WordPress maintenance is not just clicking "Update All".
A business website should be checked regularly for updates, backups, security, forms, performance and signs that something has stopped working.
> Monthly maintenance goal > > Keep the site recoverable, patched and functional without introducing avoidable changes.
1. Confirm backups
Before making changes, confirm that recent backups exist.
Check both:
• website files • database
If possible, periodically test a restore to a staging environment.
2. Update WordPress Core
Security releases should not normally wait for the monthly checklist.
For routine updates:
1. create or verify a backup 2. review release notes 3. update 4. test important pages
3. Update plugins
Remove plugins that are no longer needed.
For active plugins, check:
• available updates • compatibility notes • abandoned plugins • duplicate functionality
The fewer unnecessary plugins you maintain, the smaller the maintenance surface.
4. Update the theme
Theme updates can contain security, compatibility and bug fixes.
If the site uses a child theme or custom code, make sure updates do not overwrite modifications.
5. Test forms
A form can look correct and still fail to deliver email.
Send test submissions through:
• contact forms • quote forms • bookings • newsletter forms
Confirm the message reaches the intended mailbox.
6. Check administrator accounts
Review WordPress users.
Remove:
• unknown accounts • former staff • unused administrators
Use administrator access only where it is genuinely required.
7. Review security
Look for:
• unexpected users • unknown plugins • unusual file changes • login attacks • malware alerts • suspicious redirects
Security monitoring should ideally be continuous rather than monthly.
8. Test backups and recovery information
Make sure you know:
• where backups are stored • who can access them • how to restore • which credentials are required
9. Review performance
Check key pages on mobile.
Watch for:
• slow loading • oversized images • new scripts • layout shifts • plugin bloat
10. Check uptime and errors
Review monitoring or hosting logs for recurring failures.
Look for:
• 500 errors • PHP errors • database issues • failed cron jobs • disk limits
11. Check SSL and domain status
Confirm that:
• HTTPS works • certificate renewal is healthy • domain renewal is enabled or diarised • DNS records are correct
12. Review storage
Backups, cache files and logs can consume disk space.
Keep enough free space for updates and database operations.
A simple monthly checklist
• [ ] Backup verified • [ ] WordPress Core checked • [ ] Plugins updated • [ ] Theme updated • [ ] Forms tested • [ ] Admin users reviewed • [ ] Malware/security alerts reviewed • [ ] Key pages tested • [ ] Performance checked • [ ] SSL checked • [ ] Storage checked • [ ] Error logs reviewed
Need WordPress maintenance?
SiteForge provides ongoing WordPress care covering updates, backups, security checks, troubleshooting and performance work.
View Site Care & Maintenance.
Tasks that should not wait until the monthly check
Some events need attention immediately.
Do not wait for the next maintenance window when:
• WordPress releases an urgent security update • a plugin vulnerability is being actively exploited • malware is detected • the site is down • checkout fails • forms stop delivering • an administrator account appears unexpectedly
Routine maintenance can be scheduled. Security incidents cannot.
Keep a maintenance log
A simple record helps when troubleshooting.
Record:
• date • updates installed • backup status • errors found • changes made • test results
If a problem appears several days later, the log can help identify what changed.
Frequently Asked Questions
How often should WordPress be updated?
Security updates should be handled promptly. Routine updates can follow a controlled maintenance schedule, but there is no benefit in leaving known vulnerable software online for weeks.
Should I enable automatic plugin updates?
It depends on the site. Automatic updates reduce exposure time but can introduce compatibility problems. Business-critical stores may benefit from staged or monitored updates.
How many backups should I keep?
There is no universal number. Retention should match how often the site changes and how far back you may need to recover.
Do small WordPress sites really need maintenance?
Yes. A five-page site still runs WordPress Core, PHP, a database, themes and plugins. Small content volume does not remove software maintenance.