WordPress Maintenance Checklist.

Fifteen minutes. Do it in this order.

• Confirm the last backup exists and is off-siteA backup on the same server as the site is not a backup. Check it ran, not just that the plugin is active.
• Apply plugin and theme updates on staging firstUpdate, click through the pages that matter, then push to live. Auto-updating a checkout plugin straight to production is how Fridays get ruined.
• Apply WordPress core minor releasesMinor releases are almost always security fixes. Take them promptly.
• Submit your own contact formThe most common silent failure on a WordPress site is a form that stopped delivering email weeks ago.
• Check uptime and error logsLook for the pattern, not the single blip. Repeated 500s always mean something.
• Clear spam comments and pending registrationsBoth are attack surface and both are noise in your database.

An hour. This is where most sites quietly rot.

• Restore a backup somewhere and open itAn untested backup is a hope. Restoring to a local or staging environment once a month turns it into a fact.
• Remove plugins you no longer useDeactivated is not removed. An abandoned plugin sitting in the folder is still code on your server.
• Review user accounts and rolesRemove the developer who left, the agency you no longer work with and every account with Administrator that does not need it.
• Clean post revisions, transients and orphaned metaTake a backup first. Always take a backup first.
• Run a speed test and compare to last monthThe trend matters more than the score. A site that gets 200ms slower every month has something accumulating.
• Check 404s and fix the ones with trafficA 404 with inbound links is a redirect waiting to be written.
• Confirm SSL renewal is automatic and not near expirySet a calendar reminder 30 days before expiry even when it renews itself.

Half a day. The work that prevents emergencies.

• Check your PHP version against what is still supportedRunning an unsupported PHP version means security fixes stop reaching you, quietly.
• Run a malware and vulnerability scanThen check the plugins you use against a vulnerability database. Popular does not mean maintained.
• Review the top 20 pages for accuracyPrices, staff names, service descriptions, dead links, last year's phone number.
• Test every form end to end, including the CRM handoffSubmit, check the inbox, check the CRM, check the autoresponder. All four, not the first one.
• Review hosting resources against actual usageBoth directions. Paying for a plan you outgrew is as common as being throttled on one you did not.
• Rotate shared credentials and confirm who holds whatDomain registrar, hosting, DNS, CDN, payment gateway. Write down who can log into each one.
• Write down what happens if the site goes down at 2amWho is called, what they have access to, what the rollback is. Two paragraphs beats an improvised night.