WordPress maintenance checklist: what to do every week, month, quarter and year

Go to Dashboard, then Updates. Take a backup, update one thing at a time, and look at the site after each one. The full method, including how to go back when an update breaks something, is in how to safely update WordPress.

Fine looks like: the Updates screen lists nothing waiting, and the site works as it did before.

Open the home page and the two or three pages that bring in work, in a private browser window so that you are logged out. Do the same on a phone.

Fine looks like: every page loads, nothing has moved or lost its styling, and the browser shows no warning. If you see an error in place of a page, find it among the WordPress error fixes.

Open your backup plugin's list of backups, or the backup section of your hosting panel. Read the date of the newest one.

Fine looks like: the newest backup is as recent as your schedule says it should be, it holds both the database and the files, and it is stored somewhere other than the site's own server. If it is older than it should be, the schedule has stopped. Fix that before anything else on this list. If you have no backups yet, see WordPress backup plugins compared.

Restore the newest backup to a private copy of the site, never over the live site as a test. How to set up a WordPress staging site covers making the copy.

Fine looks like: the restored copy loads, you can log in, a post or an order from the past few days is there, and images display. Note how long it took. That is how long the site would be down on a bad day.

Go to Users. The links above the table filter the list by role. Look at the administrators first, then at everyone else.

Fine looks like: every account belongs to a person you can name who still needs it, at the lowest role that lets them do their work.

To remove someone, select Delete under their username. WordPress asks what to do with the content that person owns. Choose to attribute it to another user, then select "Confirm Deletion". The other choice deletes their posts along with the account.

An administrator nobody recognizes is a sign of a break-in. Treat it as one: how to remove malware from a hacked WordPress site. The rest of keeping accounts safe is in the WordPress security guide.

Fill in each form on the site the way a visitor would and check that the message reaches your inbox. A form can show its thank-you message while the email goes nowhere. On a store, add a product to the cart and go through checkout as far as the payment step, without paying. Then open the most recent paid order under WooCommerce, then Orders. To test a payment itself, use a staging copy with the payment method in its test mode, which is where WooCommerce's guide to test orders says test payments belong. Before paying on the live store with your own card, read your payment provider's rules: Stripe's testing documentation says its services agreement prohibits testing in live mode using real payment method details.

Fine looks like: each message arrives within a few minutes, in the inbox and not in spam. On a store, the checkout shows its payment fields, and the most recent paid order is "Processing", the status WooCommerce gives once payment is received, or has moved on to "Completed". If not, see WordPress not sending email or WooCommerce checkout not working.

Go to Tools, then Site Health. The Status tab sorts what WordPress has checked into critical issues, recommended improvements and passed tests. Critical issues are possible security holes or serious performance problems, and each comes with a suggested fix.

Fine looks like: no critical issues, and no recommended improvement you have not read and decided about.

Go to Comments and select the Spam link above the table. "Empty Spam" permanently deletes every comment marked as spam.

Fine looks like: the Spam list is empty and nothing in Pending has waited more than a few days.

Old revisions rarely need clearing. WordPress keeps a record of each saved draft and each published update, with no limit by default and no screen for deleting them. They matter only once the database has grown large, which you can read under "Directories and Sizes" on Site Health's Info tab. To cap how many are kept, add this line to wp-config.php, above the line that says "That's all, stop editing". WordPress then removes the older ones the next time each post is updated.

define( 'WP_POST_REVISIONS', 10 );

A plugin that is switched off is still on the server and still has to be kept up to date. On the Plugins screen, go through the list. For each plugin nobody uses, select "Deactivate" if it is active, then "Delete". Deleting a plugin can remove its settings too, so take a backup first.

For themes, go to Appearance, then Themes, open "Theme Details" on a theme you do not use, and select "Delete". WordPress's own guidance is to remove inactive themes you do not plan to use. Keep your active theme, its parent if it has one, and one default theme to switch to when you are tracking down a fault.

Fine looks like: no inactive plugins, and no inactive themes beyond that one spare.

PHP is the language WordPress is written in, and your host decides which version your site runs on. When the version is too old, Site Health reports "Your site is running an outdated version of PHP, which requires an update" as a critical issue. WordPress recommends PHP 8.3 or greater. Its requirements page says the older versions it still runs on have reached their end of life and may expose a site to security vulnerabilities.

The version is changed in your hosting panel, not in WordPress. An old plugin or theme can fail on a newer PHP, so take a backup first and try the change on a staging copy if you have one. If the site shows a critical error afterwards, set the version back in the hosting panel and see how to fix the white screen of death.

Fine looks like: Site Health raises nothing about PHP, and the version meets what WordPress recommends.

Run the home page and one or two pages that matter through Google's PageSpeed Insights and write the numbers down. Where enough real visits have been recorded, it reports how the page loaded for actual visitors.

Fine looks like: the Core Web Vitals assessment passes. That means the largest element appears within 2.5 seconds, the page responds to a tap or click within 200 milliseconds, and the layout shift score is 0.1 or less. The score from its own test load changes from one run to the next, so compare with last quarter's numbers and do not chase a point or two.

If the numbers have slipped, start with what was added since the last check: a plugin, a slider, larger images, a tracking script.

Log in at the company your domain is registered with and read the expiration date. Check that automatic renewal is on, that the payment card on file is still valid, and that the contact email is one you read, because renewal reminders go there. A domain that is not renewed takes the website and its email down with it.

Then open the SSL section of your hosting panel and read the date the certificate expires. Where the host renews it automatically, a date that has moved forward since last quarter tells you the renewal is working.

Fine looks like: both dates are comfortably in the future, or set to renew with a valid card. An expired certificate puts a full-page browser warning in front of the site: see Your connection is not private.

List every account the site depends on: hosting, the domain registrar, DNS if it is somewhere else, backup storage and each paid plugin or theme. Log in to each one.

Fine looks like: each account is in the name of the business, not of a past developer or employee, with an email address someone reads.

Then go to Settings, then General and read "Administration Email Address". WordPress sends its recovery mode and critical error notices there, so it must be an address your organization can open. When you change it, WordPress emails the new address, and the change takes effect once the link in that message is followed.

Updates for a paid plugin or theme come through its author's license system. Check that each license is current for what you still use, and cancel what you do not.

Go to Settings, then Privacy to see which page is your privacy policy, and reread it. WordPress leaves it to you to keep that page current and accurate. Compare it with what the site collects now: a new form, an analytics tool, a plugin added during the year.

Open "Directories and Sizes" on Site Health's Info tab and compare the total installation size with the disk space your hosting plan allows.

Fine looks like: licenses current, a policy that names everything the site collects, and room to grow on the hosting plan.