The Complete WordPress Maintenance Checklist (169-Point Guide)

Last updated: August 2026

Keeping a WordPress website healthy is not a one-off job. It is a routine of small, regular tasks that stop your site being hacked, slowed down or broken by an update. This guide gives you the complete WordPress maintenance checklist, organised by how often each task needs doing, so nothing slips through the cracks.

CareWP is a Perth-based WordPress maintenance service that runs this exact checklist for businesses across Western Australia every month, so you do not have to.

Direct answer: what is a WordPress maintenance checklist?

A WordPress maintenance checklist is a structured list of recurring tasks that keep a website secure, fast and functional. It covers core, plugin and theme updates, backups, security scans, performance checks, database cleanup and uptime monitoring. Most sites need a mix of daily, weekly, monthly, quarterly and yearly tasks, totalling roughly one to two hours of work per month when done manually.

Why this checklist matters more after June 2026

If you needed proof that “I will get to it next month” is not a maintenance plan, June 2026 provided it. Security researchers tracked six separate WordPress plugin and theme vulnerabilities, each rated a critical CVSS 9.8, being actively exploited at the same time across a combined 1.14 million installations. One of the affected plugins, Kirki, had a flaw in its password reset function that let an attacker take over any admin account just by supplying their own email address. Another, in Everest Forms Pro, allowed unauthenticated remote code execution through a standard contact form field and was added to the US CISA Known Exploited Vulnerabilities catalogue within days. Even a premium, paid plugin, Gravity Forms, was hit by a supply chain compromise that planted backdoor admin accounts on affected sites before a fix shipped.

None of those six vulnerabilities required an unusual setup or an obscure plugin. They sat in tools that hundreds of thousands of ordinary WordPress sites already had installed and switched on.

That single month sits inside a much bigger trend. Patchstack’s State of WordPress Security in 2026 report logged 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42 percent jump on the year before, or more than 250 new flaws disclosed every week. Of those, 91 percent were found in plugins and 9 percent in themes, with only six reported in WordPress core itself. Highly exploitable vulnerabilities rose 113 percent year over year.

The patching gap is the real danger. Patchstack found that 46 percent of vulnerabilities disclosed in 2025 had no fix available from the developer at the moment they went public, and the median time from public disclosure to the first observed exploitation attempt was around five hours. Separate testing has found that standard hosting-level firewalls block only 12 to 26 percent of these attacks, meaning the gap is usually closed by someone actually applying the update, not by the server alone.

That short window is why a maintenance routine run on a fixed schedule, rather than whenever there is spare time, is the single most effective thing you can do to keep your site online and your customers’ data safe.

If you would rather hand the whole routine to a local team, CareWP manages it end to end for Perth businesses.

How to use this checklist

The checklist below is split into five sections by frequency: daily, weekly, monthly, quarterly and yearly. Work through each task in order. Where a task can be automated with a plugin or a managed service, treat that as the minimum, not the finish line. You do not need to do all 169 items by hand every time, but you do need a system that makes sure each one happens on schedule and someone checks the results.

Daily WordPress maintenance tasks

These tasks catch problems within hours rather than weeks. Most can and should be automated, but automated does not mean unattended.

1. Confirm the site is loading on desktop and mobile
2. Check uptime monitoring alerts from the past 24 hours
3. Review any security plugin alerts overnight
4. Run an automated malware scan
5. Check for failed login attempt spikes
6. Confirm the most recent automated backup completed
7. Verify the homepage renders with no broken layout
8. Load two or three key landing pages and check for errors
9. Confirm the checkout or enquiry form still submits
10. Check server resource alerts from your host
11. Review firewall and blocked IP logs
12. Scan for any new files added to the server unexpectedly
13. Confirm SSL certificate is valid and not expiring soon
14. Check email deliverability for transactional emails
15. Review new user registrations for spam accounts
16. Clear any urgent error notices in the WordPress dashboard
17. Confirm CDN is serving cached assets correctly
18. Check for any 500 or 502 server errors in logs
19. Monitor real-time traffic for unusual spikes, including AI crawler traffic
20. Note any plugin update notifications for the weekly review

Weekly WordPress maintenance tasks

Weekly work usually takes 20 to 30 minutes and is where most updates happen. Always test updates on a staging copy first, never straight on the live site.

