WordPress maintenance: what to do weekly, monthly and yearly

Every week, confirm the site and its forms work and apply tested security updates. Every month, update WordPress core, themes and plugins, check backups, and remove what you do not use. Every year, review hosting, renewals, content and goals. Always test important pages after updates and keep a recent backup.

• Load the home page and key pages on a phone and a computer.
• Submit your contact form and confirm the message arrives.
• Apply security updates once they have been tested, or check that automatic updates ran.
• Review alerts from your security and backup tools.
• Check the comments and spam queue if comments are enabled.

• Update WordPress core, themes and plugins, then test important pages (forms, checkout, key templates).
• Confirm backups are completing, and that a restore actually works.
• Remove unused plugins, themes and user accounts.
• Check speed and look for broken links. See website performance.
• Review users and roles: who still needs access?

• Review hosting, domain and SSL certificate renewals. See web hosting and domain registration.
• Check that content, contact details and offers are still correct.
• Review the site against your business goals and search performance.
• Plan larger upgrades: theme refresh, PHP version, platform changes.

Updates occasionally break a site, usually because a plugin conflicts with another. Testing important pages after updates, and keeping a recent backup you know how to restore, turns a crisis into a quick fix. Keep dated backups of both files and database somewhere separate from the website.

• Use unique, strong passwords and two-step authentication for admin users.
• Install plugins and themes only from trusted sources.
• Delete what you do not use: inactive plugins are still code that can be attacked.
• Limit administrator accounts.

See website security for layered protection and recovery if something goes wrong.

If your team can set aside time every week, the checklists above are enough to start. If not, our website maintenance service handles updates, monitoring, backups and reports, and website management goes further by taking ownership of content changes and hosting too. Our monthly maintenance checklist is the one-page version. For platform context see WordPress.

How often should I update WordPress?

Apply security updates promptly and routine updates at least monthly, testing important pages afterwards.

Do I need a backup if my host already backs up?

Keep your own dated backups where you can restore them yourself. Confirm what your host actually keeps and for how long.

Is it safe to turn on automatic updates?

For security releases it is generally recommended. For major plugin updates, many businesses prefer to test first.

What happens if an update breaks my site?

Restore the latest backup or roll back the update, then investigate on a staging copy before trying again.

Facts in this article that come from outside sources are linked here. Everything else is our own recommendation, based on how we build and maintain websites.

• Hardening WordPress — WordPress Developer Resources — updates, backups, passwords, plugins
• SEO Starter Guide — Google Search Central — titles, headings, links, sitemaps, content