WordPress maintenance is the work nobody notices until it stops. A site that launched well can drift for a year without problems, then fail all at once: an expired domain, a plugin conflict after an automatic update, a backup that turns out to have been empty for months. The fix is a routine with a named owner and a calendar. Below is the schedule we would set for a typical business site: a brochure site, a booking site or a small WooCommerce store. Larger stores and membership sites need more frequent checks.
Every week
Confirm backups ran
Don’t assume. Open the backup tool or your host’s panel and check that last night’s backup completed and has a sensible file size. WordPress’s hardening guide recommends regular backups, including the database, kept as dated snapshots in a trusted location.
Apply updates
Check for core, plugin and theme updates. Security releases can arrive at any time: on 6 October 2026, for example, the release archive shows WordPress 7.1.3 published alongside point releases for many older branches. If you use automatic updates for plugins, which WordPress has offered since version 5.5, the weekly job becomes checking that they ran and nothing broke.
Test what earns money
Submit the contact form, make a test booking, or put an item through checkout. A form that silently stopped sending emails can cost weeks of enquiries before anyone notices.
Clear spam and check uptime alerts
Delete spam comments and form entries, and glance at your uptime monitor for any outages you missed.
Every month: the core of WordPress maintenance
Read Site Health
WordPress’s built-in Site Health screen, under Tools, flags critical issues and recommended improvements: an outdated PHP version, plugins waiting for updates, background updates that aren’t working, or debug errors showing to visitors. Work through anything marked critical.
Review users
Remove accounts for people who have left, and lower roles that are higher than needed. Agencies and freelancers often keep administrator access long after a project ends.
Remove unused plugins and themes
Deactivated code is still on the server. Keep one default theme as a fallback and delete the rest of the unused ones.
Check search and speed
Look at Search Console for new errors, pages dropping out of the index or sudden falls in clicks. Check Core Web Vitals too: Google’s thresholds for a good page are a Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less.
Fix broken links
Run a link checker over the site, then fix or redirect anything returning errors.
Every quarter, restore a backup to a staging site and click around. It takes under an hour, and it is the only way to know your backups work.
Every year
- PHP and database versions: WordPress’s requirements page currently recommends PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer. Ask your host what you are running and plan an upgrade, tested on staging, if you are behind.
- Renewals: list the domain, SSL certificate (if not automatic), hosting, premium plugin and theme licences, and any paid services. Put the renewal dates in a shared calendar and make sure payment cards on file haven’t expired.
- Hosting review: has traffic grown? Are backups, staging and support still adequate? Compare your plan with what the site needs now.
- Content audit: update or retire pages with old prices, team members who have left or services you no longer offer. Redirect any URLs you remove.
- Policies and legal pages: check that your privacy policy still lists the tools you use, especially new analytics, chat or form services.
- Access audit: confirm the business, not a former supplier, owns the domain registrar, hosting and analytics accounts.
Who should own WordPress maintenance?
Someone by name. In a small company that may be an operations lead with a checklist and an hour a week, backed by a developer for updates that break things. Many of the weekly checks can be automated, with alerts sent to a shared inbox: backup reports, uptime monitoring and update notices. Our automation work can set that up, and our website team builds sites that are easier to maintain in the first place.
Frequently asked questions
How much time does WordPress maintenance take?
For a typical small business site with a short plugin list, plan around 30 to 60 minutes a week and a couple of hours a month, plus a half-day once a year for the annual review. Stores and membership sites need more, because testing checkout and logins after updates takes longer. Automating backups and alerts cuts the routine time.
Should I turn on automatic updates in WordPress?
For most simple sites, yes, for minor core releases and well-maintained plugins. Automatic updates close security gaps faster than a person checking weekly. For online stores, sites with custom code or plugins that change often, test larger updates on a staging copy first. Either way, check the site after updates and keep backups from before them.
What is the WordPress Site Health screen?
It is a built-in diagnostic page under Tools in the WordPress dashboard. The Status tab lists critical issues, recommended improvements and passed tests, such as outdated PHP or failing background updates. The Info tab shows technical details about your server, themes and plugins, and can copy them to share with a developer or your host’s support team.