The WordPress Maintenance Checklist Every Site Owner Should Follow in 2026

WordPress runs a huge share of the internet. It powers more than 40% of all websites, which is exactly why attackers spend so much time probing it. When a site gets compromised, an outdated plugin is usually the way in. Patchstack and Wordfence both report that plugin vulnerabilities, not WordPress core itself, account for the large majority of exploited entry points each year.

That single fact is the reason this checklist exists. A WordPress site is not a “set and forget” asset. Core, themes and plugins ship updates constantly, the database fills with junk, and PHP versions age out of support. Skip the upkeep and you eventually pay for it with a hacked site, a slow one, or a checkout that quietly stopped working three weeks ago.

Below is a frequency-based checklist you can actually run, plus a tools table, honest DIY versus managed cost bands in AUD, and answers to the questions we hear most often at MediaPlus Digital.

If you run something other than WordPress, or you want the platform-agnostic version that covers hosting, DNS and email as well, read our general website maintenance checklist as the companion to this one. This article stays firmly inside WordPress.

Why WordPress needs more upkeep than most platforms

Hosted platforms like Shopify or Squarespace patch themselves in the background. WordPress does not work that way. Its strength is openness: thousands of plugins and themes from thousands of developers. That same openness means the security and stability of your site depends on code you did not write and cannot see changing under you.

Three things make regular maintenance non-negotiable:

• Security. Every plugin and theme is a potential door. A plugin you installed two years ago and forgot about can carry a vulnerability that gets patched upstream while your copy stays exposed.
• Performance. WordPress leans on a MySQL database that bloats over time with post revisions, spam, transients and orphaned metadata. Left alone, queries slow down and so does your site. Slow pages hurt your Core Web Vitals, which Google uses as a ranking signal.
• Compatibility. PHP, WordPress core, your theme and your plugins all move on their own schedules. When they drift too far apart, things break: a checkout button stops firing, a form stops sending, the block editor throws an error.

Maintenance is how you keep those three under control without a crisis forcing your hand.

Before anything else: back up and use staging

Two habits sit underneath every task in this checklist.

Back up before you touch anything. Updates fail. Plugins conflict. People fat-finger a setting. A recent, tested off-site backup is the difference between a five-minute restore and a lost weekend. UpdraftPlus, BackWPup and Duplicator all do this well, and most quality hosts run daily backups too. Do not trust a backup you have never restored. Test a restore at least once a quarter.

Test updates on staging, not production. A staging site is a private copy of your live site where you apply updates first, click through the important pages, then push the changes live once you know nothing broke. Most managed WordPress hosts (Kinsta, WP Engine, SiteGround and others) give you one-click staging. For a WooCommerce store or any site earning real money, staging is not optional. Updating plugins straight on a live checkout is how you find out the hard way that two of them no longer get along.

The WordPress maintenance checklist by frequency

Match the effort to the site. A small brochure site can relax the weekly items into fortnightly ones. A busy WooCommerce store or a membership site should tighten the cadence, because every hour of a broken checkout is lost revenue.

Weekly tasks

Task	Why it matters
Update WordPress core, plugins and themes (on staging first)	Closes known security holes; most exploits target outdated code
Run a security scan (Wordfence or Sucuri)	Catches malware and file changes early
Check the site is up and loading	Uptime tools like UptimeRobot alert you before customers do
Moderate and clear spam comments	Keeps the database lean and the site tidy
Confirm the latest backup ran and is off-site	A backup on the same server is not a backup
Visually check the homepage and a few key pages	Catches layout breaks an update may have caused

Weekly upkeep on a typical small business site takes 15 to 30 minutes once you have a rhythm.

Monthly tasks

Task	Why it matters
Optimise the database (WP-Optimize or similar)	Removes revisions, transients and spam; speeds up queries
Test site speed and Core Web Vitals (PageSpeed Insights, GTmetrix)	Slow pages hurt rankings and conversions
Find and fix broken links and 404s	Protects user experience and SEO
Test every contact and enquiry form	Forms break silently after updates
Review PHP error logs	Surfaces conflicts before they become outages
Check Google Search Console for crawl and index errors	Flags problems Google already sees
Do a full manual backup and store it off-site	A second, independent copy for peace of mind

Budget 45 minutes to an hour a month for this pass. Our guide to Core Web Vitals breaks down what the speed numbers actually mean and how to move them.

Quarterly tasks

Task	Why it matters
Audit plugins and themes, delete anything unused	Fewer plugins means smaller attack surface and less bloat
Confirm your PHP version is current and supported	Old PHP is slower and stops getting security patches
Review user accounts, roles and permissions	Removes stale admin access; a common breach vector
Rotate passwords and admin credentials	Limits the damage of any leaked login
Verify the SSL certificate and its renewal	An expired certificate scares off visitors instantly
Test a full backup restore on staging	Proves your backups actually work
Clean the media library of unused images	Reclaims storage and trims backup size

Yearly tasks

Task	Why it matters
Renew domain, hosting and SSL, and note the dates	An expired domain can take a site offline for days
Audit and refresh outdated content	Keeps pages accurate and relevant for SEO
Review the theme and plugin stack as a whole	Decide what to keep, replace or rebuild
Check privacy compliance (Australian Privacy Act, plus GDPR if you sell overseas)	Reduces legal and reputational risk
Reassess hosting for traffic and performance	Growth may have outgrown your current plan

Keep PHP current: the task most owners forget

PHP is the language WordPress runs on, and your host decides which version your site uses. It matters more than most owners realise. Newer PHP is meaningfully faster and, more importantly, still receives security patches. Old versions do not.

