The WordPress Maintenance Checklist

A few years into doing WordPress maintenance for clients, I noticed something: the sites that had problems were not the ones owned by careless people. They were owned by busy people — people who meant to update things, who planned to set up backups, who kept meaning to check their site speed. Life got in the way.

How to use this

Print it, or save it somewhere you will actually open it. Set a recurring reminder for the first Monday of every month. Work through each section in order — the order matters, especially for updates.

23 checks, in four steps. Most months it takes under an hour.

01. Monthly updates

The order matters here. Back up first, then update one thing at a time. 6 checks.

• Back everything up first Critical
  Before any updates. Never update without a fresh backup sitting safely off-server. If something breaks, you can restore in minutes.
• Update WordPress core Critical
  Check Dashboard → Updates. Minor updates (6.4.1 → 6.4.2) are safe to apply immediately. Major versions (6.4 → 6.5) — wait a week and check the release notes first.
• Update plugins, one at a time Critical
  Update each plugin individually, then check your site still works before moving to the next. Never click “Update All” — if something breaks, you will not know which plugin caused it.
• Update your theme Critical
  If you are using a child theme (you should be), update the parent theme. Your customisations in the child theme will not be affected.
• Test your site after updates Important
  Click through key pages: homepage, contact form, any checkout or booking flow. Check on mobile too. Issues are far easier to fix immediately after the update that caused them.
• Deactivate and delete unused plugins Good practice
  Inactive plugins can still be exploited if they have vulnerabilities. If you are not using it, delete it — not just deactivate.

Before updating on your live site, test updates on a staging copy first — most hosts have one-click staging.

02. Security checks

Five checks that catch the things people only notice once it is too late. 5 checks.

• Run a malware scan Critical
  Wordfence (free) or Sucuri SiteCheck (free, no plugin needed — just go to sitecheck.sucuri.net). Look for anything flagged as suspicious or unexpected.
• Check for failed login attempts Critical
  Wordfence → Firewall → Blocked IPs. Hundreds of failed attempts? Your login page is being brute-forced. Enable two-factor authentication immediately.
• Audit user accounts Critical
  Users → All Users. Remove anyone who no longer needs access. Check that no unknown admin accounts have appeared — this is a common sign of a compromised site.
• Confirm the SSL certificate is valid and not expiring Important
  Check the padlock in your browser address bar. If your SSL expires, browsers show a “Not Secure” warning and visitors leave immediately. Most hosts auto-renew, but verify it is working.
• Check your site is not blacklisted Important
  Visit Google Safe Browsing and enter your URL. If you are blacklisted, Google will warn visitors — and your traffic will disappear.

Change your WordPress login URL from /wp-admin to something custom (a plugin like WPS Hide Login does it). It stops most brute-force attacks.

03. Backups and performance

A backup you have never tested is a backup you cannot rely on. 7 checks.

• Confirm automated backups are running Critical
  Log in to your backup plugin (UpdraftPlus, BackupBuddy) or hosting dashboard and verify a recent backup completed successfully. “Set and forget” fails more often than you would think.
• Verify backups are stored off-server Critical
  Backups stored on the same server as your site are useless if the server fails or is hacked. Use Google Drive, Dropbox, Amazon S3, or your backup plugin’s remote storage option.
• Do a test restore, quarterly Important
  Once every three months, actually restore a backup to a staging environment and check it works. A backup you have never tested is a backup you cannot rely on.
• Run a PageSpeed Insights test Important
  Test your homepage and your most important landing page at pagespeed.web.dev. Note your score. If it has dropped significantly since last month, something has changed — investigate.
• Check uptime monitoring logs Important
  Tools like UptimeRobot (free) alert you when your site goes down. Check the monthly report — any downtime you were not aware of? Your hosting support can investigate the cause.
• Optimise the database Good practice
  WP-Optimize (free) → Database → Optimise. This removes post revisions, expired transients and spam comments, keeping your database lean and queries fast.
• Check for broken links Good practice
  Use Broken Link Checker, or Screaming Frog (free up to 500 URLs). Broken links hurt SEO and frustrate visitors. Fix or redirect any you find.

04. Content and monthly review

The last pass — the things your visitors notice before you do. 5 checks.

• Check all contact forms are working Critical
  Send a test message through every form on your site. Confirm the email arrives in your inbox. Forms break after plugin updates more often than anything else.
• Review Google Search Console for errors Important
  Check Coverage → Errors. Any new crawl errors, manual actions or security issues? These directly affect how Google ranks your site.
• Check your site on mobile Important
  Use your actual phone, not just browser dev tools. Navigate through the key journey your visitors take. Does everything work and look right?
• Review your analytics for anything unusual Good practice
  A sudden drop in traffic can signal a penalty, a site error, or a competitor overtaking you for key terms. Catch it early and you can act before real damage is done.
• Clear your caching plugin cache Good practice
  After all updates, clear your full site cache (WP Rocket, LiteSpeed, W3 Total Cache). This makes sure visitors see your updated site and not a stale cached version.

That is your month done

File this checklist somewhere safe, set a reminder for next month, and get back to the work only you can do. Your site is looked after.

If you would rather not do this yourself — that is the whole job I do. Book a free 30-minute call and we can talk about it.

WordPress care and development by Bushra. Last updated August 2026. Free to print and share.