Your site is up and running, so you don’t pay it much attention. Until a plugin update breaks something or a license quietly expires. Weekly: check for updates and verify backups. Monthly: run a malware scan, review user accounts, perform a speed test, test forms and the checkout process, and clean up the database. Annually: remove unused plugins and themes; check the PHP version, licenses, and SSL. Below, I’ll walk you through this WordPress maintenance checklist, including what your hosting provider already handles for you. It’s part of the broader guide WordPress Management: The Complete Guide.
The checklist at a glance
A maintenance checklist is a fixed list of tasks organized by frequency, with the person responsible for each task listed in the last column. I think that last column is the most important, because that’s where things go wrong in practice. Many website owners assume that their hosting provider takes care of everything, when in fact a hosting provider mainly monitors the server and doesn’t check whether your contact form is still working.
| Task | How often | Does your hosting provider already offer this? |
|---|---|---|
| View updates, install security updates | Weekly | No, you or your maintenance provider |
| Backing Up Data | Every day | Yes |
| Check whether the backup was successful | Weekly | No |
| Malware Scan and Firewall | Ongoing | Yes |
| Monitoring Your Site's Uptime | Ongoing | Partially, only with a maintenance subscription |
| Users, Speed, and Forms | Monthly | No |
| Clean Up the Database | Monthly | No |
| Restoring a Backup as a Test | Quarterly | No |
| Check plugins, PHP version, and licenses | Annual | No |
| Renew an SSL Certificate | Check annually | Yes, as long as the DNS points to your hosting provider |
Weekly: Check for updates and verify backups
Every week, check to see what updates are available and verify that your latest backup was successful. Think of it like checking the tire pressure on your car. My advice for updates is to update at least once a month, but apply security updates immediately. As far as I’m concerned, minor maintenance releases can be done automatically. I install major updates to the WordPress core, your theme, or a plugin like WooCommerce manually, after creating a backup and preferably first on a staging environment, a copy of your site where you can test things safely. You can read about how to do that in Updating WordPress Safely.
When checking the backup, I look at two things: the date of the last automatic backup and its size. If a backup is suddenly much smaller than the previous one, something was left out. Also, don’t store your backups only on the same server as your site, because if that server has problems, you’ll lose everything at once. If a major update is coming up, make an extra backup yourself, for example in Installatron. More about schedules and storage in WordPress Backup and Migration: The Complete Guide.
After that, I always take a moment to browse through the site myself. While you’re at it, check the notifications from your security system, your uptime monitoring, and Google Search Console. If comments are enabled, delete any spam comments right away.
Monthly: Security, Speed, and Functionality
Once a month, check to make sure your site is still secure, fast, and up and running. I start with the malware scan. With a good hosting provider, this runs continuously, but it’s still your job to review the results. If the scan finds something you don’t trust, read what you need to do at WordPress hacked. Next, I review the users and their user roles. Former employees and your previous web developer no longer need administrator accounts, and every forgotten account is a door left wide open.
For the speed test, I use PageSpeed Insights on your three or four most important pages, and I pay particular attention to the Core Web Vitals. If the score remains red even though you haven't made any changes, the problem is often more deep-seated, and it helps WordPress Speed Optimization. Also, test your forms by filling one out yourself and checking to see if the email arrives. A form that fails silently is the most common hidden error I encounter. I also clean up revisions, spam, and expired transients by to clean up your WordPress database, and I check the 404 errors in Search Console to fix broken links.
For WooCommerce online stores
Test your online store monthly as a customer. Place a test order using a real payment method or in test mode, and check whether the order confirmation and other transactional emails are delivered. After every update, I check whether the payment and shipping links still work, because that’s usually where things go wrong. More on that in How to Update WooCommerce Without Breaking Your Checkout. Would you rather not do it yourself? Then we'll test the checkout process, payment methods, and integrations for you WooCommerce Management.
Quarterly and annually: recovery test and cleanup round
Every quarter, restore a backup as a test, and every year, clean up and look ahead. A backup you’ve never restored is a promise, not a safety net. So restore it at least once a quarter to a copy of your site—for example, a clone in Installatron—and check that everything works. See restore a backup. While you're at it, take a critical look at your plugins. Which ones do you actually still use?
Once a year, your site undergoes a checkup, similar to a vehicle inspection. These are the points I go over during that checkup.
- Delete unused plugins and themes instead of just deactivating them. See Clean up outdated and unused plugins.
- Check whether your PHP version still receives security updates. If not, read Update PHP Version.
- Make a note of when licenses for premium plugins and themes expire, because without a license, you won't receive updates.
- Make sure your SSL certificate and domain name renew automatically.
- Reset administrator passwords using a password manager and enable two-factor authentication (2FA) on WordPress, cPanel, and your customer account at my.surver.nl.
- Check your content for outdated opening hours, prices, team members, and legal text.
- Check to see if your hosting package still meets your needs in terms of visitor traffic and disk space.
What Your Hosting Provider Already Does for You
Your hosting provider handles the automated aspects of maintenance, but the evaluation and testing are still up to you or your maintenance provider. Hosting is the foundation; maintenance is keeping the house in good shape. Good Managed WordPress Hosting It creates backups, scans for malware, runs a firewall, renews your SSL certificate, and monitors the servers. What it never does on its own is determine whether an update is safe, test your checkout process, or clean up old user accounts. And the availability of your site itself is usually only monitored if you have a maintenance subscription.
What we do as standard at Surver already takes care of part of this list for you. On all shared plans, we automatically create daily, weekly, and monthly backups, which are stored on external servers in separate data centers within Europe. Imunify scans your files in real time whenever a change is made and performs a full scan every night; ModSecurity acts as a firewall to block suspicious traffic; and your Let’s Encrypt certificate renews automatically as long as your DNS points to us. If you’d like to leave the rest to us as well, we’ll carry out the checklist within WordPress maintenance. We update the core, themes, and plugins monthly, with checks that become more comprehensive depending on the package—up to staging tests for the Enterprise plan. In addition, we check every minute to ensure your site is accessible, and if a site has been neglected for a long time, we’ll help you catch up. You can view any outages on our end at status.surver.nl. If you want to take your security further, read the guide WordPress Security.
Frequently Asked Questions
How much time does WordPress maintenance take?
That depends mainly on the number of plugins and whether you have an online store. If everything goes smoothly, the weekly check is quick. The time is spent on exceptions, such as an update that breaks something.
How much does it cost to outsource WordPress maintenance?
That depends on the number of sites, whether you have an online store, and how much oversight you want after each update. At Surver, the level of oversight varies by package, ranging from simply applying updates to first testing on a staging environment. On the maintenance and management services page, you can see what each package includes.
What happens if you don't maintain WordPress?
If you fall behind on security updates, your site will slow down, and eventually something will go wrong. To find out just how big those risks are, read What Happens If You Don't Maintain WordPress.
