The website maintenance checklist we run on client sites

A WordPress site needs something done every day, every week, every month, every quarter and every year. The daily jobs should be automatic. The weekly ones are updates. The rest are checks most owners never get to.

This is the schedule we run on more than 100 sites on our care plans, written so you can run it yourself.

What should run every day?

Backups, uptime monitoring and security scanning. None of them should need you.

• An off-site backup. A copy stored on the same server as the site disappears with it. Ours go to storage away from the server every day.
• Uptime monitoring. A free service will email you when the site stops responding. Without one, you hear about it from a client.
• Security alerts. A security plugin such as Wordfence or Solid Security scans the site and emails you. Someone has to read those emails.

Your part is checking that all three are still running. A backup job that stopped in March looks exactly like one that didn’t, until you need it.

What needs doing every week?

Updates. WordPress core, the theme and every plugin.

Most of the urgent work we do now is security fixes. AI tools are finding and exploiting plugin vulnerabilities faster than before, so security updates arrive every day. Patchstack counted 11,334 new vulnerabilities in WordPress plugins and themes in 2025, 91% of them in plugins. Almost half had no fix when they were made public, and the most heavily targeted were being attacked at scale within a median of five hours (State of WordPress Security in 2026, February 2026). A site updated once a quarter spends most of that quarter exposed.

Run updates on a staging copy first. A staging copy is a private duplicate of the site. If an update breaks it, the live site carries on. A copy needs setting up before it’s safe: it mustn’t sync back to live, it needs its plugin licences, and anything that sends emails or takes payments is switched off.

After updating, click through the key pages and send a test through each form. Forms break quietly, and you only find out when someone mentions they never got a reply.

Sometimes an update isn’t enough. If a plugin has a known flaw and no fix yet, it comes off until there is one.

What should you check every month?

• Plugins you don’t use. Delete them, don’t just deactivate them. Every plugin is code someone can attack.
• Premium licences. A premium plugin with a lapsed licence stops getting security fixes. It keeps working, so nobody notices.
• Users. Remove former staff, former agencies and one-off freelancers. Every person gets their own login, with two-factor turned on.
• PHP version. Your host’s control panel shows it. If it’s out of support, ask the host to move you. Many cheap cPanel hosts won’t do it unless you ask.
• Speed. Run the home page and your busiest page through PageSpeed Insights. Note the score so you can compare next month.
• Search Console. Check for new errors and pages that have dropped out of the index.

What should you do every quarter?

Restore a backup. This is the check almost nobody does.

We restore one for every site we look after, every quarter, to a staging copy. None of those test restores has failed. The point is knowing how long it takes. A 12GB site comes back far faster than a 50GB one, and you want to know that before the day it matters.

Then review admin access again, and look at the analytics. Which pages bring enquiries, and which forms do people actually use? That tells you where next year’s effort should go.

What belongs on the yearly list?

• A review of the whole site. Old staff profiles, expired offers, dead links, a privacy policy that no longer matches the forms you run.
• Renewals. The domain, any premium plugins outside a plan, and the SSL certificate if your host doesn’t renew it automatically.
• Hosting. Is the server software up to date? Are backups really happening? A cheap host often runs a little behind and expects you to manage all of it.
• Documentation. Write down what the site runs on, who hosts it, who holds the domain, and who to call. Keep it somewhere that isn’t your email.

That last item gets skipped more than any other.

What we find when nobody followed the checklist

This year we took on a site where auto-updates were off on 52 of its 54 plugins, and a caching plugin was holding pages for 180 days, so the owner’s edits never appeared. Nobody owned the work, so it didn’t happen.

The maintenance cost guide has more of what we find on neglected sites, and the order we fix it in.

How long does it take?

About an hour a week for a typical business site, plus a longer session each quarter for the test restore. A shop or a site with a member area takes more.

If that hour isn’t there, the checklist still tells you what to ask whoever looks after the site. Our care plans run this schedule, with weekly updates from $297 a month (monthly on the $147 plan). If the site’s already behind, a $697 health check finds what needs catching up first.

Questions about website maintenance

Can I just turn on auto-updates?

For minor WordPress releases, yes. For plugins, only if something checks the site afterwards. An auto-update that breaks a form on a Friday night stays broken until someone notices.