Key takeaways
- WordPress needs a little attention often, rather than a lot of attention rarely.
- Daily: backups and uptime. Weekly: updates and a quick check of key pages. Monthly: security review and clean-up. Yearly: a bigger health check.
- Plugins are where most problems start. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins.
- Always back up before updating, and test the pages that earn you money afterwards.
- If your site takes orders, add checkout and payment checks to every update.
A WordPress maintenance checklist covers four rhythms. Every day, check backups ran and the site is up. Every week, apply updates and test key pages. Every month, review security and tidy up. Every year, review hosting, PHP and the site as a whole. The lists below spell out each task.
This checklist is specific to WordPress. For a platform-neutral version, see our guide to website maintenance.
Why does WordPress need regular maintenance?
WordPress runs about 39% of all websites, according to W3Techs. That popularity is good for features and support, but it also makes WordPress a target. Most sites rely on 10 to 30 plugins, each maintained by a different developer on a different schedule.
Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins. Heavily targeted flaws were being attacked within a median of about five hours of becoming public. A site that’s updated once a quarter spends a lot of time exposed.
Every day
- Confirm last night’s backup completed, and that it’s stored off the server.
- Check uptime monitoring hasn’t reported any outages.
- If you run a store, check orders are still coming through as normal.
Every week
- Take a fresh backup before you change anything.
- Update WordPress core, plugins and themes. Do it on a staging copy first if the site is complex.
- After updating, load the home page, a service page, the contact form and any checkout.
- Submit a test enquiry to make sure forms still deliver.
- Glance at Google Search Console for new errors or security warnings.
Every month
- Review admin users. Remove anyone who no longer needs access.
- Delete plugins and themes you no longer use. Deactivated plugins can still be attacked.
- Check each plugin is still maintained. If one hasn’t been updated in a year, look for a replacement.
- Run a security scan, and check two-factor login is on for every admin.
- Test page speed with Google PageSpeed Insights, especially on mobile.
- Clean out spam comments, old drafts and post revisions.
Every year
- Check your PHP version is still supported, and plan an upgrade if not.
- Review your hosting plan against your traffic and storage.
- Restore a backup to a test site, to prove it actually works.
- Review content: outdated prices, old staff, expired offers and broken links.
- Check your domain, SSL certificate and any paid plugin licences renew on time.
Extra checks for WooCommerce stores
An online store has more to lose when an update goes wrong. Add these to the weekly list:
- Place a real test order from product page to payment, using a low-cost product or a test mode.
- Check order emails reach both you and the customer.
- Update WooCommerce and its payment plugins together, and read the release notes first.
- Keep an eye on database size. Stores grow quickly, and slow databases mean slow checkouts.
Our WooCommerce maintenance page explains how we look after stores.
What if an update breaks something?
This is why the backup comes first. If an update causes a problem, you can roll back the plugin or restore the backup. Our guide to what to do when an update breaks your site walks through it step by step.
For bigger sites, test updates on a staging copy before they go live. See how staging sites work.
Which tasks can you safely do yourself? Backups, updates on simple sites, content reviews and user clean-ups are all very doable. Security hardening, PHP upgrades and recovering from a failed update are where professional help pays for itself.
Frequently asked questions
How often should WordPress be updated?
Check for updates at least weekly. Security fixes for popular plugins are often attacked within hours of being published, so waiting months leaves your site exposed.
Should I turn on automatic updates?
Automatic minor core updates are sensible. For plugins, auto-updates suit simple sites. On stores and complex sites, it’s safer to update after a backup and check key pages afterwards.
Do I really need to back up before every update?
Yes. A backup taken minutes before an update is the fastest way to recover if something breaks.
How long does WordPress maintenance take each month?
For a small site, about one to two hours a month if nothing goes wrong. Stores and sites with many plugins take longer, especially when an update needs fixing.
What does a WordPress maintenance service include?
Usually updates, backups, security scanning, uptime monitoring and a report. Better services also test the site after updates and fix anything that breaks. See our guide to WordPress maintenance services.
Sources
- State of WordPress Security in 2026, Patchstack, accessed 13 Nov 2026
- Usage statistics of WordPress, W3Techs, 12 Nov 2026
- Supported versions, PHP.net, accessed 13 Nov 2026