Most WordPress disasters start small: a plugin nobody updated, a backup that never ran, a spam account nobody noticed. A short routine catches these before they turn into a hacked site or a broken checkout. Here is the checklist we use, split into what to do every week, every month and every quarter.
Every week
Check that backups ran
Open your backup tool and confirm the latest backup finished and includes both files and database. Keep copies somewhere other than the server the site runs on. A backup on the same server disappears with it.
Look at uptime and errors
Check your uptime monitor for outages, and skim the PHP error log for new fatal errors. A plugin throwing errors every few minutes is a white screen waiting to happen.
Test the money path
On a store, place a test order or at least walk through cart and checkout. Submit your contact form. Confirm the emails arrive. These break silently and cost real money.
Every month
Update WordPress, plugins and themes
- Read the changelog of big updates, especially WooCommerce and payment gateways.
- Update on a staging copy first when the site makes money.
- Take a backup right before updating the live site.
- After updating, check the home page, a product page, cart, checkout and the dashboard.
Review users and logins
Go to Users and sort by registration date. Remove accounts you do not recognise, and make sure only people who need it have the Administrator role. A sudden jump in new accounts is often the first sign of spam or a break in. We recently cleaned up a site that had collected more than 1,400 bot accounts in a year, alongside thousands of spam posts published through a compromised login.
Run a security check
- Scan for malware with your security plugin or host tool.
- Verify WordPress core files. With WP-CLI:
wp core verify-checksums. - Look for PHP files in
wp-content/uploads. There should be none. - Check for posts or pages you did not write.
Check speed
Test the home page and a product page in PageSpeed Insights and watch the Core Web Vitals report in Google Search Console. A page that suddenly got slower usually points to a new plugin, a large image or a script added to the header.
Look at Search Console
Check the Pages report for new errors, the Security and Manual actions section, and whether your sitemap is still read. Spam pages showing up in search results are a clear warning sign.
Clean up the database
Delete spam comments, old post revisions and expired transients. On stores, check the size of the WooCommerce logs and sessions. A lean database keeps the dashboard fast.
Every quarter
Test a restore
A backup you have never restored is a hope, not a backup. Restore the latest one to a staging site and check that the site works.
Review your plugins
Remove plugins you no longer use. Replace plugins that have not been updated in a year or that do not support your WordPress and WooCommerce versions. Fewer plugins means fewer things to break and fewer doors for attackers.
Check PHP and the server
Make sure the site runs a PHP version that still gets security updates, and that the SSL certificate renews on its own. Check disk space: a full disk stops backups and uploads.
Fix broken links and content
Run a broken link check, update old prices and policies, and make sure legal pages such as Terms and Privacy Policy are published and linked in the footer.
The checklist at a glance
| When | Task |
|---|---|
| Weekly | Backups ran, uptime and error log, test checkout and forms |
| Monthly | Updates with a backup first, users and admins, security scan, speed, Search Console, database clean up |
| Quarterly | Test a restore, review plugins, PHP version, SSL and disk space, broken links and legal pages |
Rather not do this yourself?
Our WordPress maintenance plans cover this checklist for you: updates, daily backups, security monitoring, speed and SEO checks and a monthly report. Premium includes 8 development hours a month for fixes and improvements, and every plan comes with support from developers.
Frequently asked questions
Can I turn on automatic updates instead?
For small sites with few plugins, automatic minor updates are fine. For stores, update WooCommerce, payment gateways and the theme by hand after checking them, so a broken update never takes checkout down without you noticing.
How long does monthly maintenance take?
For a typical small business site, one to two hours a month once the routine is set up. Stores with many plugins take longer, mostly for testing after updates.
What is the most important step?
Working backups stored off the server. With them, every other problem can be undone.
