A monthly WordPress maintenance checklist you can actually follow

Before you start

Pick a fixed day each month, put it in your calendar and keep a simple log: the date, what you updated and anything odd you noticed. The log takes seconds to write and is invaluable when something breaks and you need to know what changed.

Work through the sections below in order. The order matters: you back up before changing anything, and you test after.

Before the first session, gather what you need in one place: the WordPress administrator login, the hosting control panel login, access to the inbox that receives form notifications, and a list of the site's most important pages. If several people share responsibility, agree who does the checklist each month, so it does not fall between two chairs.

The monthly checklist

1. Backups first

• Check the date of the most recent automatic backup. If it is older than your schedule says it should be, find out why before doing anything else.
• Take a fresh manual backup, or confirm your host has one from today.
• Check that at least one copy is stored away from the website's own server.

If you are unsure what a complete backup includes, read WordPress backups explained before going further.

2. Updates

Out-of-date plugins and themes are the most common way WordPress sites get compromised. Update in this order:

1. Plugins. Read the changelog for major version jumps. Update one at a time if the site is important, so you know which one caused a problem.
2. Themes. Including your parent theme if you use a child theme. Inactive themes need updating too, or deleting.
3. WordPress core. Minor releases are usually installed automatically; check that major releases are applied once your plugins support them.
4. PHP version. Check Tools, Site Health for a warning about an outdated PHP version, and ask your host about upgrading if needed.

For important sites, test updates on a staging copy first. Our guide on how to update WordPress safely walks through it.

3. Check the site still works

Straight after updating, visit the site as a visitor would, ideally in a private browser window:

• home page, a few inner pages and a blog post;
• the main menu on a phone as well as a computer;
• any page built with Elementor or another page builder;
• for a shop, add a product to the basket and go as far as the payment step.

4. Forms and email

A contact form that silently stops sending is one of the costliest failures, because you only notice when someone complains or when enquiries mysteriously dry up.

• Submit every form on the site with a test message.
• Confirm the notification email arrives, and does not land in spam.
• Check that form entries are being stored, if your form plugin saves them.
• Check that the auto-reply to the visitor, if you use one, still makes sense.

If emails do not arrive, see WordPress not sending email. For choosing or setting up forms, see our guide to WordPress contact forms.

5. Security checks

• Users. Go to Users and remove anyone who no longer needs access. Check that only the right people are Administrators. An administrator account you do not recognise is a red flag.
• Passwords and two-factor. Make sure every administrator uses a strong, unique password and, ideally, two-factor authentication.
• Security plugin or scanner. If you use one, read its alerts rather than dismissing them.
• Abandoned plugins. On each plugin's page in the WordPress directory, look at when it was last updated. A plugin that has not been updated for a long time may be abandoned, and should be replaced.
• Certificate. Click the padlock and check the certificate is valid and not close to expiring.

6. Speed and health

• Open Tools, Site Health and work through anything marked critical.
• Run your home page and one key inner page through a page speed test and note the result in your log, so you can spot gradual slowdowns.
• Check that your caching plugin or host cache is still active after updates.
• Look at the size of recent image uploads. Very large photos uploaded straight from a camera or phone are a common cause of slow pages.

7. Housekeeping

• Deactivate and delete plugins you no longer use. Deactivated plugins can still be a security risk while their files are on the server.
• Delete unused themes, keeping one default theme as a fallback.
• Empty spam comments and check the comments queue.
• Check for broken links on key pages, especially after removing old content.
• Make sure your contact details, opening hours and prices on the site are still correct.

8. Write up the log

Finish by noting in your log what you updated, what you tested, anything that failed and what you did about it. If something needs a developer, record the details while they are fresh: the page, the error message and what changed just before it appeared. Over a few months the log becomes a useful history of the site, and it makes handing the work to someone else much easier.

Quarterly extras

Every three months, add these to the monthly routine:

Task	Why
Test restoring a backup to a staging site	Proves your backups actually work
Review paid licence renewal dates	Lapsed licences stop receiving updates
Check Google Search Console for errors	Catches indexing and security issues early
Review your privacy policy and cookie setup	New plugins may collect new data
Check domain renewal date and contact details	An expired domain takes the site and email offline

How long it takes, and the alternative

For a small site with a handful of plugins, this routine usually fits into an hour once you are used to it. Larger sites, shops and sites with many plugins take longer, especially when an update needs troubleshooting.

If that hour never seems to happen, hand the updates over. On WP Web Hosting's WP Managed plan, WordPress, theme and plugin updates are done for you and uptime is monitored, which leaves you the content checks and form tests that only you can judge.

Frequently asked