A website that worked fine at launch can slowly fall apart if no one looks after it. Plugins go out of date. Backups quietly stop running. A contact form breaks and no one notices for weeks.
Most of these problems are easy to prevent. You just need a short list, a schedule, and a named person for each task.
This WordPress maintenance checklist is written for business owners and office managers, not developers. Use it to see what needs to happen, how often, and who should be responsible.
Why website maintenance matters
WordPress is popular, which is good news and bad news. There is a huge community behind it, and fixes for known problems come out regularly. But attackers also know which old versions and plugins have weak spots, and they scan for sites that have not been updated.
Slow pages, broken forms, and security warnings also cost you trust. A visitor who hits an error page does not know it was a plugin conflict. They just leave.
Regular care keeps the site working, protects customer information, and saves you from a rushed, stressful repair later.
Decide who owns each task first
Before the checklist, settle one question: who is responsible? Tasks without an owner do not get done. In many small businesses, everyone assumes the web developer, the hosting company, or “the IT person” is handling it, and no one is.
Here is a simple way to divide the work:
| Task | Typical owner |
|---|---|
| Content updates, forms, and page reviews | Office manager or marketing lead |
| Core, theme, and plugin updates | Web developer or IT provider |
| Backups and restore tests | Hosting company plus developer or IT provider |
| Security monitoring and malware scans | Developer, IT provider, or security partner |
| Uptime alerts | Developer or IT provider, with a backup contact in the office |
| User accounts and passwords | Business owner or office manager |
| Domain and SSL renewals | Business owner, with a calendar reminder |
Write the names down. Put the backup person next to each one, too, so a vacation or a resignation does not leave a gap.
Weekly tasks
1. Check for updates
WordPress has three parts that need updates: the core software, your theme, and your plugins. Updates often include security fixes, so waiting months is risky.
Look at the Updates area in your WordPress dashboard once a week. Update on a schedule instead of whenever a notice happens to catch your eye.
For a business site, a careful routine looks like this:
- Confirm a recent backup exists before you change anything.
- Update plugins and the theme first, then core, or follow your developer’s preferred order.
- Open the home page, a few key pages, and your main form to make sure nothing broke.
- If something looks wrong, restore the backup or contact your developer.
If your site takes orders, bookings, or payments, ask your developer to test major updates on a staging copy first. A staging site is a private copy of your website where changes can be tried safely.
2. Remove what you do not use
Every plugin and theme you leave installed is one more thing that needs updates. If a plugin is turned off and you do not need it, delete it. The same goes for old themes you will never use. Keep one default theme as a fallback if your developer recommends it.
3. Look at security and uptime alerts
If you have a security plugin or a monitoring service, read its weekly summary. You are looking for repeated failed logins, new admin users you do not recognize, or warnings about outdated software. Do not ignore alerts just because the site still loads.
Backups: the item people skip
A backup is only useful if it works. Many site owners find out their backups were incomplete on the worst possible day.
What a good backup setup includes
- Both files and database. Your pages, posts, and settings live in the database. Images, themes, and plugins are files. You need both.
- Offsite storage. Do not keep the only copy on the same server as the website. If that server fails or is compromised, the backup goes with it.
- A schedule that fits your site. A site that rarely changes can back up less often. A site with daily orders, bookings, or form entries needs more frequent backups. Ask your host or developer what is set up today.
- More than one restore point. Keep several recent copies, not just the latest one. If a problem went unnoticed for a few days, you will want an older clean version.
Test a restore
Once a quarter, have your developer or host restore a backup to a test location and confirm it opens correctly. This is the only real proof that the backup works. Put it on the calendar, and note who did it and when.
Security checklist
You do not need to be a security expert, but a few habits cover most of the basics.
- Use strong, unique passwords. Every person who logs in should have their own account. Never share one admin login.
- Turn on two-step login for admin accounts if your setup supports it.
- Review user accounts every few months. Remove former employees, old contractors, and anyone who no longer needs access. Give people the lowest level of access that lets them do their job.
