WordPress Maintenance Checklist

An interactive weekly, monthly and quarterly WordPress maintenance checklist with saved progress and an exportable client report.

Runs in your browser

Progress

0 of 37 items complete · 0%

Frequency

Your progress is saved in this browser only, so you can close the page and continue later.

  • Weekly

    Check the backup log, not just the schedule: both the database and wp-content (uploads, themes, plugins) must be included.

  • Monthly

    Copies on the same server disappear with the server. Keep at least one copy in separate storage (S3, B2, Google Drive) with a retention of 30+ days.

  • Quarterly

    A backup you have never restored is a hope, not a backup. Restore to staging, log in and click through key pages.

  • Weekly

    An on-demand snapshot right before updates makes a broken plugin update a five-minute rollback.

  • Weekly

    Prioritise security releases. Read changelogs for major versions and update page builders and WooCommerce on staging first.

  • Weekly

    Customisations belong in a child theme so updates do not overwrite them.

  • Monthly

    Minor (security) releases install automatically by default; major releases should be tested on staging, especially with WooCommerce.

  • Quarterly

    Tools → Site Health shows the PHP version. Run a supported release (8.2 or newer) for security fixes and speed; test on staging before switching.

  • Monthly

    Deactivated code can still be exploited if a vulnerable file is reachable. Keep one default theme as a fallback.

  • Quarterly

    Plugins not updated for over a year or closed on WordPress.org no longer receive security fixes.

  • Weekly

    Look for modified core files, malware signatures, blocked attacks and failed login spikes.

  • Monthly

    Remove former staff and contractors, downgrade anyone with more access than needed and look for administrators you do not recognise.

  • Quarterly

    Two-factor authentication stops most credential-stuffing attacks on wp-login.php.

  • Monthly

    Verify the expiry date and that http:// and www variants redirect to one HTTPS URL. The .htaccess generator can create the redirect.

  • Quarterly

    define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php stops a hijacked admin account from editing PHP in the dashboard.

  • Monthly

    Use the Core Web Vitals report in Search Console for real-user data and PageSpeed Insights to diagnose individual templates.

  • Monthly

    Load a page logged out and check the response headers (e.g. x-cache: HIT) or the cache plugin status.

  • Monthly

    Make sure new uploads are compressed and served in WebP/AVIF. Check what sizes WordPress generates with the Image Size Calculator.

  • Quarterly

    Query Monitor shows slow database queries, HTTP calls and scripts per page; remove or replace the worst offenders.

  • Monthly

    Check Pages (indexing) for new errors, manual actions, security issues and sudden drops in clicks.

  • Monthly

    Only indexable, canonical URLs that return 200 should appear. Generate one manually with the Sitemap Generator if needed.

  • Quarterly

    A leftover Disallow: / or the Settings → Reading checkbox can deindex a site. Rebuild it with the robots.txt generator.

  • Quarterly

    Fix missing, duplicate or truncated snippets — preview them with the SERP Snippet Preview.

  • Monthly

    Crawl the site (Screaming Frog, Ahrefs or Sitebulb) rather than running a link-checker plugin permanently, which adds database load.

  • Monthly

    Redirect removed URLs that still get traffic or links to the closest relevant page with a 301 — the Redirect Generator writes the rules.

  • Monthly

    Contact, quote and checkout emails fail silently when SMTP credentials expire. Use an SMTP plugin with email logging.

  • Quarterly

    Refresh prices, dates, team members, legal pages and posts that mention old versions or years.

  • Weekly

    Clear the spam and trash queues so they do not bloat the wp_comments table.

  • Quarterly

    Delete stale revisions and cap future ones with define( 'WP_POST_REVISIONS', 10 ); in wp-config.php.

  • Monthly

    Run wp transient delete --expired with WP-CLI, or use a database clean-up plugin.

  • Quarterly

    Site Health warns when autoloaded options are large. Leftovers from deleted plugins are loaded on every request.

  • Quarterly

    Remove events from uninstalled plugins (wp cron event list) and consider a real server cron — see the Cron Generator.

  • Weekly

    Check the outage log and response-time trend; recurring short outages usually point to a resource limit on the host.

  • Weekly

    Fatal errors and repeated warnings reveal broken plugins before visitors report them. Log to a file with WP_DEBUG_LOG, never to the screen.

  • Monthly

    Tools → Site Health flags missing PHP modules, failed loopbacks, outdated software and HTTPS problems.

  • Quarterly

    Old backups stored on the server and log files are the usual culprits when a disk quota fills up.

  • Quarterly

    Enable auto-renew and confirm the billing card on file has not expired.

