Your website runs quietly until the morning it doesn’t. A plugin update breaks the contact form, or a warning screen replaces your home page, and leads stop without a sound. This website maintenance checklist stops most of those mornings before they start. It sorts every job by how often it needs doing, from a quick daily glance to a quarterly review.
Last updated 14 September 2026. Checked against WordPress.org documentation, Google’s guidance and Patchstack’s 2026 security report.
Quick answer
Every week: check the backup ran, update WordPress, plugins and themes, then test your main form.
Every month: check speed and broken links, clean the database and delete unused plugins. That is the core of a monthly WordPress maintenance checklist.
Every quarter: test a full restore, check your PHP version and review admin users. No time for these WordPress maintenance tasks? Book a free call.
Why a website maintenance checklist matters
91%
WordPress plugins: share of new WordPress security flaws found in plugins in 2025
5 hours
Most-attacked WordPress flaws: weighted median time to the first attack
3–5
WordPress backups: recent copies WordPress.org says to keep, in different places
8.3
PHP on your server: the version or newer that WordPress recommends
2.5 s
Google: the most time your main content should take to load
What website maintenance means
What a WordPress website maintenance checklist covers
Website maintenance is the routine work that keeps a live site safe, fast and working after launch. On WordPress, it comes down to four kinds of job: backups, updates, security checks and clean-up. A website maintenance checklist puts each job on a schedule, so nothing waits until it breaks.
Every website maintenance checklist starts with the three parts of your site that get updates: the WordPress core, your theme and your plugins. Each one comes from a different team on its own timetable. Your server adds one more part, PHP, the programming language WordPress runs on.
Skip the routine and problems pile up where you can’t see them: an old plugin with a known hole, a backup that stopped months ago, a form that no longer sends leads. The WordPress website maintenance checklist below catches each of those while it is still a small job.
Website maintenance checklist schedule
What to check daily, weekly, monthly and every quarter
Copy this website maintenance checklist table into your calendar. Each row shows how often a job needs doing and whether you can set it to run by itself.
WordPress maintenance tasks by schedule, checked against WordPress.org guidance, September 2026
How often
The tasks
Why it matters
Can it run by itself?
Every day
Read uptime and security alert emails; confirm order and form emails still arrive
You hear about a problem before a customer does
Yes, an uptime monitor emails you
Every week
Check the backup ran; update WordPress, plugins and themes; test your main form; clear spam
Attackers move within hours of a flaw going public
Partly: backups and updates can run alone, testing can't
Every month
Speed check; broken links and 404 errors; database clean-up; delete unused plugins and themes; Site Health review
Slow pages and dead links cost visits and trust
Partly: tools report, you decide
Every quarter
Test a full restore; check the PHP version; review admin users and passwords; retest forms and checkout on a phone
A backup you never restored is only a guess
No
Once a year
Renew the domain and hosting; confirm SSL renews; update privacy and legal pages; refresh your busiest pages
An expired domain can take the whole site offline
Partly: turn on auto-renew
WordPress.org suggests weekly backups for smaller sites and daily backups for busy ones.
Before your first check
Set up five safety nets once, and every check gets faster
Maintenance should feel like a routine. These five settings take one sitting, and from then on they do most of the watching your website maintenance checklist needs.
1
Turn on automatic backups
Back up both parts WordPress needs, the files and the database, and keep a copy away from your hosting server. Our WordPress hosting runs daily backups on every plan.
2
Add an uptime monitor
A monitor checks your home page around the clock and emails you the moment it goes down.
3
Choose which updates run by themselves
Since WordPress 5.5, you can switch on auto-updates plugin by plugin and theme by theme, from the Plugins and Themes screens.
4
Get a staging site
A staging site is a private copy of your site where you test updates before real visitors see them. Ask your host whether your plan includes one.
5
Keep one login list
Note who can reach your hosting, domain, WordPress and each paid plugin, and store it in a password manager.
Every day and every week
Daily and weekly WordPress maintenance tasks that catch problems early
Once your safety nets run, the weekly half of your website maintenance checklist takes a few clicks. Do them in the same order each time, because the order keeps one bad update from costing you a day.
Every day
- Read any uptime or security alert the day it arrives.
- Run a store or take leads? Confirm new order and form emails still reach your inbox.
Every week
- Check that the latest backup finished, with a copy off the server.
- Update plugins, themes and WordPress, using the steps below.
