WordPress runs a huge share of the internet. It powers more than 40% of all websites, which is exactly why attackers spend so much time probing it. When a site gets compromised, an outdated plugin is usually the way in. Patchstack and Wordfence both report that plugin vulnerabilities, not WordPress core itself, account for the large majority of exploited entry points each year.<\/p>\n
That single fact is the reason this checklist exists. A WordPress site is not a “set and forget” asset. Core, themes and plugins ship updates constantly, the database fills with junk, and PHP versions age out of support. Skip the upkeep and you eventually pay for it with a hacked site, a slow one, or a checkout that quietly stopped working three weeks ago.<\/p>\n
Below is a frequency-based checklist you can actually run, plus a tools table, honest DIY versus managed cost bands in AUD, and answers to the questions we hear most often at MediaPlus Digital.<\/p>\n
If you run something other than WordPress, or you want the platform-agnostic version that covers hosting, DNS and email as well, read our general website maintenance checklist<\/span><\/a> as the companion to this one. This article stays firmly inside WordPress.<\/p>\n