As of 2026, PHP 8.2 is a sensible practical minimum for a live site, and 8.3 is a safe default. WordPress 6.9, released in December 2025, added early support for PHP 8.5, though most hosts have not rolled it out yet. The trap is upgrading PHP blindly: an old plugin can break on a newer version. So treat a PHP bump like any other update. Clone to staging, switch the PHP version there, click through the site, then apply it live. Most hosts let you change PHP versions from the hosting dashboard in a couple of clicks.

WooCommerce stores need a tighter routine

A WooCommerce store is a WordPress site with money moving through it, so the stakes are higher and a few tasks get added on top of everything above.

• Test the full checkout every week. Add to cart, apply a coupon, run a real payment in test mode, confirm the order email lands. A silent checkout failure can cost you every sale until someone notices.
• Keep WooCommerce and its extensions in lockstep. Payment gateways, shipping and subscription add-ons are the plugins most likely to clash after a core WooCommerce update. Always stage these first.
• Clean up store data. WooCommerce stores expired sessions, abandoned carts and old order metadata that bloat the database faster than a normal site. Clear them on a schedule.
• Watch stock, tax and shipping settings after any update that touches the store, since these occasionally reset or misbehave.
• Prune completed and cancelled orders on a retention schedule that still meets your tax record obligations.

Because a store carries real revenue risk, many WooCommerce owners run the weekly list fortnightly on quiet sites but daily on busy ones, and never update on production.

Recommended WordPress maintenance tools

You do not need all of these. Pick one per job and learn it well.

Job	Tools	Notes
Backups	UpdraftPlus, BackWPup, Duplicator	Send copies off-site to Google Drive, S3 or Dropbox
Security and firewall	Wordfence, Sucuri, Patchstack	Malware scanning, firewall and vulnerability alerts
Caching and speed	WP Rocket, LiteSpeed Cache	Page caching, lazy loading and file minification
Image optimisation	Imagify, Smush, ShortPixel	Compress and serve modern formats like WebP
Database cleanup	WP-Optimize, Advanced Database Cleaner	Clear revisions, transients and overhead
Debugging and performance	Query Monitor	Finds slow queries and the plugin causing them
Uptime monitoring	UptimeRobot, Better Uptime	Alerts you the moment the site goes down
Speed testing	Google PageSpeed Insights, GTmetrix	Measure against Core Web Vitals thresholds

Query Monitor deserves a special mention. When a site suddenly slows down, it shows you exactly which query or plugin is responsible, which turns guesswork into a five-minute fix.

DIY versus managed maintenance, and what it costs in Australia

There is no single right answer here. It comes down to how much time you have, how comfortable you are in the WordPress admin, and how much a day of downtime would cost your business.

Doing it yourself costs only your time plus a few plugin licences. Expect somewhere around AUD 150 to 500 a year for premium tools such as WP Rocket, a Wordfence Premium licence and paid backup storage. The catch is discipline. The checklist only protects you if you actually run it, and the month you skip is usually the month something breaks.

A managed WordPress maintenance plan hands the whole routine to a team that does it every day. In Australia, plans generally fall into these bands:

Plan level	Typical AUD per month	Usually includes
Basic	$80 to $150	Updates, backups, security scans, uptime monitoring
Standard	$150 to $350	The above plus speed checks, monthly reporting, small content edits
Premium / WooCommerce	$350 to $800+	Staging updates, priority support, store maintenance, performance tuning, dev hours

For a deeper breakdown of what drives these numbers, see our guide to website maintenance costs in Australia.

The honest rule of thumb: if your website brings in meaningful revenue, a managed plan usually pays for itself the first time it prevents an outage or a compromise. If it is a small brochure site and you enjoy tinkering, the DIY checklist above is perfectly workable.

Frequently asked questions

How often does a WordPress site really need maintenance?

Some tasks are weekly (updates, security scans, backups), some monthly (database cleanup, speed and form testing), and some quarterly or yearly (plugin audits, PHP checks, content review). The frequency tables above lay out a schedule you can follow as is. Busy or revenue-generating sites should run the weekly items more often.

Can I just turn on automatic updates and forget it?

Auto-updates for minor core releases and trusted plugins are sensible and reduce risk. But they are not a full plan. Automation will not test your checkout, catch a broken form, review a PHP upgrade or notice a layout breaking after an update. It reduces the manual load; it does not replace human eyes.

What is the single most important maintenance task?

Backups, closely followed by updates. Updates prevent most problems, and a tested off-site backup saves you when something goes wrong anyway. Neither is useful without the other.

Why does my WordPress site keep getting slower over time?

Usually a bloated database, unoptimised images, too many plugins, or an ageing PHP version. Run a database cleanup, compress your images, remove plugins you no longer use, and confirm you are on current PHP. Use Query Monitor to find the specific culprit.

Do I need staging if I only make small changes?

For a simple site you can often update directly, as long as you have a fresh backup first. For a WooCommerce store, a membership site or anything earning real money, staging is strongly recommended. The cost of a broken checkout far outweighs the few minutes staging takes.

Is managed hosting enough on its own?

Managed hosting handles infrastructure such as server-level backups, SSL renewal and some caching. It does not review your plugin updates, test your forms, audit your users or watch Search Console. You still need the application-level checklist above, either done yourself or through a maintenance plan.

Keep your WordPress site healthy without the guesswork

A WordPress site rewards steady attention and punishes neglect. Run the weekly, monthly, quarterly and yearly tasks above, keep PHP current, test on staging, and give WooCommerce the extra care it needs, and you will avoid the vast majority of security and performance problems before they start.

If you would rather hand it off, MediaPlus Digital in Melbourne builds and looks after WordPress sites for Australian businesses. Explore our WordPress website development work, or let our team run the whole routine for you through our website maintenance service. New to the platform and weighing it up? Our guides on why use WordPress for your website and the pros and cons of WordPress are a good place to start.