Websites fail slowly, then suddenly. The form that stopped sending in March gets noticed in June; the plugin unpatched since winter becomes the hack in spring. Maintenance is the boring work that prevents expensive weeks — here’s all of it, organized by frequency. Use this as your own routine or as the measuring stick for whoever you’re paying.
Nobody notices website maintenance until it stops happening.
Weekly: the five-minute pulse check
Verify backups actually ran. Not “backups are configured” — open the backup location and confirm this week’s files exist. Backup systems fail silently, and discovering that during a crisis is the worst possible time.
Submit your own contact form. Send a test through every form that matters and confirm it arrives. WordPress email breaks quietly — a hosting change, an SMTP token expiring — and every silent day is lost leads.
Scan the homepage and key pages. Thirty seconds of looking: layout intact, images loading, nothing injected that shouldn’t be there.
Monthly: the real work
Updates — with a safety net
Update WordPress core, themes, and plugins, but never blind: back up first, update, then check the site. On sites where downtime costs money, test updates on a staging copy first. Delete deactivated plugins entirely — inactive code is still attackable code, a point WordPress’s own hardening guide makes explicitly.
Security review
Run a malware scan, review the user list for accounts that shouldn’t exist, and confirm admin accounts use strong passwords and, ideally, two-factor. Most hacked WordPress sites are breached by bots exploiting an unpatched plugin — not by anyone targeting you specifically. Boring diligence is the entire defense.
Performance spot-check
Run PageSpeed Insights on your homepage and best-selling page. Speed decays as content and plugins accumulate; catching a slide early is a small fix instead of a full rescue.
Quarterly: step back and look
Restore a backup — for real. Once a quarter, actually restore a backup to a staging environment. A backup you’ve never restored is a hope, not a plan.
Content audit. Prices, team members, service claims, the copyright year in the footer — outdated details quietly tell visitors nobody’s home.
Search Console review. Check Coverage for crawl errors and the Performance report for pages that slipped. Ten minutes here catches SEO problems while they’re still small.
Broken link crawl. Links rot — pages you linked to move or die. A quarterly crawl keeps both visitors and Google from hitting dead ends.
Yearly: the strategic pass
Renew the domain (set it to auto-renew and check the payment card anyway — expired domains kill businesses for days), confirm SSL renewal is automated, review hosting fit, and honestly assess whether the site still represents the business. Most sites need a proper refresh every 3–4 years; the yearly review is where you see it coming instead of being surprised.
Do it yourself or hand it off?
Everything above is doable by a careful owner with 2–3 hours a month and the discipline to never skip it. The discipline is the hard part — maintenance is the first thing busy months delete. If it keeps not happening, that’s the honest signal to hand it off: my maintenance service runs this exact checklist from $99/month, with small fixes included and a real developer answering instead of a ticket queue.