WordPress powers a huge share of the web, and that popularity is exactly why it needs regular care: plugins update constantly, and outdated sites are the main target of automated attacks. The bots doing the attacking don't take weekends off, and they don't care that you're "a small business, who'd bother?"
A WordPress site is less like a printed brochure and more like a car. Nobody expects a car to run for five years without an oil change, yet plenty of websites are quietly running plugins that were last updated around the time you bought the phone you've since replaced twice. This checklist is what a professional care plan covers. Use it to look after your own site, or to check what your developer actually does.
Before anything else: make sure you have a working, off-site backup and know how to restore it. Every other task is safer with one.
- Check backups ran
- Update plugins and themes
- Security updates on
- Test the contact form
- Scan for malware
- Speed test
- Search Console check
- Delete unused plugins
- Review admin users
- Uptime reports
- Clean the database
- Fix broken links
- Test a full restore
- Check PHP version
- Update prices, hours, offers
- Review GA4 conversions
- Domain and SSL auto-renew
- Review licenses
- Refresh top pages
- Accessibility check
- Refresh or redesign?
Weekly Tasks (15 Minutes)
- Check backups ran. Daily automated backups stored off the server (e.g. cloud storage), kept for at least 30 days.
- Update plugins and themes. Update on a staging copy first if your host offers one, or one at a time on live, checking the site after each. Not all 23 at once at 11pm on a Friday. Ask anyone who has.
- Apply WordPress minor (security) updates. These are usually automatic. Make sure they are.
- Test your contact form. Send a test inquiry. Broken forms are the most common silent failure, and "silent" is the scary part: the site looks fine, the phone just mysteriously stops ringing.
- Scan for malware. Use a security plugin or your host's scanner.
Monthly Tasks (1 Hour)
- Run a speed test (PageSpeed Insights) on the homepage and your top page. Watch LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1.
- Review Search Console: coverage errors, manual actions, security issues and Core Web Vitals.
- Remove unused plugins and themes. Deactivated isn't enough. Delete them. That slideshow plugin from 2021 is not coming back into fashion.
- Review admin users. Remove old accounts, check roles, enforce strong passwords and 2FA. If "intern2019" still has admin rights, today's the day.
- Check uptime reports and fix recurring downtime (often a hosting problem).
- Clean the database: spam comments, post revisions, expired transients.
- Fix broken links and 404s reported in Search Console.
Quarterly Tasks
- Test a full restore from backup on a staging site. A backup you've never restored is a hope, not a plan.
- Check PHP version with your host and upgrade to a supported version.
- Update key content: prices, opening hours, team, offers and service areas. Customers notice when the "new" offer expired two summers ago.
- Review conversions in GA4: which pages bring inquiries, and which don't.
Yearly Tasks
- Renew the domain (turn on auto-renew) and check the SSL certificate is auto-renewing.
- Review licenses for premium plugins and themes.
- Refresh your top pages and cost/pricing content with the current year's information.
- Do an accessibility check: color contrast, focus states, form labels and alt text.
- Decide whether the site needs a refresh or a redesign.
Signs Something Is Already Wrong
- Visitors are redirected to spam sites, or Google shows "This site may be hacked".
- Your host suspends the account or sends malware warnings.
- New admin users you didn't create.
- A sudden drop in traffic or a spike in strange pages indexed in Google.
If you see any of these, act quickly, and resist the urge to just "turn it off and on again": see WordPress malware removal.
DIY or Care Plan?
If you're comfortable with the tasks above and will actually do them every week, DIY is fine. Be honest about the "actually" part. Most business owners would rather spend that time on their business. That's what WordPress care plans are for: from $29/month for updates, daily backups, monitoring and a monthly report, with higher plans adding edits and priority fixes. If your site is slow as well as unmaintained, start with speed optimization.
Frequently Asked Questions
How Often Should WordPress Be Updated?
Check weekly. Security releases should be applied within days; plugin updates weekly after a quick test.
Can Updates Break My Site?
Occasionally, usually from plugin conflicts. That's why you update with a fresh backup, ideally on staging first. Not updating breaks sites too; it just takes longer and ends worse.
How Much Does WordPress Maintenance Cost?
Typically $29–$150 per month depending on what's included. See small business website costs for the full picture.