Nearly every emergency we get called into is not really an emergency. It is eight months of skipped maintenance arriving at once, on a Friday, usually while the client is away.
This is the routine we run on sites we look after. It is not exciting. That is the point.
Weekly
For any site taking payments or generating leads. A simple brochure site can do this monthly.
- Apply security and minor core updates. These should already be automatic. Confirm they actually ran.
- Review plugin updates. Read what changed. A patch release goes straight through. A major version number change goes to staging.
- Confirm the backup ran. Not that the plugin is installed. That last night produced a file.
- Load the site as a visitor. Homepage, one service page, the contact form, the checkout. Thirty seconds, and it catches things no monitor reports.
- Check the uptime monitor log. Short repeated outages are usually the first sign of a hosting problem worth raising before it becomes a long one.
Monthly
- Update everything that is left, on staging for anything commercial. Our WooCommerce 11 notes show why store updates deserve their own process.
- Delete unused plugins and themes. Deactivating is not enough. Dormant code on the server is still code an attacker can reach. Delete it.
- Review users. Remove accounts for people who have left. Check nobody has quietly become an administrator.
- Empty spam and trash. Comments, and old post revisions if they have piled up.
- Skim Search Console. Coverage errors, manual actions, new crawl problems. Five minutes.
- Check form submissions arrive. Send one. Broken contact forms can go unnoticed for months, and nobody complains because the message never arrived.
Quarterly
The items that get skipped and later turn into invoices.
- Restore a backup somewhere. Not a checkbox. Actually restore to a staging environment and load the site. A backup that has never been restored is a hopeful assumption.
- Check the PHP version. Under Tools, Site Health, Info, Server. If you are on an end of life version, plan the move now rather than when your host forces it. We set out the current picture in which PHP version to run.
- Clean the database. Orphaned meta, expired transients, leftover tables from plugins deleted years ago.
- Run a speed test properly. On mobile, on a real connection, on the pages people actually land on. Compare against last quarter rather than against a target.
- Find broken links and 404s. Especially after any content changes.
- Verify SSL renewal. Automated renewals fail more often than people expect, and always at a weekend.
Annually
- Full security review. File integrity, admin accounts, login protection, file permissions. If anything looks wrong, our cleanup process is the next step.
- Audit the plugin stack. Every plugin, honestly assessed. What does it do, is it still needed, is it still maintained, is there a lighter option. Most sites can lose a third of their plugins without losing anything else.
- Review hosting. Traffic grows, plans do not. Check what you are paying against what you are using.
- Content review. Outdated prices, staff who left, services you no longer offer, and the year in your copyright footer.
- Check the domain expiry date. It sounds absurd until you meet a business that lost its domain to an unmonitored email address.
The three that matter most
If you only ever do three things:
- Verified backups. Our guide on testing a backup restore covers the part most people skip. Everything else is recoverable if this one is genuinely working.
- Timely security updates, checked against the GitHub Advisory Database. Most compromised WordPress sites were running a known vulnerability with an available patch.
- A supported PHP version, per the official WordPress requirements, and our note on which PHP version to run. Free performance, and it closes an entire class of automated attack.
Everything above is what we would want done on our own sites, which is the only standard worth using. If it never gets done because nobody owns it, that is the real problem to solve, and it is usually solved by making it somebody specific job rather than by buying another plugin.
Frequently asked questions
How often does a WordPress site need maintenance?
Weekly for updates and backup checks on any site handling transactions or leads. Monthly is enough for a simple brochure site. Quarterly for deeper checks such as PHP version, database cleanup and broken links. Annually for a full security and performance review.
Can I just turn on automatic updates?
For minor core updates and security patches, yes, and you should. For plugin and major core updates on a site that generates revenue, no. Automatic updates apply the update and tell you nothing about whether the checkout still works. Test on staging, then apply.
What is the most commonly skipped maintenance task?
Testing that backups restore. Most sites have backups running. Far fewer have ever verified that one of those backups produces a working site. The failure is discovered on the day it matters, which is the worst possible day.
Do I need a maintenance plugin?
Not really. What you need is a routine and someone accountable for it. A good backup solution and an uptime monitor cover most of the tooling. Stacking maintenance plugins on a site usually adds weight and another thing to update.
How much should WordPress maintenance cost?
It varies with the site. A simple brochure site needs an hour or two a month. A store with extensions and custom code needs meaningfully more, because every update has to be tested against a working checkout. The useful question is not the price but what is included and who is responsible when something breaks.
Pingback: WordPress 7.0.4 Security Release: Who Is Exposed | TidWeb