WordPress maintenance checklist (monthly)

This WordPress maintenance checklist is a monthly routine in six stages: back up, update, check security, test what matters, check speed, and tidy up. Work through it in order, because each stage protects the next. It is the action list only. For the reasons behind each task, read what WordPress maintenance includes.

Online stores need extra steps, listed in the WooCommerce maintenance checklist.

Before you start

1. Pick a quiet time. Look at your analytics and choose the hours with the fewest visitors.
2. Make sure you can log in to three places: WordPress, your hosting control panel, and wherever your backups are stored.
3. Open a note to record what you change. If something breaks next week, this note is where the search starts.

Stage 1: Backup

1. Confirm that a full backup of files and database was taken today. If not, take one now.
2. Confirm a copy sits somewhere other than the web server.
3. Check the backup size looks normal. A backup far smaller than last month's is a warning sign.
4. Once a quarter, restore a backup to a staging copy of the site to prove it works.

Stage 2: Updates

1. Read the list under Dashboard > Updates before touching anything. Note any major version jumps, since those carry the most risk.
2. If you have a staging site, apply the updates there first and look over the main pages.
3. Update plugins. Do them in small groups, not all at once, so a fault can be traced to its cause.
4. Update the theme and any parent theme or page builder.
5. Update WordPress core if a new version is waiting.
6. Check the PHP version under Tools > Site Health > Info > Server. If it is close to end of support, plan the change. See upgrading PHP on WordPress safely.
7. Open Tools > Site Health and read any critical issues it reports.

Stage 3: Security

1. Review the Users list. Remove accounts for people who have left and lower any role that is higher than it needs to be.
2. Confirm every administrator uses two-factor authentication.
3. Run a malware and vulnerability scan with your security plugin or service and read the result.
4. Delete plugins and themes that are deactivated and not needed. WordPress's hardening guide advises removing unused ones, not just switching them off.
5. Check that the SSL certificate is valid and note its expiry date.
6. Look in Google Search Console for security issues or manual actions.

Stage 4: Test what matters

Do this after the updates, on the live site.

1. Submit every enquiry form with a real test message and confirm the email arrives.
2. Run through any booking, quote or payment step from start to finish.
3. Open the home page, a service page, a blog post and the contact page on a desktop browser and on a phone.
4. Use the site search and the main navigation, including the menu on a phone.
5. Confirm that analytics and conversion tracking recorded your test enquiry.
6. Check any connection to another system, such as a CRM, mailing list or booking system.

Stage 5: Speed and uptime

1. Test the home page and one key landing page with a speed tool and compare the result with last month's.
2. Review the uptime report for outages and note when they happened.
3. If load time has slipped, look at what was added since the last check: new plugins, large images, new scripts.
4. Clear the page cache after updates and confirm caching is still switched on.

Stage 6: Housekeeping

1. Empty the spam and trash folders for comments and form entries.
2. Run a broken link check and fix or redirect what it finds.
3. Review 404 errors in Search Console and redirect any that matter.
4. Clean the database of old revisions and expired temporary data, after the backup is confirmed.
5. Check the domain renewal date and who receives the renewal email.
6. Save your notes: what was updated, what was tested, what needs follow-up.

Quarterly and yearly extras

Every quarter:

• Restore a backup to staging as a test.
• Review the full plugin list and ask whether each one is still needed and still being updated by its developer.
• Change passwords for hosting and any shared accounts.

Every year:

• Review the PHP version against the supported list on php.net.
• Check that the privacy policy, cookie notice and contact details are still accurate.
• Review whether the hosting plan still fits the site's traffic.

If something breaks

1. Stop updating.
2. Check your notes for the last change and reverse that one change if you can.
3. If the site is down and the cause is not obvious, restore the backup you confirmed in stage 1.
4. Reproduce the problem on staging before trying again on the live site.

Handing the checklist to someone else

If this list is more than you want to carry each month, Stryx runs it as part of its WordPress maintenance service. Taking over an existing site starts with an audit, so the first step is a conversation. Contact Stryx to start one.