Export report

The report lists every item as a Markdown task (- [x] done, - [ ] not done) and renders nicely in GitHub, Notion, Obsidian and most ticket systems.

What does WordPress maintenance involve?

A WordPress site is never “finished”. Core, themes and plugins ship security fixes every week, backups silently fail, SSL certificates expire, contact forms stop delivering when SMTP credentials change, and the database slowly fills with revisions, spam and expired transients. Most hacked or broken WordPress sites were not attacked by anything clever — they simply missed routine maintenance.

This checklist turns that routine into concrete tasks grouped by area (backups, updates, security, performance, SEO, content, database and monitoring) and tagged by how often they should be done: weekly for anything that protects against data loss or known vulnerabilities, monthly for health and SEO checks, and quarterly for audits that change slowly.

Ticks are saved in your browser so you can work through the list over several sessions. When you are done, export a Markdown report with the date, completed and outstanding items and your notes — ideal for agency care plans and monthly client reports.

How to use the WordPress Maintenance Checklist

  1. Pick a frequency filter — for a weekly check, choose Weekly to see only the tasks due this week.
  2. Work through each group and tick items as you complete them. Use Check all for a group you have fully covered, and collapse finished groups to keep your place.
  3. Enter the site name, the maintenance date and any notes (updated plugins, issues fixed, follow-ups).
  4. Click Copy Markdown or Download .md to save the report, then Reset progress (click twice to confirm) before the next maintenance cycle.

Example

An exported report looks like this (shortened):

# WordPress Maintenance Report — example.com

- **Site:** example.com
- **Date:** 2026-10-01
- **Progress:** 31 of 37 items complete (84%)

## Backups (4/4)

- [x] Confirm the latest automatic backup completed _(Weekly)_
- [x] Verify backups are stored off-site _(Monthly)_
...

## Outstanding items

- Test-restore a backup to a staging site (Backups)

A sensible maintenance rhythm

  • Weekly (15–30 minutes): check backups, apply plugin and theme updates after a fresh snapshot, review security and uptime alerts, scan the error log.
  • Monthly (1–2 hours): core updates, Search Console, Core Web Vitals, forms, broken links and 404s, user and SSL checks.
  • Quarterly (half a day): restore test, PHP version, abandoned plugins, database clean-up, content refresh and renewal dates.
  • High-traffic stores and membership sites need the weekly tasks more often — WooCommerce security releases should be applied within days.

Update safely

Update in this order: take a backup, update plugins one group at a time, then themes, then core, and check the front end and checkout after each step. Major releases of WooCommerce, page builders and membership plugins deserve a staging test. If an update breaks the site, restoring the snapshot taken minutes earlier is far faster than debugging on production.

Frequently Asked Questions

How often should a WordPress site be maintained?

At least weekly for backups and security updates, monthly for health and SEO checks, and quarterly for audits such as restore tests, PHP upgrades and database clean-up. The frequency tags on each item follow this rhythm.

Where is my progress stored?

In your browser’s local storage on this device only. Nothing is sent to a server. Clearing site data or switching browsers starts a fresh checklist, so export the report if you need a permanent record.

Should I enable automatic plugin updates?

For well-maintained, low-risk plugins, yes — it closes security holes quickly. Keep manual control over WooCommerce, page builders and anything that changes the database, and make sure daily backups are running either way.

Can I use this checklist for client maintenance reports?

Yes. Fill in the site name and date, add notes about what you changed, and export the Markdown report. It pastes cleanly into emails, Notion, GitHub issues or a PDF via any Markdown editor.

What should I check before launching a new site instead?

Use the WordPress Launch Checklist, which covers pre-launch settings such as permalinks, search engine visibility, redirects from the old site and legal pages.

Browse WordPress Tools

  • WordPress Launch Checklist

    An interactive pre-launch checklist for WordPress sites covering settings, security, SEO, performance, content, legal and testing.

    WordPress

  • WordPress .htaccess Generator

    Build a clean WordPress .htaccess with HTTPS, www redirects, security hardening, caching and compression rules.

    WordPress

  • WordPress robots.txt Generator

    Create a correct robots.txt for WordPress or WooCommerce with sitemap lines, AI crawler blocking and custom rules.

    WordPress

  • WordPress Redirect Generator

    Turn a list of old and new URLs into validated 301 redirects for Apache .htaccess, Nginx, PHP or CSV.

    WordPress

  • WordPress ACF Field Generator

    Build Advanced Custom Fields groups visually and export acf_add_local_field_group() PHP plus escaped template code.

    WordPress

  • WordPress Custom Post Type Generator

    Generate register_post_type() code with every label, REST and block-editor support, rewrite rules and menu icons — as a snippet or plugin.

    WordPress