Use this free WordPress maintenance checklist to keep your site updated, backed up and working. Tick tasks as you go: the progress bar shows how far you are, and your ticks are saved only in this browser on this device. Nothing is sent to us. Use Print checklist for a paper copy.
Backups need checking, not just scheduling. A backup job that reports success can still be incomplete. The monthly and quarterly tasks include a quick verification and a staging restore, because that is the only way to know a backup will work when you need it.
0 of 21 done
Print checklist Reset
Every week (about 10 minutes) Open the site while logged out Use a private window. Check the home page, your most visited posts and any page that earns money or leads. Review available updates Dashboard → Updates. Note major version changes and read changelogs before updating complex plugins. See our auto-updates policy . Confirm the latest backup completed Check the date and size in your backup tool or hosting panel. A backup that is suddenly much smaller is a warning sign. Check uptime alerts If you use an uptime monitor, review any downtime alerts and their times. Every month (about 45 minutes) Apply plugin, theme and core updates Test stores, page builders and membership plugins on staging first, then update the live site. Verify a backup instead of assuming it worked Open the archive, confirm the uploads folder is there and compare the database table count. Our backup guide shows how. Review administrator accounts Users → All Users, filter by Administrator. Remove accounts you do not recognise or no longer need. See unknown admin users . Test important forms and email Submit the contact form and a password reset, and confirm the emails arrive and are not in spam. Check Tools → Site Health Read critical issues first. Some recommendations may not apply to your setup. See loopback and REST API errors . Check key pages for broken links Click through navigation, buttons and the links in your top articles. Measure speed on two pages Run PageSpeed Insights on the home page and one article and compare with last month. See slow site diagnosis . Check HTTPS and the certificate expiry date Click the padlock in the browser. Look for mixed content warnings in the Console. See mixed content . Every quarter (1 to 2 hours) Test-restore a backup on staging Restore a recent backup to a staging or local copy and check logins, pages, images and forms. Never test a restore over the live site. Delete unused plugins and themes Deactivated code can still contain vulnerabilities. Keep one default theme as a fallback. Review the PHP version Tools → Site Health → Info → Server. Plan upgrades from unsupported versions and test on staging. See upgrading PHP safely . Database housekeeping, after a backup Review large autoloaded options and old data left by removed plugins. See autoloaded options and database cleanup . Check disk space and old backup files Remove old backup archives stored on the web server once they are safely stored elsewhere. Review integrations and application passwords Users → Profile → Application Passwords, plus API keys in plugin settings. Revoke anything unused. Recovery plan (review once a year) Write down where backups are and how to restore Include which tool, which account and roughly how long a restore takes. Keep hosting, domain and DNS logins secure Store them in a password manager with multifactor authentication enabled. Know who to contact Note your host’s support channel and any developer you work with, plus your domain registrar. How to use this checklist
The timings are a starting point for a typical small business site or blog. A busy online shop may need daily backups and more frequent update checks, while a small site that rarely changes can stretch some tasks. Adjust the schedule to how much you could afford to lose.
If something on the list fails, start with the matching guide:
This checklist does not scan or change your website. It is a list of tasks for you or your developer to carry out.
