Every emergency I get called about was preventable by a routine. Hacked site: an update not applied. Site down: a licence expired. Broken layout: an update applied without checking afterwards.
This is the routine. Ten minutes weekly, thirty minutes monthly, an hour quarterly, half a day annually. Put it in the calendar rather than trusting yourself to remember.
Quick Info
Weekly
Ten minutes: updates, backup check, quick front-end look
Monthly
Thirty minutes: full update pass, security, forms, speed spot-check
Quarterly
One hour: plugin audit, database, broken links, content review
Annually
Half a day: licences, PHP version, restore test, content refresh
Most skipped task
Testing a restore
Most expensive to skip
Updates
Weekly: ten minutes
01Apply available updates for plugins, themes and core. Take a backup first if the site is business-critical.
02Look at the actual front end afterwards. Homepage, one service page, one post. Not the dashboard.
03Confirm the latest backup ran and is where you expect it.
04Check for new user accounts you did not create.
05Glance at any uptime alerts from the past week.
The front-end check is the item people skip, and it is the reason sites sit visibly broken for a fortnight. The dashboard looking normal tells you nothing.
Monthly: thirty minutes
Updates and health
—Full update pass including anything you deferred, on staging first if the site takes bookings or payments.
—Read the WordPress Site Health screen and resolve anything flagged as critical.
—Confirm your PHP version is current and supported.
Security
—Run a malware scan.
—Review the user list and remove accounts nobody needs.
—Confirm two-factor authentication is still enabled on all admin accounts.
—Check failed login volumes for anything unusual.
Function
—Submit your own contact form and confirm the email arrives in a mailbox somebody reads. Do this every month without exception.
—Test any booking, quote or payment flow end to end.
—Click through your main navigation on a phone.
Performance
—Run PageSpeed Insights on the homepage and one key page, mobile.
—Check the Core Web Vitals report in Search Console for new problems.
—Look for recently uploaded oversized images and optimise them.
Test your own contact form monthly. A silently broken form is the most expensive fault a business website can have, and it is invisible from the inside.
Quarterly: one hour
01Plugin audit. Remove anything you cannot justify in a sentence. Check the last-updated date on everything that remains and replace anything untouched for over a year.
02Database housekeeping: clear old post revisions, expired transients, spam and trashed comments. Backup first.
03Broken link scan, internal and external. Fix or remove.
04Check Search Console coverage for new crawl errors, 404s and indexing problems.
05Review your top ten pages: are the prices, dates, screenshots and claims still accurate?
06Review analytics for pages that have dropped, and check why.
07Confirm SSL renewal is automatic and the certificate is valid.
The plugin audit is the highest-value quarterly item. Sites accumulate plugins the way garages accumulate paint tins.
Annually: half a day
01Test a full restore from backup onto a staging site. This is the single most important item on the entire checklist and almost nobody does it.
02Review all licences and renewals: theme, plugins, hosting, domain. Confirm they are on a card that has not expired.
03Confirm the domain is registered in your own account, not a former developer's.
04Review hosting: is the tier still right, is the renewal price still reasonable, is response time still acceptable?
05Refresh your best content. Update figures, screenshots, examples and internal links on your top twenty pages.
06Review the site against your current business: are the services listed the ones you sell, are the prices current, is the About page still true?
07Check accessibility basics: contrast, keyboard navigation, form labels.
08Review your privacy policy against what you actually collect.
The domain ownership check catches a genuinely common and genuinely painful problem. Confirm it while nothing is wrong.
The update discipline
Updates are where most maintenance anxiety lives, so a policy removes the decision.
—Automatic updates on for core minor releases and for plugins you trust not to break layout.
—Manual updates for page builders, form plugins and anything touching layout or payments.
—Backup before manual updates. Every time.
—Staging for major version updates on any site that generates revenue.
—Front-end check afterwards, always.
—If an update breaks something, restore rather than debug under pressure. Investigate on staging.
What to do when something breaks
01Do not make more changes. Note exactly what you did last.
02If it followed an update, deactivate the plugin you just updated and see if the fault clears.
03Check the site with a default theme temporarily if the fault looks theme-related.
04Restore from the most recent backup if the site is down or serving errors to customers. Diagnose afterwards.
05Check the error log, which your host provides and almost nobody opens.
06Then reproduce on staging and fix properly.
Restore first, diagnose second, when the site is customer-facing. Debugging a live broken site to save fifteen minutes is a false economy.
Doing it yourself versus paying for it
The checklist above is around three hours a quarter, which most owners can do. Maintenance services charge £30 to £100 a month and are worth it when the site generates real revenue, when nobody in the business will reliably do it, or when downtime costs more than the fee.
What matters is that somebody specific owns it. Maintenance nobody is responsible for does not happen, and the first anyone notices is when a customer mentions the site has been down.
Frequently Asked Questions
How often should I update WordPress?
Weekly for available updates, with automatic updates handling core minor releases. Longer gaps are how known vulnerabilities get exploited.
Do I really need to test my contact form every month?
Yes. Forms break silently after plugin updates, host changes and email configuration changes, and a broken form costs you enquiries you never know existed.
Is a maintenance service worth paying for?
If your site generates revenue and nobody internally will do the routine, yes. £30 to £100 a month is less than one lost customer.
What is the most commonly skipped task?
Testing a restore from backup. Most people discover their backup does not work on the day they need it.
Should I update plugins automatically?
For most plugins, yes. Keep manual control over page builders, form plugins and anything touching payments, and check the front end afterwards.
How long does WordPress maintenance take?
Ten minutes weekly, thirty monthly, an hour quarterly and half a day annually. Around three hours a quarter in total.
Before You Go
The routine is dull and it prevents essentially every WordPress emergency I have been called about. Put the weekly and monthly items in the calendar as recurring events and assign them to a named person.
Then do the annual restore test. It is the one item on this list that people only value once, and by then it is too late. The security checklist covers the hardening side.
Calendar it. Test the restore.
WRITTEN BY TARIQ SALLAM
Marketing Consultant. Entrepreneur. Content Creator.
I'm a marketing consultant, entrepreneur and content creator. I help businesses grow through practical marketing, websites, SEO, content and AI.
More About Tariq →
Keep reading