The WordPress maintenance checklist

This checklist is organised by cadence, with a note on each item about whether it can be automated. There is an interactive version you can tick through if you would rather work from that.

Weekly

• Apply security patches. Not all updates, specifically the ones flagged as security releases. These should not wait for a monthly window. Automatable, with verification.
• Check backup success. Not that the schedule ran, that the backup completed and is the size you would expect. A 4KB backup is a failed backup. Automatable.
• Review uptime and incidents. Anything that went down, for how long, and whether it recurred. Automatable.
• Scan for new vulnerabilities affecting your installed versions. Generic vulnerability news is noise. Matching against what you actually run is signal. Automatable.
• Check for spam and suspicious registrations. A sudden spike in user registrations is often the first visible sign of a problem. Partly automatable.

Monthly

• Apply remaining plugin, theme and core updates. Risk-assessed, tested and verified. Automatable, with verification.
• Test a restore. The item everyone skips and the one that determines whether your backup strategy is real. Restore into a sandbox and confirm the site boots. Automatable.
• Review Core Web Vitals per template. Not just the home page. Compare against last month rather than against a threshold. Automatable.
• Check forms and checkout actually work. Submit a real test enquiry. Add something to a cart and load the checkout. Broken forms fail silently and can go unnoticed for weeks. Automatable.
• Review 404s and broken links. Especially after content changes. Automatable.
• Check SSL certificate expiry and domain renewal dates. Automatable.
• Send the client or stakeholder report. Automatable.
• Review user accounts. Remove dormant administrators, former staff and old contractor accounts. Needs a human decision.

Quarterly

• Audit the plugin list. Remove anything deactivated and unused. Every installed plugin is attack surface whether it is active or not. Needs a human.
• Check for abandoned plugins. Anything without an update in over a year, or removed from the repository, needs replacing. This is one of the highest practical risks in most sites. Detection automatable, replacement needs a human.
• Optimise the database. Clear post revisions, expired transients, spam comments and orphaned metadata. Automatable.
• Review PHP version. Running an unsupported PHP version means no security patches at the language level. Detection automatable.
• Review hosting resources. Whether the plan still fits the traffic and whether you are hitting limits. Needs a human.
• Review the care plan itself. Hours consumed, margin, whether scope has drifted. Needs a human.

Annually

• Full security review. User roles, file permissions, security headers, admin username patterns, exposed endpoints, XML-RPC. Partly automatable.
• Test the actual disaster recovery plan. Not just a restore. A full recovery from total loss, timed, so you know your real recovery time. Needs a human.
• Review third-party integrations and API keys. Rotate credentials, remove integrations nobody uses. Needs a human.
• Content and accessibility audit. Outdated content, broken embeds, missing alt text, contrast failures. Partly automatable.
• Review the technology choices. Whether the theme, page builder and key plugins are still the right ones. Needs a human.

What this list looks like across a portfolio

On one site the checklist is a manageable routine. Across twenty sites it is roughly thirty hours a month of work that produces nothing billable and nothing visible. That is the point at which people stop doing it properly, and the failures start appearing in the items that were skipped.

Look at how the items are annotated. Most of them are automatable, and the ones that are not tend to be the interesting ones: judgement about an abandoned plugin, a conversation about hosting, a decision about whether a care plan still works. Automating the first group is what creates the time to do the second group properly.

That is the whole argument for tooling, and it is worth being honest that it does not eliminate maintenance. It moves the work from repetition to judgement.