WordPress Maintenance Checklist (2026): Weekly to Yearly

Originally published at Sites You Own.

WordPress powers a huge share of the web, and that popularity is exactly why it needs regular care: plugins update constantly, and outdated sites are the main target of automated attacks. The bots doing the attacking don't take weekends off, and they don't care that you're "a small business, who'd bother?"

A WordPress site is less like a printed brochure and more like a car. Nobody expects a car to run for five years without an oil change, yet plenty of websites are quietly running plugins that were last updated around the time you bought the phone you've since replaced twice. This checklist is what a professional care plan covers. Use it to look after your own site, or to check what your developer actually does.

Before anything else: make sure you have a working, off-site backup and know how to restore it. Every other task is safer with one.

The Maintenance Calendar

Weekly (15 min)	Monthly (1 hour)	Quarterly	Yearly
Check backups ran	Speed test	Test a full restore	Domain and SSL auto-renew
Update plugins and themes	Search Console check	Check PHP version	Review licenses
Security updates on	Delete unused plugins	Update prices, hours, offers	Refresh top pages
Test the contact form	Review admin users	Review GA4 conversions	Accessibility check
Scan for malware	Uptime reports, clean the database, fix broken links		Refresh or redesign?

Little and often beats 23 updates at 11pm on a Friday.

Weekly Tasks (15 Minutes)

• Check backups ran. Daily automated backups stored off the server (e.g. cloud storage), kept for at least 30 days.
• Update plugins and themes. Update on a staging copy first if your host offers one, or one at a time on live, checking the site after each. Not all 23 at once at 11pm on a Friday. Ask anyone who has.
• Apply WordPress minor (security) updates. These are usually automatic. Make sure they are.
• Test your contact form. Send a test inquiry. Broken forms are the most common silent failure, and "silent" is the scary part: the site looks fine, the phone just mysteriously stops ringing.
• Scan for malware. Use a security plugin or your host's scanner.

Monthly Tasks (1 Hour)

• Run a speed test (PageSpeed Insights) on the homepage and your top page. Watch LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1.
• Review Search Console: coverage errors, manual actions, security issues and Core Web Vitals.
• Remove unused plugins and themes. Deactivated isn't enough. Delete them. That slideshow plugin from 2021 is not coming back into fashion.
• Review admin users. Remove old accounts, check roles, enforce strong passwords and 2FA. If "intern2019" still has admin rights, today's the day.
• Check uptime reports and fix recurring downtime (often a hosting problem).
• Clean the database: spam comments, post revisions, expired transients.
• Fix broken links and 404s reported in Search Console.

Quarterly Tasks

• Test a full restore from backup on a staging site. A backup you've never restored is a hope, not a plan.
• Check PHP version with your host and upgrade to a supported version.
• Update key content: prices, opening hours, team, offers and service areas. Customers notice when the "new" offer expired two summers ago.
• Review conversions in GA4: which pages bring inquiries, and which don't.

Yearly Tasks

• Renew the domain (turn on auto-renew) and check the SSL certificate is auto-renewing.
• Review licenses for premium plugins and themes.
• Refresh your top pages and cost/pricing content with the current year's information.
• Do an accessibility check: color contrast, focus states, form labels and alt text.
• Decide whether the site needs a refresh or a redesign.

Month 6: 27 Updates Available. "It's Working Fine, Why Touch It?"

The Diary of a Website Nobody Updated

Entirely fictional. Any resemblance to your site is, hopefully, a coincidence.

• Month 1: "3 updates available." Owner: "Later."
• Month 6: "27 updates available." Owner: "It's working fine, why touch it?"
• Month 11: the contact form starts sending inquiries into the void. Nobody notices, because there are no inquiries to notice.
• Month 15: a stranger's pharmacy links appear in Google under the business name.
• Month 15, one hour later: "But nobody touched it!" Exactly.

Signs Something Is Already Wrong

• Visitors are redirected to spam sites, or Google shows "This site may be hacked".
• Your host suspends the account or sends malware warnings.
• New admin users you didn't create.
• A sudden drop in traffic or a spike in strange pages indexed in Google.

Month 15: Nobody Touched It. Exactly.

If you see any of these, act quickly, and resist the urge to just "turn it off and on again": see WordPress malware removal.

DIY or Care Plan?

If you're comfortable with the tasks above and will actually do them every week, DIY is fine. Be honest about the "actually" part. Most business owners would rather spend that time on their business. That's what WordPress care plans are for: from $29/month for updates, daily backups, monitoring and a monthly report, with higher plans adding edits and priority fixes. If your site is slow as well as unmaintained, start with speed optimization.

DIY or care plan? A two-question honesty test:

1. Are you comfortable doing the tasks above? If no, get a care plan.
2. Will you actually do them every week? (Be honest.) If no, get a care plan. If yes, DIY is fine. See you next week. And the next.

DIY or Care Plan? Be Honest About the “Actually” Part.

Frequently Asked Questions

How Often Should WordPress Be Updated?

Check weekly. Security releases should be applied within days; plugin updates weekly after a quick test.

Can Updates Break My Site?

Occasionally, usually from plugin conflicts. That's why you update with a fresh backup, ideally on staging first. Not updating breaks sites too; it just takes longer and ends worse.

How Much Does WordPress Maintenance Cost?

Typically $29–$150 per month depending on what's included. See small business website costs for the full picture.

Your Turn

Which task on this list do you skip most often? (Mine used to be the test restore. Never again.) Tell me in the comments. 👇

Want more like this? Read the original post, or request a free video audit of your current site and I'll tell you honestly what it needs (and what it doesn't).