Maintenance without a checklist is just hoping things work. Here’s the routine we run on every site under our care plan – adapted so any site owner or developer can follow it independently.
Weekly tasks: Check for plugin, theme and core updates. Before applying any update on a live site, push it to a staging environment. Verify critical page functionality (forms, checkout, login) after updates deploy. Confirm your uptime monitor reported zero downtime events. Check your security plugin’s scan results for new alerts.
Monthly tasks: Run a full malware scan and review the firewall log for any spike in blocked requests – a sudden jump often signals a coordinated attack. Test your backup restore process by spinning up the most recent backup in a staging environment and clicking through key user journeys. Review Google Search Console for any new crawl errors, manual actions or Core Web Vitals regressions. Run a Lighthouse audit and compare scores to last month. Clear and rebuild your database – remove post revisions older than 30 days, clear transients, optimize tables. Check for any PHP deprecation notices in your error log; these are next month’s fatal errors.
Quarterly tasks: Audit all user accounts – remove any that no longer need access and reset passwords for any administrator accounts that haven’t been changed in 90+ days. Review your SSL certificate expiry and renew if within 60 days. Update your DNS TTLs if you’re planning any upcoming migrations. Test your emergency contact and incident response process: do you know who to call if your site goes down at midnight?
Running through this list consistently takes about two hours per site per month. Skipping it takes about 20 hours to recover from – if you’re lucky.
