WordPress maintenance checklist
Last updated
WordPress sites need regular care. Plugins and themes release updates every week, backups need checking, and problems tend to build quietly until a client notices. This checklist sets out what to do and how often, for one site or a hundred.
Adjust the timings to the site. A shop taking orders every hour needs more frequent backups and closer monitoring than a brochure site that changes once a month, but the list of jobs is the same.
Before you start: set a baseline
Do these once for each site, so the regular checks have something to compare against:
- Record the host, PHP version, WordPress version, theme and every plugin with its version.
- Take a full backup and restore it somewhere safe, such as a staging copy, to prove it works.
- Note the site’s normal page speed and Core Web Vitals.
- List the pages that matter most: the home page, contact form, checkout, login.
- Make sure every administrator has their own account and two-factor authentication.
- Agree who gets alerts, and how quickly someone should respond.
Daily
Daily jobs should be automatic. You should only spend time on them when something fails.
- Check the site is up, every few minutes rather than once a day, and confirm failures before alerting.
- Run a backup (more often for shops and busy sites) and check that it finished.
- Scan for security problems: known vulnerable plugin versions, changed core files, new administrator accounts and repeated failed logins.
- Apply security releases for WordPress, plugins and themes, with a backup first.
Weekly
- Apply ordinary plugin and theme updates. Take a snapshot first, check the site afterwards, and roll back anything that broke.
- Read the changelogs of major updates (page builders, WooCommerce, membership plugins) and test those on staging before production.
- Check the PHP error log for new warnings and fatal errors.
- Test the pages that matter: submit the contact form, add something to the basket, log in.
- Review comments and form submissions for spam, and clear it out.
Monthly
- Restore a recent backup onto staging for at least one site, to prove backups still work.
- Review page speed and Core Web Vitals against the baseline, and investigate anything that got worse.
- Remove plugins and themes that are deactivated and not coming back.
- Clean the database: old post revisions, expired transients, spam and trashed comments.
- Check broken links and redirects on the main pages.
- Review user accounts and remove anyone who no longer needs access.
- Send the client a report: updates applied, backups taken, uptime, security findings and anything fixed.
Quarterly
- Check the PHP version against what your host offers and what your plugins support, and plan an upgrade on staging if you are behind.
- Review plugins that have not been updated by their authors for a long time, and plan replacements.
- Check premium plugin and theme licences, so updates keep arriving.
- Review scheduled tasks (WP-Cron) for jobs that are stuck or failing.
- Test a full restore of the whole site, not just a file or table.
- Check that the site’s privacy policy and cookie notices still match the plugins and tracking it uses.
Yearly
- Check domain and SSL certificate renewal dates, and who owns the domain account.
- Review the hosting plan against the site’s traffic and storage.
- Audit the theme: is it still maintained, and is any custom code outside a child theme?
- Review the care plan with the client: what broke this year, what took the most time, and whether the plan still fits.
After every change, and when something breaks
Some checks are triggered by events rather than the calendar. After any update, deploy or settings change:
- Load the home page and the pages that matter, logged out and logged in.
- Check the PHP error log for new errors.
- If anything is worse, roll back first, then investigate on staging.
When a site breaks without an obvious cause, work through it in order: confirm the scope, check what changed recently, read the error log, and only then start deactivating plugins, on staging if you can. Write down what you found and what you changed.
One-off hardening
These are not regular jobs, but every site should have them done once and checked whenever the site changes hands:
- Turn off the built-in theme and plugin file editor, so a stolen administrator login cannot edit PHP from the dashboard.
- Turn off XML-RPC unless something the site relies on needs it.
- Limit login attempts and consider moving the login page away from the default address.
- Add security headers, such as X-Frame-Options and X-Content-Type-Options.
- Make sure the site loads over HTTPS everywhere, with no mixed content.
- Hide PHP errors from visitors while still logging them for you.
MaintainHQ’s connector can apply most of these from the dashboard, and Gus can propose them as fixes for your approval. See performance and security.
Extra checks for shops and busy sites
A WooCommerce shop, a membership site or anything that takes bookings changes every hour, so the cost of a bad update or a lost backup is higher. Add these to the lists above:
- Back up more often, hourly if orders arrive through the day, and keep the copies off the server.
- Make sure a restore will not wipe orders, bookings or form entries taken since the backup. Prefer restoring single tables or folders over rolling back the whole site.
- Test the full checkout, including payment in test mode, after every update to WooCommerce, the theme or a payment plugin.
- Check the Action Scheduler queue for failed or stuck jobs, which can quietly stop emails and subscription renewals.
- Watch page speed on the basket and checkout pages, not only the home page.
Keep a maintenance log
Write down what was done on each site and when: updates applied, backups restored, problems found and how they were fixed. A log turns a vague memory of “something like this happened before” into a quick answer, shows the client what their care plan paid for, and gives the next person on the site the history they need.
If you run maintenance through a tool, the log is usually built for you. In MaintainHQ every update, backup and Gus action is recorded against the site, and Gus fixes come with a receipt you can share with the client.
What to automate
Most of this checklist is repetitive, which makes it a good fit for a tool. The table shows which jobs MaintainHQ runs for you; plan details are on the pricing page.
| Job | How often | In MaintainHQ |
|---|---|---|
| Uptime checks | Every few minutes | Every 5 minutes, confirmed after 2 failed checks, with an incident opened |
| Backups | Daily or more | Hourly, daily, weekly or monthly, with retention you control |
| Security checks | Daily | Daily checks on every paid plan; malware scanning and vulnerability alerts on Pro and Agency |
| Updates | Weekly, security at once | Snapshot, update, check and automatic rollback |
| Testing risky updates | Before major updates | Pre-update tests on a linked staging site |
| Test restores | Monthly | Verified backups, and restores onto another connected site |
| Database clean-up | Monthly | Database clean-up action |
| Client reports | Monthly | Scheduled reports by email and PDF on Pro and Agency |
| Fixing what broke | As needed | Gus finds the cause and prepares a fix for your approval |
What a tool cannot do for you: decide what the client pays for, review whether a plugin is still the right choice, and talk to the client. Those stay on your list.
Running the checklist with MaintainHQ
MaintainHQ connects to each WordPress site with a plugin, on any host, and runs the daily and weekly jobs above on a schedule. When something breaks, Gus, the AI WordPress engineer, reads the logs, finds the cause and prepares a fix. Nothing changes until you approve it, and every fix gets a backup, a check afterwards and automatic rollback.
Plans start at $2.99 a month for 1 site, with a 7-day trial. See all features, how safe updates work, or compare MaintainHQ with other maintenance tools.