Short answer: WordPress maintenance means keeping the core, theme and plugins updated safely, taking backups you have actually tested, watching security and uptime, keeping the site fast, and fixing small problems before they grow. A good monthly care plan does all of this on a schedule, tests updates on a staging copy before touching the live site, and sends you a short report of what was done.
A website is not finished on launch day. WordPress, your theme and your plugins release updates every month, many of them for security. Use this checklist to look after your own site, or to judge what a maintenance provider should be doing for you.
Weekly
- Check updates for WordPress core, the theme and plugins. Read the change notes for major versions.
- Apply updates on a staging copy first, check the important pages and forms, then apply them to the live site.
- Confirm backups ran and are stored off the server (a backup on the same server is lost if the server fails).
- Look at uptime alerts and any errors your monitoring reported.
Monthly
- Test a backup restore on a staging site. A backup that cannot be restored is not a backup.
- Run a security scan for malware and changed core files.
- Review users: remove accounts that are no longer needed and check that admin access is limited to the right people.
- Remove unused plugins and themes. Even deactivated plugins can be a security risk.
- Test forms and checkout: submit your contact form and, for shops, place a test order.
- Check speed: run a page-speed test on your main pages and look at Core Web Vitals in Google Search Console.
- Check Search Console for indexing problems, broken pages and security warnings.
Quarterly
- Review plugins: replace any that are no longer maintained or have better alternatives.
- Check PHP version with your host — old versions are slower and stop receiving security fixes.
- Clean the database: old revisions, spam comments and expired data slow the site down.
- Check broken links and fix or redirect them.
- Review content: prices, opening hours, team members and offers that have changed.
Security basics that should always be in place
- HTTPS on every page, with a certificate that renews automatically.
- Strong, unique passwords and two-factor authentication for administrators.
- Limited login attempts and no "admin" username.
- File editing disabled in the WordPress dashboard.
- Regular, off-site backups and a plan for what to do if the site is hacked.
What a monthly care plan should include
- Updates tested on staging before going live.
- Daily off-site backups, with restores tested.
- Uptime and security monitoring, with alerts.
- Malware clean-up if the site is ever hacked.
- Some time each month for small changes.
- Regular speed checks and fixes.
- A short monthly report you can understand.
Be cautious with plans that only promise "updates" without testing or tested backups — that is where most problems come from.
Do it yourself or hire someone?
If you are comfortable with WordPress and have an hour or two a month, you can follow this checklist yourself. If your site brings in leads or sales, or you manage several client sites as an agency, a care plan is usually cheaper than the cost of a broken or hacked site.
Our WordPress maintenance services cover everything on this list, with plans for single sites, online stores and agencies. If your site is slow, our website speed optimization service can help first.
