WordPress Maintenance Checklist
A monthly WordPress maintenance checklist: backups, core and plugin updates, security, performance, forms and a short client report. Schedule it per site.
- Typical schedule monthly
- The checklist 5 sections, 21 items
- Variables
{{site}}{{month}}
Use this checklist once a month for every WordPress site you look after, whether it is your own or part of a client care plan. WordPress sites rarely fail all at once. They decay: an abandoned plugin, a full disk, a contact form that stopped sending months ago. A fixed monthly routine catches these before the client does.
Who owns it
One named person per site owns the monthly run, usually a developer on the agency's maintenance team. If the client pays for a care plan, the finished run is also the evidence of the work you did that month.
Common pitfalls
- Updating without a tested backup. A backup you have never restored is a hope, not a backup. Restore one to staging from time to time.
- Updating everything on production at once. Update on staging first for sites with WooCommerce, page builders or custom code, then update production and check the key pages.
- Ignoring abandoned plugins. A plugin that has not been updated in a long time, or was removed from the plugin directory, is a security risk even if it works. Plan a replacement.
- Forgetting the boring parts. Domain renewals, SSL certificates and form delivery cause more outages than hacks do.
Schedule one run per site per month in Runbook. Each run gets the site and month filled in, and the history shows which updates were applied and who checked the site.
The checklist: WordPress maintenance for {{site}} ({{month}})
Backup
-
Recent full backup (files and database) exists and is stored off the server
-
Backup restored to staging this quarter to prove it works optional
A quarterly restore test is enough for most sites. Do it monthly for shops.
Updates
-
Updates applied and tested on staging first optional
Recommended for WooCommerce, page builders and sites with custom code.
-
WordPress core updated to the current version
-
Plugins updated, and changelogs checked for major versions
-
Theme and child theme updated
-
PHP version on the server is still supported
-
Plugins with no recent updates or removed from the directory flagged for replacement
Security
-
Unused plugins, themes and admin users removed
-
Admin accounts use strong passwords and two-factor authentication
-
Security scan run and the results reviewed (e.g. Wordfence, Patchstack, host scanner)
-
SSL certificate valid with more than 30 days left
-
Domain renewal date checked
Function and performance
-
Home page, key landing pages and checkout or booking flow load and work
-
Every contact form submitted and the message received
-
Broken links scan run and fixes applied
-
Page speed of the home page checked against last month
-
Disk space and database size checked on the hosting account
-
Spam comments and old post revisions cleaned up optional
Report
-
Uptime for the month reviewed in the monitoring tool
-
Short report sent to the client: updates, issues found, recommendations for
{{month}}
Checklist as Markdown
Frequently asked questions
How often should WordPress be updated?
Check for updates at least monthly, and apply security releases for core and plugins as soon as they come out. Many hosts apply minor core updates automatically. Major plugin updates are safer on staging first, because they are the most common cause of broken layouts and checkouts.
What is included in a WordPress maintenance plan?
A typical plan covers backups, core, plugin and theme updates, security monitoring, uptime monitoring, and a monthly report. Some plans add a few hours of content changes or speed work. Write down exactly what is included so the client knows what the monthly fee pays for.
Can I automate WordPress maintenance?
Backups, updates and uptime checks can be automated with your host or tools like ManageWP or MainWP. The checks that need a person remain: does the checkout still work, did the form email arrive, is a plugin abandoned. This checklist covers those, and you can mark automated steps as quick confirmations.
Updated