WordPress is flexible and easy to edit, but it isn't maintenance-free. Plugins and themes need updating, backups need checking, spam and security threats need watching, and content and speed drift over time. A simple routine prevents most problems. This checklist breaks WordPress maintenance into weekly, monthly, quarterly and yearly tasks.
Weekly tasks
- Check for core, plugin and theme updates
- Apply security updates promptly, testing on staging where possible
- Confirm backups ran successfully
- Check uptime monitoring and any security alerts
- Moderate comments and clear spam
- Test the main contact form
Monthly tasks
- Apply remaining plugin and theme updates after testing
- Review installed plugins; remove anything unused
- Check page speed and Core Web Vitals on key pages
- Check for broken links with a broken link checker
- Review Search Console for errors and drops in performance
- Review user accounts; remove people who no longer need access
- Optimise the database (revisions, transients, spam)
Quarterly tasks
- Test restoring a backup to a staging site
- Review security settings: two-factor authentication, user roles, firewall
- Update outdated content, prices and team details
- Review top pages for SEO improvements
- Check that forms, checkout and integrations still work end to end
- Review hosting performance and resource usage
Yearly tasks
- Renew domain, hosting and premium plugin licences (or confirm auto-renewal)
- Review the theme: is it still supported and fast?
- Accessibility review against WCAG 2.2
- Review privacy policy, cookie banner and legal pages
- Review the site against business goals; plan improvements or a redesign
Maintenance at a glance
| Area | Weekly | Monthly | Quarterly | Yearly |
|---|---|---|---|---|
| Updates | Security updates | Plugins and themes | Theme review | |
| Backups | Check they ran | Test restore | ||
| Security | Alerts | User review | Settings review | |
| Speed | Core Web Vitals | Hosting review | ||
| SEO | Search Console, links | Content review | Goals review | |
| Content | Comments | Update outdated pages | ||
| Legal and access | Accessibility, privacy |
Updating WordPress safely
- Back up the database and files first
- Update on staging and check key pages and forms
- Update one major plugin at a time so problems are easy to trace
- Check the live site after updating
- Roll back from backup if something breaks
Our guide to how often you should update your website covers the wider routine.
Keep plugins under control
| Do | Don't |
|---|---|
| Use well-maintained plugins from reputable developers | Install plugins for tiny tweaks a theme setting could handle |
| Remove plugins you don't use | Leave deactivated plugins installed |
| Check update history and reviews before installing | Use "nulled" (pirated) premium plugins |
| Prefer one good plugin over several overlapping ones | Run multiple plugins that do the same job |
Speed checks
- Optimise images and serve modern formats
- Use caching and a CDN
- Limit heavy page builders and sliders
- Keep the database tidy
Our guide to Core Web Vitals explains which metrics matter.
Security essentials
- Two-factor authentication for every admin
- No "admin" username
- Strong, unique passwords
- Limited login attempts
- A firewall at the host or via a security plugin
- Regular off-site backups; see our website backup strategy
Recommended tools for each task
| Task | Typical tools |
|---|---|
| Backups | Host backups plus a backup plugin or managed service storing copies off-site |
| Security | Host firewall or a reputable security plugin; two-factor authentication |
| Uptime monitoring | An external uptime monitoring service |
| Speed | Caching (host-level or plugin), image optimisation, a CDN |
| Broken links | A link checker, run monthly |
| SEO | An SEO plugin plus Google Search Console |
| Staging | Host staging environments for testing updates |
Fewer, well-chosen tools are better than many overlapping plugins.
When to stop maintaining and rebuild
Maintenance keeps a good site healthy, but sometimes a rebuild is the better investment. Signs it may be time:
- The theme is no longer supported or updated
- The site depends on abandoned plugins
- Core Web Vitals stay poor despite optimisation
- Simple changes regularly break layouts
- The design no longer reflects your business
- You've outgrown WordPress for what you need
Our guide to 12 signs your website needs a redesign can help you decide.
How we help
Our WordPress development team builds lean WordPress sites, and our updates and security patching and website maintenance and support plans take this whole checklist off your hands.
The short version
Check updates, backups, security alerts and forms weekly; update plugins, review speed, links and users monthly; test restores and review content and security quarterly; renew licences and review accessibility, legal pages and goals yearly. Always back up and test before updating.
