WordPress Website Maintenance Checklist: A Simple Guide (2026)
A WordPress website maintenance checklist is a simple routine that keeps your site safe, fast, and working. If you run a small business site on WordPress, you do not need to be a developer to look after it. You need a short list of tasks, done on a regular rhythm, before small problems turn into big ones.
Last updated: October 2026
Think of it like servicing a car. You would not drive for years without an oil change and then be surprised when the engine fails. A WordPress site is the same. Core software, plugins, and themes get updates all the time, and each update fixes bugs or closes security holes. Skip them for a year and you are running a site with known weak spots.
This guide gives you the full checklist, split by how often each task needs doing, with the exact clicks in your WordPress dashboard. No paid tools are required. Everything here can be done with free plugins and free Google tools.
One quick note: maintenance is not the same as maintenance mode. Maintenance mode is the short “we’ll be back soon” screen visitors see while you work on the site. Maintenance is the ongoing care that keeps the site healthy in the first place.
WordPress maintenance checklist at a glance
| How often | What to do | Time needed |
|---|---|---|
| Weekly | Check backups, run updates, scan for malware, test your forms | 15 to 20 minutes |
| Monthly | Speed test, broken links, spam cleanup, database cleanup, Search Console check | About an hour |
| Quarterly | Plugin audit, user audit, restore test, content refresh | 2 to 3 hours |
| Yearly | PHP version, hosting review, domain and SSL renewals, legal pages | Half a day |
That is roughly 15 minutes a week and an hour a month for a typical small business site. The quarterly and yearly jobs add a few more hours across the year. It is far cheaper than rebuilding a hacked site.
Two rules before you touch anything
Rule 1: Never update without a backup you can restore. A backup only counts if you know where it is stored and how you would use it. A backup sitting on the same server as your site does not help if the server itself fails. Keep at least one copy somewhere else, such as your backup plugin’s cloud storage or a download on your computer.
Rule 2: Update in small batches, and check the site after each batch. If you update 20 plugins at once and something breaks, you will not know which one caused it. Update a few, load your homepage and one inner page, then move on. If your site earns money, test big updates on a staging copy first. Most managed hosts offer one-click staging, and it is worth using for major updates such as a new WordPress version, a page builder update, or a PHP change.
Weekly tasks (15 to 20 minutes)
1. Confirm your backup ran. Open your backup plugin and check the date and size of the latest backup. A backup that silently stopped running weeks ago is the same as no backup at all. If you use a free plugin such as UpdraftPlus, its dashboard shows the last backup date at a glance.
2. Update WordPress core, plugins, and themes. Go to Dashboard, then Updates. Install core updates first, then plugins, then your theme, in small batches as described above. If an update notice says a plugin needs a newer version of WordPress or PHP, sort that out before you update the plugin.
3. Run a security scan. A free security plugin such as Wordfence can scan your files for malware and changed files. Look at its alerts rather than just clearing them. A warning about a new admin user you did not create is a red flag, not a routine notice.
4. Check uptime alerts. A free uptime monitor such as UptimeRobot emails you when your site goes down. Glance at the week’s report. Repeated short outages often point to a hosting problem worth raising with your host.
5. Test one thing a visitor does. Submit your contact form, or if you sell online, walk through the first steps of checkout. Forms break quietly after updates, and visitors who hit a broken form simply leave without telling you.
6. Take a quick visual look. Open your homepage on your phone and on a computer. A broken layout after an update is easy to spot and easy to fix early, but embarrassing if it sits there for a month.
Monthly tasks (about an hour)
1. Run a speed test. Test your homepage and your most visited page in PageSpeed Insights. Write down the scores. You are not chasing a perfect score. You are watching for sudden drops, which usually trace back to a new plugin, a large image, or a new third-party script.
2. Fix broken links and 404 errors. In Google Search Console, check the Pages report for “Not found (404)” errors and fix the ones visitors actually hit. A broken link checker plugin can find broken links inside your own posts. Fixing these keeps visitors on your site and helps search engines trust your pages.
3. Clear spam and trash. Empty the spam comment folder and the trash for posts, pages, and comments. Spam piles up fast on WordPress sites, and it bloats your database for no reason.
4. Clean the database. WordPress stores post revisions, trashed items, and temporary data that builds up over time. A free plugin such as WP-Optimize can safely remove revisions and expired temporary data. Take a backup first, as always, then run the cleanup.
5. Check Search Console for problems. Look at the coverage and security sections. Search Console tells you plainly if Google cannot reach a page, if a page has an error, or if it found a security issue. Fix what it flags before it starts hurting your rankings.
6. Review your analytics briefly. You do not need a deep report. Check which pages lost traffic and which gained it. A page that suddenly dropped may have a broken element or outdated information worth refreshing.
Quarterly tasks (2 to 3 hours)
1. Audit your plugins and themes. Go to Plugins, then Installed Plugins, and ask each one a hard question: do I still use this? Delete anything you do not use, including inactive plugins. Unused plugins still need updates, and abandoned ones stop getting security fixes entirely. Do the same for themes under Appearance, then Themes. Keep your active theme plus one default WordPress theme as a fallback, and remove the rest.
2. Audit your users. Go to Users, then All Users. Remove old accounts for people who no longer work with you, and downgrade anyone who has an administrator role they do not need. Every admin account is a door into your site, so fewer doors means fewer risks.
3. Test a full restore. This is the task most people skip, and it is the most important one. A backup you have never restored is a hope, not a plan. Restore your backup to a staging site once a quarter and check that the site actually works. If the restore fails, you want to find out on a quiet afternoon, not during a real emergency.
