A website maintenance checklist only works if someone actually follows it every month. Most small business websites do not fail because of one big disaster — they fail slowly, from small things nobody checked: an outdated plugin, an expired SSL certificate, a backup that silently stopped running months ago.
This website maintenance checklist breaks the work into what to check weekly, monthly, quarterly, and once a year, so nothing important gets missed and nothing gets checked more often than it actually needs to be.
How to Actually Use This Checklist
A checklist only helps if it is tied to a specific day, not a vague intention to get to it eventually. Pick one recurring calendar reminder for the weekly items, one for the monthly batch, and one for the quarterly review. Assign it to a specific person, even on a small team of two — a task that belongs to everyone tends to belong to no one. If a website generates real income for the business, treat the monthly checks with the same seriousness as paying a recurring bill.
Weekly Checks
- Confirm the last automated backup actually completed — do not just assume the backup plugin is running silently in the background
- Scan for new comment spam and delete or approve as needed
- Check uptime monitoring for any downtime alerts from the past week
- Glance at Google Search Console for new security or manual action warnings
Monthly Checks
- Update WordPress core, plugins, and themes — after taking a full backup, and ideally testing on a staging copy first
- Run a full malware and security scan
- Check page speed on both mobile and desktop using Google PageSpeed Insights
- Test every contact form and checkout flow end to end — a broken form can go unnoticed for weeks with nobody reporting it
- Check for broken internal and outbound links
- Review 404 error logs and set up redirects for any real traffic still hitting dead pages
- Clean up spam comments and unused media files taking up storage
- Review the site on a real mobile device, not just a browser dev-tools simulation
Quarterly Checks
- Run a full database optimisation — clear out post revisions, expired transients, and orphaned data left behind by uninstalled plugins
- Review every installed plugin and remove anything no longer in active use — inactive plugins are still a security risk even when disabled
- Check SSL certificate expiry and confirm auto-renewal is actually configured, not assumed
- Review user accounts and remove access for anyone who no longer needs it
- Test the backup by actually restoring it somewhere — a backup file that exists but has never been restored is unverified, not safe
- Check domain and hosting renewal dates so nothing lapses unexpectedly
Annual Checks
- Review the hosting plan against current traffic — what worked two years ago may now be undersized for a busier site, or oversized for one that never grew
- Audit overall site content for anything outdated, discontinued, or no longer accurate
- Reassess whether the current maintenance routine actually matches how critical the website has become to the business
Tools That Make This Easier
Dozens of plugins are not required to cover this checklist. UpdraftPlus or Duplicator handle backups. Wordfence or Solid Security cover malware scanning and login protection. Google PageSpeed Insights and GTmetrix cover performance checks. Uptime Robot or a similar free monitor sends an alert the moment a site goes down. The checklist matters more than the specific tool — pick one for each job, configure it once, and actually check its results on schedule rather than assuming it is working correctly forever.
What Happens If This Gets Skipped?
Nothing happens immediately — that is exactly the problem. An outdated plugin can sit quietly for months before it becomes the exact vulnerability an automated bot exploits. A backup that silently failed is invisible right up until the moment it is actually needed, usually during an emergency. Most of the urgent WordPress fixes we get called in for started as a checklist item nobody had time to check for three or four months in a row.
Prefer not to run this checklist personally every month? Our website maintenance services handle all of it — backups, updates, security scans, and a monthly report — so nothing on this list ever gets missed. Get in touch to see what is included.