1. Take a fresh full-site backup before any changes
2. Update WordPress core to the latest minor release
3. Update all plugins on a staging environment first
4. Update themes on staging before production
5. Test the live site after each batch of updates
6. Roll back any update that breaks functionality
7. Check and optimise overall page load speed
8. Run a broken link scan across the site
9. Fix or redirect any broken internal links
10. Clear the site cache after updates
11. Moderate and remove spam comments
12. Empty the trash for posts, pages and comments
13. Review new form submissions and enquiries
14. Check Google Search Console for crawl errors
15. Review Search Console for new manual actions or warnings
16. Cross-check newly disclosed CVEs against your active plugin and theme list
17. Deactivate and delete any unused plugins
18. Delete any unused themes except one default fallback
19. Review user accounts for unfamiliar logins
20. Confirm automated backups are still running and stored offsite
21. Check disk space usage on the server
22. Review 404 error logs and add redirects where needed
23. Test contact and booking forms end to end
24. Verify e-commerce payment gateway is processing test orders
25. Check mobile responsiveness on a real device
26. Review the security plugin’s weekly summary
27. Confirm two-factor authentication is active for admins
28. Update any plugin licence keys nearing expiry
29. Check that scheduled posts published correctly
30. Review website analytics for sudden traffic drops

Monthly WordPress maintenance tasks

Monthly maintenance adds around 45 minutes to an hour and focuses on deeper performance and database health.

1. Run a full performance audit with a speed testing tool
2. Optimise and compress new images uploaded that month
3. Clean up the WordPress database of overhead
4. Remove expired transients from the database
5. Delete post revisions beyond a sensible limit
6. Remove orphaned metadata and tables left by old plugins
7. Run a full malware and file integrity scan
8. Compare core files against a known good version
9. Review and tighten file and folder permissions
10. Audit user roles and remove unnecessary admin access
11. Reset or rotate passwords for shared accounts
12. Review and prune inactive user accounts
13. Test a full backup restore on a staging site
14. Confirm backups are stored in at least two locations, following the 3-2-1 rule
15. Review and renew hosting and domain if due
16. Check Core Web Vitals in Search Console
17. Audit the largest pages for render-blocking resources
18. Review and update the XML sitemap
19. Resubmit the sitemap to Search Console if changed
20. Check robots.txt for accidental blocking
21. Review redirects and remove redirect chains
22. Audit internal linking for orphan pages
23. Check for and fix mixed content warnings
24. Review and update any outdated content or pricing
25. Refresh meta titles and descriptions on key pages
26. Test the site on the latest browser versions
27. Review plugin and theme changelogs for major updates, including any flagged in the CISA Known Exploited Vulnerabilities catalogue
28. Check PHP version and plan any required upgrade
29. Review server error logs for recurring issues
30. Audit third-party scripts for performance impact
31. Confirm GDPR and Australian Privacy Act notices are current
32. Review cookie consent and privacy policy links
33. Check accessibility basics such as alt text and contrast
34. Review email signup and automation flows
35. Reconcile e-commerce orders and stock levels
36. Test the search function returns relevant results
37. Review comment and contact spam filtering effectiveness
38. Document any changes made during the month

Quarterly WordPress maintenance tasks

Every three months, step back and review the bigger picture of security, performance and strategy.

1. Conduct a full security audit of the site
2. Review all installed plugins for ongoing developer support
3. Replace any plugins that are no longer maintained
4. Review the theme for ongoing developer updates
5. Run a deep performance benchmark against competitors
6. Review and update the hosting plan if traffic has grown
7. Test full disaster recovery from a clean backup
8. Review the backup retention policy
9. Audit all admin and editor user accounts
10. Review API keys and integrations for unused access
11. Rotate critical passwords and application passwords
12. Review SSL and security headers configuration
13. Test the site under simulated high traffic
14. Review and update the content strategy
15. Audit top landing pages for conversion performance
16. Review and refresh older blog posts for accuracy
17. Update internal links to point to current content
18. Review schema markup and structured data
19. Check for duplicate content and canonical issues
20. Audit image alt text across the whole library
21. Review form conversion rates and fix friction points
22. Test all third-party integrations still function
23. Review payment gateway fees and settings
24. Confirm tax and shipping rules are current
25. Review the staging environment is in sync with production
26. Update documentation for site configuration
27. Review and test the incident response plan
28. Audit DNS records for accuracy
29. Review CDN configuration and cache rules
30. Check that all legal pages are current and linked
31. Review accessibility against WCAG guidelines
32. Plan major upgrades for the next quarter

Yearly WordPress maintenance tasks

These annual tasks keep your site modern and aligned with your business goals.