- Use a reputable security plugin or service to scan for malware and block suspicious login attempts. Your developer or IT provider can help choose one and set it up.
- Make sure your site uses HTTPS. Your SSL certificate needs to renew on time. An expired one triggers browser warnings that scare visitors away.
- Keep your hosting account secure. A strong WordPress login does not help much if the hosting or domain account has a weak password.
If you want an outside view of your overall risk, not just your website, a cybersecurity assessment can help point out gaps across your accounts, devices, and network.
Uptime and performance checks
Uptime monitoring
An uptime monitor checks your site every few minutes and alerts you if it goes down. Many hosting companies and third-party tools offer this. Make sure alerts go to at least two people, and that one of them is not the person who built the site years ago and no longer works with you.
Speed checks
Once a month, run your home page and a couple of key pages through a free speed testing tool, such as Google’s PageSpeed Insights. You do not need a perfect score. Watch for big changes, because a sudden slowdown often points to a new plugin, an oversized image, or a hosting issue.
Common fixes include:
- Compressing large images before uploading them
- Using a caching setup recommended by your host or developer
- Removing plugins you no longer use
- Moving to a better hosting plan if the site has outgrown its current one
Monthly business checks
These are the tasks the office manager can usually own, with no technical skill needed.
- Test every form. Submit your contact form, quote request, or booking form and confirm the message arrives. Also check your spam folder. Form emails fail more often than you would expect.
- Click through your main pages on a phone and on a computer. Check menus, buttons, phone numbers, and addresses.
- Check links. Look for broken links, especially to pages you moved or deleted.
- Review your content. Update hours, staff names, service areas, and offers. Fix outdated details such as the copyright year in your footer.
- Ask someone outside the company to try the site. A fresh set of eyes spots confusing steps you no longer notice.
Yearly tasks
- Confirm your domain name registration and set it to renew automatically if possible.
- Check who has the login for your domain, hosting, and website, and make sure the business owns those accounts.
- Review your hosting plan to see if it still fits your traffic and needs.
- Look at your theme and plugins and decide whether any should be replaced because they are no longer supported.
- Re-read the whole site for accuracy, from services to legal pages and privacy policy.
A simple schedule you can copy
- Weekly: Updates, alerts, and a quick look at the site.
- Monthly: Form tests, link checks, speed test, and content review.
- Quarterly: Backup restore test and user account review.
- Yearly: Domain, hosting, SSL, and full site review.
When to hand it off
If this list feels like a lot, that is normal. Many small businesses do the monthly business checks in house and hand the technical work to a professional. That might be your web developer, your hosting company’s care plan, or a managed IT provider.
Through our IT partners, we can arrange managed IT services for businesses that would rather not juggle updates, monitoring, and security on their own. Whoever you choose, ask them to put in writing what they handle, how often, and how they report back to you.
The goal is simple: no task without an owner, and no surprise when something needs attention.
Frequently asked questions
How often should I do WordPress maintenance?
Check for updates and alerts weekly, test forms and review content monthly, test a backup restore and review user accounts quarterly, and check your domain, hosting, and SSL once a year. A busy site, such as one that takes orders, may need closer attention than a simple brochure site.
Who should be responsible for maintaining a business WordPress site?
Split it by skill. An office manager can handle content, forms, and user accounts. A web developer, hosting company, or IT provider should handle updates, backups, and security. The owner should hold the domain and hosting logins. Name one person and a backup for every task.
Do I need a security plugin for WordPress?
Most business sites benefit from one, since it can scan for malware and block suspicious logins. But a plugin is only part of the picture. You also need timely updates, strong passwords, limited user access, and good backups. Ask your developer or IT provider which setup suits your site.
How do I know my WordPress backups actually work?
Test them. Have your developer or host restore a recent backup to a test location and confirm the pages, images, and forms work. Do this about once a quarter. Also confirm that backups include both files and the database, and that a copy is stored away from your web server.