A WordPress site isn’t something you build once and forget. Plugins release fixes, PHP versions reach end of life, certificates expire and forms quietly stop sending. This WordPress maintenance checklist breaks the work into weekly, monthly, quarterly and yearly tasks, so a business site stays secure, fast and working without turning into a full-time job. Use it as is, or hand it to whoever looks after your site.<\/p>\n
Most of the problems we fix on client sites didn’t start as emergencies. They started as a skipped update, a backup nobody tested, or a plugin that stopped being maintained two years ago. Small things pile up until one of them takes the site down on a busy day.<\/p>\n
Updates are the clearest example. On September 17, 2026, WordPress 7.1.1 shipped as a maintenance and security release with 11 security fixes, and the WordPress team recommended updating immediately. The same announcement repeats a point many owners miss: only the most recent version of WordPress is actively supported. A site that’s a few versions behind isn’t just missing features; it’s missing fixes.<\/p>\n
Maintenance also protects things that aren’t technical at all: your domain, your search traffic, and the leads coming through your contact form.<\/p>\n
Three things make every task below safer and faster. Set them up once.<\/p>\n
The WordPress documentation is clear that a full backup has two parts: the files (core, themes, plugins, uploads, A useful rule of thumb is 3-2-1: three copies of your data, on two different types of storage, with one copy offsite. The WordPress backup guide says much the same thing in plain terms: keep at least 3 to 5 recent backups, stored in different places, for example on the server, in cloud storage and on your own computer. A backup that only lives on the same server as the site disappears with the server.<\/p>\n The step most people skip is testing. The WordPress docs recommend checking automated backups with a manual one now and then to make sure the process actually works. The real test is restoring a backup to a staging site and clicking through it.<\/p>\n A staging site is a private copy of your live site where you can try updates and changes first. Many hosts offer one click staging. If yours doesn’t, a local copy works for smaller sites. For stores and membership sites, staging is the difference between finding a broken checkout yourself and hearing about it from a customer.<\/p>\n Keep a simple log, even a shared spreadsheet, with the date, what was done, versions before and after, and anything odd you noticed. When something breaks three weeks later, the log tells you what changed. It also shows clients or managers that the work is actually being done.<\/p>\n WordPress gives you several layers of automatic updates, and it’s worth knowing what’s on by default:<\/p>\n Auto-updates are a good choice for small, well-maintained plugins. For the plugins your business depends on (WooCommerce, payment gateways, page builders, membership plugins), a safer monthly routine is:<\/p>\n Rollback protection only catches fatal errors. It won’t notice a broken layout or a payment button that stopped working, which is why testing still matters.<\/p>\n Go to Tools > Site Health. The Status tab groups results into critical issues, recommended improvements and passed tests. Critical items include background updates that aren’t working, a site that can’t reach WordPress.org, errors displayed to visitors, an outdated PHP version and plugins waiting for updates. The Info tab lists your WordPress, PHP and database versions, active and inactive plugins, and directory sizes. Fix anything critical and note the rest in your log.<\/p>\n Run a malware and file integrity scan with your security plugin or your host’s scanner. Then go to Users and check every account with the Administrator, Editor or Shop Manager role:<\/p>\n If you’ve added AI tools to your site, include their API keys and permissions in this review. Our guide to WordPress AI plugin security<\/a> covers what to check.<\/p>\n Open Google Search Console once a month and check three reports:<\/p>\n Fix broken internal links you find, and add redirects for pages that moved or were deleted but still get traffic.<\/p>\n PHP is the language WordPress runs on, and each PHP branch gets two years of active support followed by two years of security fixes only, according to php.net. As of early October 2026, the supported branches are:<\/p>\nwp-config.php<\/code>) and the database, which lives separately on the database server. You need both to restore a typical site. It suggests backing up the database first and then the files, and restoring in the opposite order: files first, then the database.<\/p>\nA staging site<\/h3>\n
A maintenance log<\/h3>\n
Weekly tasks<\/h2>\n
\n
Monthly tasks<\/h2>\n
Update core, plugins and themes safely<\/h3>\n
\n
WP_AUTO_UPDATE_CORE<\/code> constant in wp-config.php<\/code>.<\/li>\n\/\/ wp-config.php: allow only minor core updates automatically\ndefine( 'WP_AUTO_UPDATE_CORE', 'minor' );<\/code><\/pre>\n\n
Check the Site Health screen<\/h3>\n
Security scan and user audit<\/h3>\n
\n
Search Console, broken links and 404s<\/h3>\n
\n
Quarterly tasks<\/h2>\n
Check your PHP version<\/h3>\n