4. Refresh your most important pages. Read your homepage, services page, and top three blog posts. Update prices, old dates, dead links, and claims that are no longer true. Fresh, accurate pages convert better and rank better than stale ones.
5. Check plugin licenses. If you pay for premium plugins, confirm the licenses are still active. An expired license means you stop receiving updates, which quietly turns a safe plugin into a risk.
Yearly tasks (half a day, once)
1. Check your PHP version. PHP is the language WordPress runs on, and old versions stop receiving security fixes. In your dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section to see your PHP version. WordPress recommends PHP 8.3 or newer. Note that PHP 8.2 stops receiving security fixes on December 31, 2026, so if your site still runs 8.2, plan the move before that date. Your host controls the PHP version, so ask them to switch it, and test the change on staging first.
2. Review your hosting plan. Is your plan still right for your traffic? A site that has grown may need more resources, and a site that has shrunk may be overpaying. Check your uptime record for the year before you renew.
3. Confirm domain and SSL renewals. Check that your domain name is set to auto-renew with a payment method that still works, and that your SSL certificate renews automatically. An expired domain or certificate can take a site offline overnight.
4. Review your theme. Themes age. If your theme has not been updated by its author in a long time, or it blocks features you now need, this is the moment to plan a switch rather than patching around it for another year.
5. Refresh legal pages. Privacy policies, terms, and cookie notices need to match what your site actually does today. If you added a new tool, form, or analytics service during the year, update these pages to match.
What to do when an update breaks your site
It happens to everyone sooner or later. Do not panic, and do not start changing five things at once.
- Note what just changed. Write down the last update you ran. That is almost always the cause.
- Restore your backup if the site is down. This is why the backup rule comes first. A restore takes minutes and beats hours of guessing.
- If only one feature broke, deactivate the last updated plugin. If you cannot reach your dashboard, your host’s support team can rename the plugin folder for you, which switches the plugin off.
- Test on staging before you try again. Re-run the update on a staging copy, find the conflict, and check whether the plugin author has already released a fix.
- Ask your host for help. Hosts see broken updates every day and can often point at the exact error in minutes. Keep a note of what fixed it, so next time is faster.
Security releases deserve special attention. For example, WordPress 7.1.4, released on October 28, 2026, was a security release, and the official advice was to update right away. When you see a security release notice in Dashboard, then Updates, treat it as urgent rather than routine.
Free tools that cover the whole checklist
| Job | Free option |
|---|---|
| Backups | UpdraftPlus (free version) or your host’s backup tool |
| Security scans | Wordfence (free version) |
| Speed tests | PageSpeed Insights |
| Search errors and security issues | Google Search Console |
| Uptime monitoring | UptimeRobot (free plan) |
| Database cleanup | WP-Optimize (free version) |
| Broken links | Broken Link Checker or Search Console’s 404 report |
You do not need a paid bundle to do this well. Paid tools save time, but they do not replace the routine itself.
Should you do it yourself or hire a care plan?
Doing it yourself costs about 15 minutes a week plus an hour a month, and it works fine for a simple blog or brochure site. Hire help when the site earns real money, when it runs a store, or when you know you will not actually do the routine. Some basic care plans start at about $49 a month, and they usually cover updates, backups, scans, and small fixes. Before you sign up, ask two questions: do they test restores, and will they show you a monthly report of what they did? A plan that cannot answer both is not worth paying for.
Mistakes that cause most WordPress problems
- Updating everything at once, then not knowing what broke.
- Trusting a backup that was never tested.
- Leaving old admin accounts and unused plugins in place.
- Running a PHP version that no longer gets security fixes.
- Keeping backups only on the same server as the site.
- Ignoring Search Console warnings until rankings drop.
Frequently asked questions
How often should I maintain my WordPress site?
Weekly for backups and updates, monthly for speed and error checks, quarterly for audits and a restore test, and yearly for PHP, hosting, and renewals. A small site with few changes can stretch the monthly jobs to every six weeks, but the weekly backup and update check should not slip.
How long does WordPress maintenance take?
About 15 to 20 minutes a week and around an hour a month for a typical small business site, plus a few hours a year for the quarterly and yearly jobs. The first month takes longer because you are setting up backups and tools. After that it becomes routine.
What happens if I never update WordPress?
Your site keeps working until it does not. Outdated plugins and themes are a common way attackers get in, and old versions can stop working with newer PHP or with each other. Recovery from a hacked or broken site costs far more time and money than the routine would have.
Can I do WordPress maintenance without coding skills?
Yes. Every task in this checklist is done by clicking through the dashboard, your backup plugin, or a free Google tool. The only job that may need your host’s help is changing the PHP version, and most hosts will do that for you on request.
Is WordPress maintenance the same as maintenance mode?
No. Maintenance mode is a temporary screen that tells visitors you are working on the site. Maintenance is the regular work itself: updates, backups, scans, and checks. You may switch maintenance mode on during a big update, but the two are different things.
How much does it cost to hire someone for WordPress maintenance?
Basic care plans from agencies often start at about $49 a month for a simple site, with higher prices for stores or sites with heavy traffic. Compare what is included: updates, off-site backups, security scans, restore tests, and a monthly report are the basics worth paying for.
Do I still need maintenance if my host handles backups?
Partly, but not fully. Host backups cover one job. You still need updates, scans, user audits, speed checks, and restore tests, and you should confirm what your host’s backup actually covers and how long it keeps copies.
