costs, such as domain, hosting and plugin license renewals, are separate from the support fee. To see the plans and current prices, visit the MyTarh pricing page.

If you'd rather have this checklist run without you having to worry about it, book a free consultation so we can review your site's current state and tell you which tasks are urgent. Details of the plans and how we work are on the WordPress website care & maintenance page.