A Realistic WordPress Maintenance Routine: Weekly, Monthly and Quarterly

Most WordPress emergencies we see are not sophisticated attacks. They are a plugin left two years out of date, a backup that was never tested, or a PHP version that quietly stopped receiving security fixes. A routine you actually follow beats a perfect plan you do not.

Weekly: updates and a quick health check

• Review available updates for WordPress core, plugins and themes. Read changelogs for anything major before updating.
• Apply updates on staging first when the site handles payments or bookings, then on production.
• Open Tools → Site Health and read any new critical issues.
• Load the home page, a key landing page and your main form or checkout after updating.
• Confirm the latest backup completed.

Monthly: backups you have proven you can restore

A backup is only useful if it restores. Once a month, restore the latest backup to a staging environment and click through the site. Keep at least one copy off the hosting server, so that a problem with the host does not take your only backup with it.

While you are there, remove plugins and themes you no longer use. A deactivated plugin is still code on the server; deleting it removes the risk entirely.

Monthly: users and access

• Remove accounts for people who no longer need access, and downgrade roles where full administrator rights are not required.
• Make sure administrator accounts use strong, unique passwords and, where possible, two-factor authentication.
• Review who has access to hosting, DNS and the domain registrar — those accounts matter as much as WordPress logins.

Quarterly: the bigger questions

PHP version

Each PHP branch receives two years of active support followed by two years of security-only fixes. Check php.net’s supported versions page and plan upgrades before your version reaches end of life, testing on staging first.

Performance baseline

Re-test a few representative pages and compare with last quarter. A slow creep in page weight usually points to a new plugin, an embedded third-party script or unoptimised images.

Plugin review

Look at each active plugin and ask whether it is still needed, still maintained and still the best option. Our plugin selection checklist is a handy companion here.

Monitoring between checks

A schedule catches slow problems; monitoring catches sudden ones. At minimum, set up an external uptime check that alerts you when the home page stops responding, and make sure the alerts go to someone who will act on them. Keep PHP error logging enabled on the server (but not displayed to visitors) and glance at the log after every update.

For sites that depend on forms, send a test enquiry after updates and confirm it arrives where it should. A contact form that silently stops delivering email can cost more than a short outage.

Small hardening steps that pay off

• Disable the built-in theme and plugin file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
• Use SFTP or SSH rather than plain FTP, and keep hosting control-panel accounts protected with two-factor authentication.
• Make sure your SSL certificate renews automatically and that all pages redirect to HTTPS.

What to automate — and what not to

Automatic minor core updates and automated backups are sensible defaults for most sites. Fully automatic updates for every plugin are a judgement call: they close security holes quickly, but a broken update can land while nobody is watching. On sites where downtime costs money, we prefer scheduled, supervised updates with monitoring.

Write it down

Keep a simple log: date, what was updated, anything unusual. When something does break, that log turns an hour of guessing into a two-minute answer.