Why maintenance matters more than it seems
A WordPress site isn’t one piece of software. It’s WordPress core, a theme, and usually somewhere between ten and forty plugins, each written and updated by different people, all running on a server with its own software versions. Every one of those parts changes over time: security fixes, compatibility changes, new features, and occasionally abandonment.
Left alone, a site doesn’t stay the same. It slowly falls behind. Known vulnerabilities accumulate, the PHP version your host supports moves on, a plugin is abandoned by its developer, and one day an update you can no longer avoid breaks something, or an automated attack finds the hole that was patched months ago.
Maintenance is the routine that keeps the gap small. This checklist is organised by frequency. A small brochure site can follow it lightly; a busy WooCommerce store should follow it closely.
Before you start: three things to have in place
- A staging site. A private copy of your site where updates can be tested. Many hosts provide one-click staging; if yours doesn’t, it can be set up separately.
- Off-site backups. Automatic backups of files and database, stored somewhere other than your web server, kept for at least 30 days.
- An uptime monitor. A free or paid service that checks your site every few minutes and emails you if it goes down.
Without these, every other step is riskier. With them, a bad update becomes a five-minute rollback instead of an emergency.
Weekly checks
- Check backups ran. Look for the latest backup’s date and size. A backup that’s suddenly much smaller than usual is a warning sign.
- Review available updates. Note security releases especially; those shouldn’t wait for the monthly routine.
- Glance at uptime alerts and your host’s resource usage for anything unusual.
- Submit a test through your main contact form and confirm the email arrives. Forms fail silently more often than anything else on a website.
- For stores: check that recent orders are coming in normally and order emails are sending.
Monthly checks
The update routine
This is the core of maintenance, and the order matters:
- Back up the live site.
- Copy the live site to staging (or refresh staging from live).
- Apply updates on staging: plugins, theme, then WordPress core. If there are many, apply them in small groups so you know which one caused a problem.
- Test on staging: home page, a few key pages on mobile and desktop, forms, search, login, and for stores, add to cart and checkout with a test order.
- Apply the same updates to live at a quiet time, then repeat a quick check.
- Write down what was updated and anything you held back, and why.
Other monthly checks
- Remove unused plugins and themes completely, not just deactivate them. Inactive code can still be exploited.
- Review administrator accounts. Remove anyone who no longer needs access; make sure every admin has two-factor authentication.
- Run a security scan and review anything flagged.
- Check Search Console for new indexing errors, security issues or manual actions.
- Check SSL certificate expiry and domain renewal dates.
- Look at site speed for your key pages and note anything that’s got noticeably worse.
Our maintenance plans cover this checklist every month, with tested updates and a plain-English report.
Quarterly checks
- Test a backup restore to staging. It’s the only way to know a backup actually works.
- Check your PHP version against what WordPress recommends and what your host supports. Plan upgrades before hosts force them.
- Review plugins for abandonment: any plugin not updated by its developer for a year or more, or with unresolved security reports, should be replaced.
- Clean the database: old post revisions, spam comments, expired transients, and tables left behind by removed plugins. Back up first.
- Check broken links on key pages and fix or redirect them.
- Review forms and integrations: CRM connections, email marketing sign-ups, booking tools.
- Review Core Web Vitals in Search Console for each page group.
Yearly checks
- Access audit: list every account the site depends on (registrar, DNS, hosting, email, Search Console, analytics, premium plugin licences) and confirm they’re in the business’s name with current recovery details.
- Renew premium licences before they lapse, as expired licences stop receiving security updates.
- Review content: outdated pages, old prices, team members who’ve left, services you no longer offer.
- Review your privacy policy and cookie setup against what the site actually does now.
- Check hosting fit: is the plan still right for your traffic and needs?
- Review accessibility basics: contrast, keyboard navigation, alt text, form labels.
The checklist at a glance
| Frequency | Task | Why it matters |
|---|---|---|
| Weekly | Confirm backups ran | A backup that silently stopped is worse than none: you think you’re safe |
| Weekly | Test the main contact form | Forms fail quietly; lost enquiries are invisible |
| Monthly | Update on staging, test, then deploy | Security fixes without broken layouts |
| Monthly | Remove unused plugins and stale admins | Less to attack, fewer ways in |
| Monthly | Check Search Console | Early warning for indexing and security problems |
| Quarterly | Test-restore a backup | Proves you can recover |
| Quarterly | Check PHP version and abandoned plugins | Avoid forced, rushed upgrades |
| Yearly | Access and ownership audit | Never lose the domain or hosting to a departed contractor |
Should you turn on automatic updates?
WordPress can update core, plugins and themes automatically. For minor WordPress core releases (security and maintenance releases), automatic updates are on by default and generally safe. For plugins and themes, automatic updates are a trade-off: you get security fixes fast, but nobody checks whether an update broke something.
A sensible middle ground for many small sites: automatic updates for well-maintained plugins with a strong track record, manual tested updates for anything business-critical (page builders, WooCommerce and its extensions, membership and booking plugins), and daily backups either way. For stores, test-first updates are worth the effort.
When to get help
You can absolutely maintain a WordPress site yourself if you have the time and follow a routine. It’s worth getting help if any of these apply: you don’t have staging or tested backups; updates keep breaking things; you run a store where downtime costs real money; nobody on the team has time to do this monthly; or the site is on outdated software that needs careful catching up.
Official references: WordPress’s guides on updating WordPress and hardening.
Frequently asked questions
How often should I update WordPress plugins?
Check weekly and apply security updates promptly; other updates can be grouped into a monthly, tested routine. Always back up first.
Do I really need a staging site?
For anything beyond a very simple site, yes. It’s the only way to test updates without customers seeing problems first.
How long should I keep backups?
At least 30 days, longer for stores and busy sites. Infections are often discovered weeks after they start, so short retention can leave you with no clean copy.
What's the most commonly skipped maintenance task?
Testing a backup restore. Many owners discover their backups are incomplete only when they need them.
About this guide
We build, repair, move and maintain WordPress and WooCommerce websites for businesses in the UAE, US, UK and Canada. This guide reflects how we approach the problem in client work, checked against the official documentation linked in the text. Published 16 October 2026.
Found an error or something out of date? Tell us and we’ll correct it.