1. Conduct a comprehensive site-wide audit
2. Review overall site architecture and navigation
3. Evaluate whether the current theme still fits the brand
4. Plan any redesign or rebuild work needed
5. Renew domain registration well before expiry
6. Renew hosting and review the provider’s performance
7. Review and renew all plugin and theme licences
8. Reassess the hosting plan against current needs
9. Migrate to the latest supported PHP version
10. Review the entire plugin stack for consolidation
11. Remove long-term unused media from the library
12. Archive or delete outdated content
13. Conduct a full SEO audit of the site
14. Review keyword rankings and search visibility, including AI Overview and AI search citations
15. Refresh cornerstone content with current data
16. Review backlink profile for toxic links
17. Update the brand assets and logo files if changed
18. Review and refresh all photography and imagery
19. Conduct a full accessibility audit
20. Review compliance with the Australian Privacy Act
21. Update the privacy policy and terms of service
22. Review data retention and deletion practices
23. Test full disaster recovery from offsite backups
24. Review and update all admin contact details
25. Audit every user account and remove stale access
26. Review the security strategy against current threats
27. Penetration test or vulnerability scan the site
28. Review uptime statistics for the year
29. Benchmark annual performance trends
30. Review analytics goals and conversion tracking
31. Reassess Core Web Vitals performance over time
32. Review the content calendar for the year ahead
33. Set maintenance and security budgets for next year
34. Review the maintenance provider or plan
35. Document the full site setup and credentials securely
36. Review email hosting and deliverability
37. Test all automated workflows and integrations
38. Review e-commerce platform and plugin roadmap
39. Reassess third-party service contracts
40. Review insurance and liability for the website
41. Confirm all software is on supported versions
42. Plan for any major WordPress version migrations
43. Review the site’s mobile experience comprehensively
44. Reassess the goals the website is meant to achieve
45. Survey customers on website usability
46. Review competitor websites for new ideas
47. Update the maintenance checklist itself
48. Schedule the next year of maintenance tasks
49. Confirm someone is accountable for every task on this list

What this actually costs in Australia

Whether you run this checklist yourself or pay someone to, it has a real cost either way. Basic WordPress support in Australia starts from around $50 a month for light, reactive fixes. A proper managed care plan that covers the full checklist typically runs $169 to $500 a month for small business brochure sites, and $500 to $2,500 a month once you add e-commerce, higher traffic or compliance needs. Enterprise plans from larger Australian agencies can run several thousand dollars a month.

The cheaper end of the market usually means fewer tasks covered and slower response times. When comparing quotes, check exactly which of the 169 items above are actually included, how quickly a critical CVE like the ones seen in June gets patched, and how often, before comparing price alone.

Doing it yourself vs using a maintenance service

Run manually, this checklist takes a disciplined hour or two each month, plus the time to fix anything that breaks. The hard part is not the effort, it is the consistency. Miss a few weeks of updates during a busy season and your site is sitting exposed to whichever plugin ends up in the next wave of simultaneous critical vulnerabilities, unpatched.

A managed maintenance service handles the whole routine for you. CareWP is run by Perth-based engineers who test every update on a staging copy before it touches your live site, so an update can never break your site without warning. You get a dedicated engineer, transparent monthly reporting and no lock-in contracts.

CareWP plans start at $249 per month for Essential, $549 per month for Professional, and $1,290 per month for Enterprise. For sites that have already run into trouble, one-off malware removal is $499 and full site recovery is $1,497. You can compare what is included on the pricing page or get in touch to talk through what your site needs.

Frequently asked questions

How often should I update WordPress plugins?

Check for plugin updates at least weekly, and apply security updates as soon as they are released. With 91 percent of WordPress vulnerabilities found in plugins, and June 2026 showing six critical flaws exploited at once, delaying updates is the most common way sites get hacked. Always test updates on a staging copy first.

How long does WordPress maintenance take each month?

Done manually, regular WordPress maintenance takes roughly one to two hours per month. Weekly tasks take 20 to 30 minutes, monthly tasks add about an hour, and quarterly and yearly tasks are less frequent but more involved. Fixing problems when they occur adds extra time.

Can I automate WordPress maintenance?

Many tasks such as backups, uptime monitoring and malware scanning can be automated with plugins. However, updates still need testing, and database cleanup and performance audits need human judgement. A managed service like CareWP combines automation with engineer oversight for full coverage.

What happens if I skip WordPress maintenance?

Skipping maintenance leaves known vulnerabilities unpatched, and almost half of disclosed flaws have no fix ready when they go public. You also risk slow load times, broken features after updates, lost backups and search ranking drops. Most damage from neglect is far more expensive to fix than to prevent.

Do I need a maintenance plan for a small business website?

Yes. Small business sites are targeted just as often as large ones, because most attacks are automated and indiscriminate rather than targeted. A maintenance plan keeps your site secure, fast and online, protecting both your reputation and your customers’ data for a predictable monthly cost.

Keep your Perth website covered

This 169-point checklist is the same routine CareWP runs for clients across Perth and Western Australia every month. If you would rather spend your time on your business than on plugin updates and security scans, contact CareWP and let a local team take care of it.

Sources: Patchstack State of WordPress Security in 2026 report; WebPulse analysis of the June 2026 “Simultaneous Six” WordPress vulnerability wave (Wordfence, Patchstack, NVD, adyog.com); Australian WordPress maintenance market pricing surveys, 2026.