Maintenance

WordPress maintenance checklist: weekly, monthly, and yearly tasks

By Alwin Kansakar · 30 October 2026

A WordPress site isn’t finished when it launches. Plugins release updates, security issues are found, content grows, and small problems pile up until something breaks, usually at the worst possible moment. This is the maintenance checklist I use, grouped by how often each task should happen.

Before anything else: backups

Every other task on this list is safer with good backups. A backup only counts if it is:

• Automatic: daily for busy sites and online stores, at least weekly for brochure sites.
• Off-site: stored somewhere other than the same server as the website.
• Complete: both the database and the files, especially the uploads folder.
• Tested: you’ve actually restored one, at least once, to a test site.

Weekly

• Check that the latest backups completed successfully.
• Review available updates for WordPress core, themes, and plugins. Apply security updates promptly.
• Test important forms, such as contact, enquiry, and checkout, to make sure they still send.
• Check your uptime monitor for any downtime alerts.
• For online stores, place a test order or check that recent orders are processing normally.

Monthly

• Apply routine updates, on a staging site first for anything major, then on the live site.
• Run the main pages through PageSpeed Insights and compare with last month. See my speed optimization checklist if anything has slipped.
• Check Google Search Console for crawl errors, pages dropping out of the index, and security warnings.
• Scan for broken links and fix or redirect them.
• Clear spam comments and old form entries you don’t need to keep.

Quarterly

• Review user accounts. Remove people who no longer need access, and check nobody has a higher role than they need.
• Review plugins. Remove anything unused, and replace plugins that are no longer maintained.
• Clean the database: old revisions, expired transients, and leftover data from removed plugins. Back up first.
• Do a test restore of a backup to confirm it actually works.
• Check that two-factor authentication is still enabled for every administrator.

Yearly

• Check the PHP version on your hosting and upgrade if it is close to end of life.
• Renew the domain, and make sure it’s registered in your name with auto-renew turned on.
• Renew premium theme and plugin licences so you keep receiving updates.
• Review hosting performance and cost. Has the site outgrown its plan?
• Review the privacy policy, cookie notice, and legal pages.
• Audit content: update outdated pages, and remove or redirect pages that no longer serve a purpose.

Security habits that prevent most problems

• Use strong, unique passwords and two-factor authentication for every admin account.
• Never install nulled (pirated) themes or plugins. They’re one of the most common sources of malware.
• Keep the number of administrators as small as possible.
• Make sure the site runs on HTTPS everywhere.
• Delete themes and plugins you’re not using rather than just deactivating them.

Do it yourself, or hand it off?

Weekly and monthly checks take less than an hour once you have a routine, and many site owners handle them in-house. If your site makes money, though, or you’d rather not deal with failed updates and security issues yourself, a maintenance plan with a developer is usually cheaper than fixing a broken or hacked site. See typical maintenance costs in Nepal.