WordPress maintenance checklist: what to check every week, month and year

A WordPress site is not a brochure you print once. It runs code that changes every week: WordPress itself, your theme, your plugins and the server underneath. Most hacked business sites are not singled out: automated bots scan the web for outdated plugins and break in wherever they find one. The best defence is simply regular maintenance.

Here is the checklist we use, split by frequency. You can run it yourself or hand it to a provider.

Every week

• Check that backups ran. A backup you have never verified is a guess. Confirm the latest backup exists, is stored off the server and includes both files and the database.
• Review available updates. Note which plugins, themes and core updates are waiting, and read the changelog of anything major.
• Look at uptime alerts. If your monitoring tool reported downtime, find out why before it happens again.
• Test your main form. Send yourself a test request from the contact form. A broken form can cost weeks of leads before anyone notices.

Every month

Apply updates safely

Apply updates on a staging copy of the site first, check the key pages, then apply them to the live site. Turning on automatic updates without supervision is one of the most common causes of broken layouts and checkout errors: a single plugin conflict can take a page down.

Clean up plugins

Remove plugins you no longer use, even inactive ones: their code is still on the server. Replace plugins that have not been updated by their developer in over a year.

Check security

• Review administrator accounts. Remove former employees and contractors.
• Make sure two-factor authentication is on for every admin account.
• Scan for malware and unexpected file changes.
• Confirm your SSL certificate is valid and renews automatically.

Check speed

Run your homepage and one service page through Google PageSpeed Insights on mobile. If the scores drop, look at recently added plugins, images uploaded at full size or a new tracking script.

Fix broken links and errors

Use Google Search Console to spot pages that return errors (404) and fix or redirect them. Broken links frustrate visitors and waste the crawl budget Google gives your site.

Every year

• Restore a backup on a test server to prove it works.
• Review your hosting: PHP version, server resources, renewal price.
• Audit your forms and cookies against Law 25: consent before tracking, a current privacy policy and a named person in charge of personal information.
• Review who has access to your domain registrar, hosting, DNS and analytics accounts. Make sure the business, not a former supplier, owns them.
• Renew your domain for several years at once, with auto-renewal on.

If something goes wrong

Under Law 25, a confidentiality incident (for example, a breach that exposes client information collected through your site) must be recorded in an incident register. If it presents a risk of serious injury, you must notify the Commission d'accès à l'information and the people affected. Recent backups, update logs and access lists make that process much faster and much less stressful.

Do it yourself or delegate?

Running this checklist takes a few hours a month if everything goes well, and much longer when an update breaks something. If your site brings in leads or sales, a maintenance plan is usually cheaper than one bad week.

NeoLabs' WordPress maintenance plans cover tested updates on staging, daily backups, 24/7 monitoring and speed checks. Ask us for a free site health check.