WordPress runs a large share of the web, which makes it a large target. Most hacked WordPress sites are not victims of clever attacks. They are running a plugin that was last updated two years ago, on a password that has not changed since launch.
Regular care prevents most of it, though not all, and no checklist removes risk entirely. This is the checklist I work through on the sites I look after. Most of it takes under an hour a month once it is set up, though a larger or more complex site will take longer. It is deliberately practical. For the wider argument about why maintenance deserves a place in your planning and budget, see my article on why website maintenance is a strategic decision.
Set it up once, then keep the rhythm
The list below is easier to follow when the groundwork exists. Before the first monthly session, make sure you have a place to record what you did, a staging copy or at least a reliable backup, and a list of the journeys that matter to the business, such as the contact form, the booking link, or the checkout. Those journeys are what you test after every change.
Note also that automatic updates are not a replacement for this routine. WordPress documentation says background updates are enabled by default on most sites for core, but plugins and themes are updated automatically only in special cases, such as security fixes pushed by the WordPress security team, unless you configure them. You can enable them for specific plugins, and I consider that sensible for small, low-risk plugins. For anything that touches payments, bookings, or custom behaviour, I prefer a deliberate update with a check afterwards.
Every week
Check the site is up and working. Load the homepage and one or two key pages. Better still, set up an uptime monitor that emails you when the site goes down. Remember its limit: it tells you the address responds, not that the forms and checkout work.
Look at form submissions. If enquiries suddenly stop, check that the contact form still sends. Silent form failures are common after updates and email changes. Send a test message yourself, and make sure it arrives in a mailbox somebody reads.
Every month
Back up first. Before any update, make sure a fresh backup exists and is stored away from your hosting account. Daily automatic backups are better, with at least 30 days kept. The number of days is my practical preference, not a rule, and you should set it according to how often your content changes and how quickly you would notice a problem.
Test a restore. Once a quarter, restore a backup to a staging copy. It is the only way to know the backups actually work. WordPress’s own upgrade guidance stresses confirming that a backup is usable.
Update WordPress core, themes and plugins. Do it on a staging copy first if the site matters to your business. Read the changelog for major versions, then update the live site and check the key pages and forms. Update one thing at a time on a complicated site. If something breaks, you will know which update caused it, which saves a long search.
Remove what you do not use. Every inactive plugin and theme is code that can still be attacked. Delete them, do not just deactivate them. Keep one default theme as a fallback if your host or workflow expects it.
Check for abandoned plugins. If a plugin has not been updated in over a year, look for a maintained alternative. A year is a rule of thumb. A small, simple plugin may be stable, whereas a complex one that has gone quiet is a greater concern. Check the plugin directory for the last update, the compatibility notes, and whether the developer responds to support questions. Replacing a plugin has a cost, so weigh it against what the plugin does.
Review user accounts. Remove people who have left, check that only the right people are administrators and make sure everyone uses a strong, unique password with two-factor login. A hypothetical example: a former freelancer still has an administrator account from a project two years ago. Nobody thinks of it as a risk, which is exactly why it is one.
Run a security scan. A scanner such as Wordfence or your host’s malware checker will flag changed files and known vulnerabilities. Treat the result as information to review, not as a verdict. Scanners produce false alarms and can miss things, so pair them with the other habits on this list.
Check speed. Run your homepage through PageSpeed Insights. If the mobile score has dropped, look at recently added plugins, images and scripts. Compare with your previous result rather than chasing a perfect number, and focus on whether pages feel quick on a phone.
Look at Search Console. Check for new errors, pages dropped from the index and security warnings.
What to leave alone
A checklist can encourage change for its own sake. Not every update needs to be applied on the day it appears, and not every warning is urgent. A security fix for a plugin that your site actively uses deserves prompt attention. A cosmetic release for a plugin you could remove deserves a question about whether you need it at all. If a site is stable, serves its purpose, and has working backups, doing the routine checks and resisting unnecessary redesigns of its setup is good maintenance.
It is also worth keeping a short log of each monthly session: what was updated, what was tested, and anything unusual. When something breaks three weeks later, that log is the quickest route to a cause, and it makes handover to another person far easier. A simple spreadsheet or shared document is enough. The value lies in keeping it consistent, not in the format.
Every quarter
Check your PHP version. Old PHP versions stop receiving security fixes. Your host’s control panel shows which one you run; ask them before you upgrade. At the time of writing, php.net lists PHP 8.4 and 8.5 as actively supported, with 8.2 and 8.3 receiving security fixes only, and 8.2’s security support ending on 31 December 2026. Check the supported versions page for the current position. Moving up can break an older plugin or theme, so test on staging first.
Review your hosting. Is the site fast enough, is support helpful, do you have staging and backups included? Cheap hosting often costs more in time. That said, a more expensive plan is not automatically better, so judge it by what you actually need: reliability, response times, and recovery options.
Clean the database. Old revisions, spam comments and expired transients slow the site down. A plugin such as WP-Optimize can tidy them, after a backup. I would do this cautiously on a site with custom content types, since a cleanup tool cannot know which data you still need.
Check renewals. Domain, hosting, SSL and premium plugin licences. An expired domain is the most avoidable outage there is. Put the dates in a calendar that more than one person can see, and make sure the renewal emails go to a monitored address and not to someone who has left.
Test your own contact routes. Once a quarter, submit each form, place a test booking if you have one, and check that automatic confirmation emails arrive and read correctly. Updates to email settings, SSL certificates, or a plugin can quietly break these, and the first person to notice is usually a customer.
Every year
Review your content. Update or remove pages that are out of date, check that contact details and prices are still right, and fix broken links. If a page no longer serves a purpose, consider whether to redirect it rather than simply delete it, so that old links still lead somewhere useful.
Review who has access. Hosting, domain registrar, DNS, analytics and the WordPress admin. Write it down in one place.
When something goes wrong
If the site shows a white screen, an error or strange content, do not panic and do not start deleting plugins on the live site. Take a backup of the current state, then restore the last good backup or work on a copy. If an update caused it, note which one, because that detail helps both you and the plugin developer.
If the site has been hacked, change every password after the clean-up, not before, or the attacker may simply log in again. Also check for unfamiliar administrator accounts and review who can reach the hosting account. Contact your host early, since many can help identify what changed.
Doing it yourself, or not
Everything here is within reach of a careful site owner. The hard part is remembering to do it every month, and knowing what to do when an update breaks something. A sensible middle path is to do the weekly checks yourself and ask for help with updates and recovery, or the reverse if you enjoy the technical work. Retaining the arrangement you already have is also a fair outcome if it covers the checks above. If you would rather not think about it, my WordPress care plans cover all of this, with a short monthly report.