- Send a test message through your main contact form.
- Run your security plugin's scan and read the result.
- Delete spam comments and any user account you don't recognize.
How to update WordPress safely
1
Back up first
Take a fresh backup of the files and the database. WordPress.org’s own upgrade guide starts with this step.
2
Read what changed
Open each plugin’s changelog, the note that lists what an update changes. A big version jump deserves a test on your staging site first.
3
Update in small groups
Go to Dashboard, then Updates. Update a few items at a time, so you know which one caused any problem.
4
Test the pages that earn money
Load the home page, a service page, the contact form and, on a store, the checkout.
5
Keep it or roll back
All fine? You’re done for the week. Something broke? Restore the backup from step 1, then retest that one update on staging.
This weekly routine sits at the heart of any WordPress maintenance checklist. Skip a few weeks and the updates pile up, and a long pile is much harder to test than a short one.
Pro tip
Keep auto-updates on for small plugins you barely touch. Turn them off for your page builder, your store plugin and anything that handles payments, and update those by hand after a backup.
Rather spend your week on customers than on updates?
Our WordPress care plans take the updates, backups and uptime checks off your list. Talk it through with our team first.
Once a month
Monthly WordPress maintenance checklist: speed, links and clean-up
Once a month, book a quiet slot for the checks no plugin can judge for you. Your monthly WordPress maintenance checklist is where slow pages, dead links and forgotten plugins show up.
Every month
- Test your top pages in PageSpeed Insights, or read the Core Web Vitals report in Search Console.
- Open Search Console's Page indexing report and fix pages marked Not found (404).
- Clear old post revisions, trashed posts and spam from the database with a trusted clean-up plugin.
- Deactivate and delete plugins and themes you no longer use.
- Open Tools, then Site Health, and fix anything listed under Critical issues.
Start with speed, because slow pages lose visitors before they read a word. Google counts a page as good when its main content loads within 2.5 seconds for most visits. Miss that on your top pages? Our guide to improving WordPress site speed starts with images and caching.
Broken links come next on a monthly WordPress maintenance checklist. A visitor who lands on a dead page leaves, and Google keeps coming back to crawl the dead address. Fix each 404 with the right link, or redirect it to the closest live page. For a full technical check, our WordPress SEO team can help.
Then clean up. WordPress.org’s housekeeping guide suggests deleting plugins and themes you don’t use, and each one you delete is one less item on your monthly WordPress maintenance checklist. Need a better plugin for a job? See our list of free and premium WordPress plugins.
Security on your website maintenance checklist
Security checks that close the doors attackers try first
A hacked site can cost you leads, sales and your customers’ trust. Patchstack’s 2026 report found that 91% of new WordPress security flaws in 2025 sat in plugins, so your plugin list deserves the most attention.
Deleting a plugin you don’t use removes that risk for good. The same report found 46% of flaws had no fix ready when they went public, and an update can’t protect you from a hole nobody has patched yet.
On a WordPress website maintenance checklist, security comes down to steady habits: updates within days, a strong unique password and two-factor login for every admin, a weekly scan and as few admin accounts as you can manage. Our WordPress security checklist goes deeper on each one.
Every quarter and once a year
Quarterly and yearly jobs that finish your WordPress website maintenance checklist
These jobs come round less often, which makes them the easiest part of a website maintenance checklist to forget. Put them in your calendar today, on the first working day of each quarter.
Every quarter
- Restore a recent backup to your staging site, to prove it works.
- Check your PHP version under Tools, Site Health, Info, Server, and ask your host to move you to 8.3 or newer.
- Remove admin accounts nobody uses and change passwords on shared logins.
- Retest forms, checkout and your top pages on a phone.
- Replace any plugin that has stopped getting updates.
Once a year
- Renew your domain and hosting, and switch on auto-renew for both.
- Confirm your SSL certificate renews by itself.
- Update your privacy policy and other legal pages.
- Refresh the facts, prices and photos on your busiest pages.
The quarterly restore test matters most. Even when automatic backups run, WordPress.org advises a manual backup now and then to prove the process works, and a restore on staging proves it end to end.
Your PHP version matters too. WordPress recommends PHP 8.3 or greater, and it warns that versions past their end of life may expose your site to security holes.
A backup you never restored is a hope. A backup you restored last quarter is a plan.
