A Monthly WordPress Maintenance Checklist You Can Finish in an Hour
Most WordPress emergencies are maintenance that was skipped. An hour a month covers nearly all of it, and the order below puts the highest-value checks first so a shortened session still does the important parts.
The short version
- Backups first, and verify one actually restores.
- Updates second, through staging.
- Everything after that is optimisation and can be skipped under time pressure.
Backups (15 minutes)
- Confirm the last seven daily backups exist and are the expected size.
- Download one off-server. A backup on the same server as the site is not a backup.
- Once a quarter, restore one to staging and log in. This is the only way to know the backup works.
Updates (20 minutes)
- Refresh staging from production.
- Apply pending plugin, theme and core updates on staging.
- Walk the critical paths: home, a post, an archive, search, the main form, login.
- Repeat on production and walk them again.
Security (10 minutes)
- Review the user list. Remove accounts for people who have left, and downgrade anyone who does not need administrator.
- Check that no new administrator accounts appeared that you did not create.
- Confirm SSL is valid and not approaching expiry.
- Scan the error log for repeated 404s on suspicious paths, which indicate active probing.
Performance (10 minutes)
- Run the home page and one post through a Core Web Vitals check.
- Compare to last month. You are looking for drift, not a perfect score.
- Check that caching is actually serving cached pages.
- Review the ten largest images uploaded this month.
Content and links (5 minutes)
- Run a broken-link check and fix internal ones. External rot is normal and lower priority.
- Check Search Console for new coverage errors.
- Look at the top ten pages by traffic and confirm none of them look broken.
Database (quarterly, not monthly)
Post revisions, spam comments, expired transients and orphaned metadata accumulate. Cleaning them monthly is unnecessary on most sites; quarterly is enough, and it should always be preceded by a backup.
Watch out
Database optimisation plugins that offer to delete “unused” tables are the most common cause of self-inflicted damage. They cannot reliably tell which tables a plugin still needs. Leave tables alone unless you know what created them.
| Task | Frequency | Time |
|---|---|---|
| Verify backups exist | Monthly | 5 min |
| Test-restore a backup | Quarterly | 20 min |
| Updates via staging | Monthly | 20 min |
| User audit | Monthly | 5 min |
| Core Web Vitals check | Monthly | 10 min |
| Broken links | Monthly | 5 min |
| Database cleanup | Quarterly | 15 min |
Common questions
Can I automate all of this?
Backups, monitoring and core minor updates, yes. The checks that require judgement — did this update break something, is this new admin account mine — do not automate well.
What if I have twenty sites?
Then you need a management dashboard and a fixed day each month. The per-site time drops a lot once the routine is the same everywhere.
Is an hour a month really enough?
For a stable site with a reasonable plugin list, yes. A site with heavy traffic, e-commerce or many editors needs more.
Sumit
Writes everything on TechMozz.