The Monthly WordPress Maintenance Checklist I Use for Small Business Sites

Most WordPress sites don't break in one dramatic moment. They decay quietly: a plugin stops getting updates, the cache stops working after an update, someone uploads a 6 MB photo, the contact form silently stops sending email. Nobody notices until a customer says "I sent you a message last week".

I'm a freelance WordPress and Flutter developer in Famagusta, North Cyprus, and besides building sites I look after existing ones. This is the routine I actually use. It's boring on purpose: boring maintenance is what keeps sites from becoming emergencies.

Before touching anything: a backup you can restore

• Full backup of files and database, stored outside the site's public folder.
• On some shared hosts wp db export fails because proc_open is disabled. mysqldump with the credentials from wp config get works instead.
• Once in a while, actually restore a backup to a staging copy. A backup you've never restored is a hope, not a backup.

Updates, one group at a time

• Core, theme and plugins, but not all blindly at once on a site that matters. Update, then check, then continue.
• After updating, check the pages that make money: home, the main service page, the contact form, checkout if there is one.
• Watch for side effects of cache plugins. On one site, a plugin action triggered a full cache purge, and the optimised CSS files briefly returned 404s, so the site loaded unstyled until the cache was rebuilt. Now I check that every CSS and JS file on key pages returns 200 after any update.

Security basics that catch most problems

• Hidden login URL, two-factor authentication for every admin, limited login attempts.
• No public readme.html, no xmlrpc.php if nothing uses it, no user enumeration through ?author=1 or /wp-json/wp/v2/users.
• Remove the WordPress version from the page source, including the ?ver= on core assets. It doesn't make the site invisible, but it stops making it easy for bots to match the site to a known vulnerable version.
• Review admin users and installed plugins. Every plugin is code you're trusting.

Speed that doesn't slide back

• Run PageSpeed on the home page and one inner page, and take the median of several runs, because single runs vary a lot.
• Look for new full-size images, new third-party scripts and cache misses.
• On a four-language real estate site I work on, a colleague and I raised the median mobile PageSpeed score from 51 to 75 and desktop from 81 to 97 without changing the design. Monthly checks are what keep those numbers from drifting down.

Forms, links and search visibility

• Send a real test message through every form and confirm it arrives. Email deliverability breaks more often than people think.
• Check Google Search Console for new indexing problems, 404s and manual actions.
• Make sure the sitemap still lists the right pages and nothing important is accidentally noindex.

Content: the part clients forget

Maintenance isn't only technical. Old prices, last year's opening hours and a "new" offer from two seasons ago hurt trust as much as a slow page. A short monthly content check with the client is often the most valuable part of the routine.

When the client also has an app

When a Flutter app reads its content from the same WordPress site through the REST API, one routine covers both: if a WordPress update changes an endpoint or a field, it gets caught before users of the app notice.

I wrote the client-facing version of this, explaining what maintenance includes and when a business needs a monthly plan, here: WordPress Maintenance in North Cyprus.

What's on your maintenance checklist that isn't on mine?