WordPress maintenance tasks for online stores
Selling online? Add checkout checks to your list
Stores need a longer website maintenance checklist. A broken checkout loses money in silence, because customers rarely write to say they gave up. If you sell with WooCommerce, place a real test order every week, from the product page to the confirmation email.
Update your store plugin and its extensions on staging first, then check stock, shipping and tax on a test order. We build and look after WooCommerce stores, and our store care tests the checkout every week.
If something breaks
An update broke your site? Fix it in five calm steps
Careful owners with a good website maintenance checklist still hit a bad update now and then. Work through these steps in order, and you get back online without making things worse.
1
Note what changed
Write down the last plugin, theme or WordPress update you ran, and when you ran it.
2
Clear a stuck maintenance message
Seeing “Briefly unavailable for scheduled maintenance”? The update left a file named .maintenance in your site’s main folder. Delete it in your host’s file manager and reload the page.
3
Switch off the plugins
Locked out of the dashboard? In your file manager, rename the wp-content/plugins folder to plugins.hold, log in, rename it back, then turn plugins on one at a time.
4
Restore your backup
Still broken? Restore the files and the database from the backup you took before updating.
5
Get help before you retry
Report the problem to the plugin’s developer, or book a one-off bug fix from a WordPress team.
Who runs your website maintenance checklist
Do the WordPress maintenance tasks yourself, or hand them off?
Both routes work, as long as one named person owns the website maintenance checklist. Trouble starts when a busy month pushes the checklist aside and nobody notices.
Do it yourself
- No monthly fee beyond your hosting and paid plugins.
- You learn how your own site works.
- It takes time every week, and more when an update breaks something.
- You fix every problem yourself, often on a deadline.
- A busy month makes it easy to skip the checks.
Hand it to a care team
- A team runs the updates, backups and uptime checks every month.
- You get your weekly slot back for customers.
- Someone who works in WordPress daily spots trouble early.
- Your files, database and domain stay yours either way.
- A monthly fee to budget for.
Our WordPress care plans start at $49 a month. Standard Care covers uptime monitoring, plugin and theme updates, website backups and an hour of edits.
Website maintenance checklist: our verdict
Which route fits your business?
Choose by how your week looks. If you can protect a slot every Monday, run the website maintenance checklist yourself. If your site brings in leads or sales and your week is already full, hand it to a team. WP BigBang is a WordPress-only team with 500+ websites built.
Do it yourself if…
- Your site is small, with few plugins and no store.
- You can keep a weekly slot, and you like the work.
Our pick for busy owners
Hand it to a team if…
- Your site brings in leads or sales every week.
- You run a store, bookings or online payments.
- Nobody on your team wants to own the updates.
- You want a named team to call when something breaks.
Frequently asked questions
WordPress maintenance checklist questions, answered
What should a website maintenance checklist include?
Backups, updates, security checks, speed and broken-link checks, and a regular restore test. Sort them by schedule: weekly updates and backup checks, monthly speed and clean-up, quarterly restore tests and yearly renewals.
What are the most important WordPress maintenance tasks?
Backups and updates. Back up the files and the database first, then update WordPress, your theme and your plugins, and test your key pages. Patchstack found that 91% of new WordPress security flaws in 2025 were in plugins.
What goes on a monthly WordPress maintenance checklist?
A monthly WordPress maintenance checklist covers a speed check on your top pages, a scan for 404 errors in Search Console, a database clean-up, deleting unused plugins and themes, and a look at Tools, then Site Health.
How often should I update WordPress plugins?
Check every week, and back up before each round. Attackers move fast: Patchstack puts the weighted median time to a first attack on the most-targeted WordPress flaws at 5 hours.
How often should I back up my WordPress site?
WordPress.org suggests weekly backups for smaller sites and daily backups for busy ones. Keep 3 to 5 recent copies in different places, such as your server, cloud storage and your own computer.
Can I follow a WordPress website maintenance checklist myself?
Yes, if your site is small and you can keep a weekly slot. Updates, backup checks and form tests are WordPress maintenance tasks that need no code. Restores, PHP changes and fixing a broken update are where many owners bring in help.
What PHP version should my WordPress site use?
PHP 8.3 or greater, as WordPress recommends. Your host can show your current version and move you to a newer one.
What happens if I skip WordPress maintenance?
Problems build up out of sight: plugins with known security holes, backups that stopped running, slow pages and broken forms. A website maintenance checklist catches each one on a schedule, before it turns into a repair.
