A monthly WordPress maintenance checklist

Most WordPress problems that feel sudden are not — they are the result of something small left unattended for months. A slow site, a hacked site, a broken update: nearly all of them are more survivable, and often entirely avoidable, on a site that gets checked over on a regular schedule rather than only when something has already gone wrong.

None of the individual tasks below take long. The value is in doing them consistently, not in any one of them being especially important on its own.

Updates

1. Review pending plugin and theme updates

   Check Dashboard → Updates and read what each update actually changes before applying it, particularly for anything central to the site — payments, forms, caching.

2. Take a backup before applying updates

   Every time, not just occasionally. See backing up a WordPress site.

3. Apply updates and check the site afterwards

   Load the front end and the admin area, not just the updates screen itself, to confirm nothing broke.

4. Check for a pending major WordPress release

   These do not install automatically. See how WordPress auto-updates actually work for why, and updating WordPress safely for the process.

Backups

• Confirm scheduled backups have actually been running, not just configured. A silently failing backup schedule is worse than no schedule, because you believe you are covered when you are not.
• Confirm at least one copy exists somewhere other than the hosting account itself.
• Every few months, actually restore a backup to a staging copy or subdomain to confirm it works. An untested backup is a belief, not a safeguard.

Database housekeeping

• Clear excess post revisions, expired transients, and spam comments.
• Empty the trash for posts, pages and comments.
• Optimise the database tables once the clutter is removed.

See cleaning up and optimising the WordPress database for the full process, including WP-CLI commands if you have SSH access.

Security checks

• Review the list of user accounts with admin access and remove anyone who no longer needs it.
• Check for plugins that have not been updated in a long time, or have been removed from the plugin directory entirely — both are warning signs worth acting on.
• Confirm two-factor authentication and a login attempt limit are both still active, not just set up once and forgotten.
• Run a malware scan if the site has one available, and review any alerts it has raised since the last check.

Comments and spam

• Review anything sitting in the moderation queue.
• Empty the spam comment queue rather than leaving it to grow indefinitely.
• Check that a spam-filtering plugin is still active and correctly configured.

Performance

• Load the site's key pages and note whether anything feels slower than last month.
• Check that any caching plugin is still active — a plugin conflict or update can sometimes disable it silently.
• Look for large, unoptimised images added since the last check, particularly in recently published content.

Broken links and content

• Spot-check a handful of internal and external links across the site for anything now broken.
• Check forms — contact, newsletter signup, anything collecting information — are still submitting and arriving correctly.
• If the site sells anything, place a test order or walk through checkout to confirm nothing in the purchase path has quietly broken.

Domain, SSL and hosting basics

• Check the SSL certificate is still valid and not close to expiring, particularly if it is not on automatic renewal.
• Confirm the domain itself is not approaching its renewal date and is not set to expire unexpectedly.
• Check disk space and other account usage in your control panel, since an account quietly filling up over months is the kind of thing nobody notices until an upload or a backup starts failing.

Once a year, go a little further

A handful of tasks are worth doing on a longer cycle than monthly, since they take more time and change less often between checks:

• Review every user account on the site, not just admins — contributors and editors who no longer need access accumulate the same way admin accounts do.
• Audit every active plugin against whether it is still needed, rather than just checking each one still works. A plugin installed for a campaign that ended a year ago is still running code on every page load.
• Reconsider the theme and any page builder in use against how the site's needs may have changed, rather than assuming the original choice is still the right one.
• Walk through the full disaster-recovery path once — confirm you know exactly how you would restore the site if the hosting account itself became unavailable, not just how you would restore a single file.

What this buys you

None of this prevents every possible problem, but it catches the slow, quiet ones — a failing backup, a forgotten plugin, a database quietly bloating — long before they turn into an emergency. A site maintained this way is also considerably faster to fix when something does go wrong, because you know it was in a known-good state as recently as last month rather than having no idea how long a problem has been building.