---
title: "WordPress Maintenance Checklist: Monthly Tasks | Fernando Kylas"
description: "A practical monthly WordPress maintenance checklist covering updates, backups, security, speed and content, so your site stays fast and safe."
url: https://fkweb.dev/en/insights/wordpress-maintenance-checklist/
lang: en-GB
alternates:
  en: https://fkweb.dev/en/insights/wordpress-maintenance-checklist/
  fr: https://fkweb.dev/fr/articles/checklist-maintenance-wordpress/
  nl: https://fkweb.dev/nl/inzichten/checklist-wordpress-onderhoud/
  de: https://fkweb.dev/de/wissen/wordpress-wartung-checkliste/
  x-default: https://fkweb.dev/en/insights/wordpress-maintenance-checklist/
---

1.  [Home](https://fkweb.dev/en/)
2.  [Insights](https://fkweb.dev/en/insights/)
3.  WordPress maintenance checklist: what to do every month

# WordPress maintenance checklist: what to do every month

A practical monthly WordPress maintenance checklist covering updates, backups, security, speed and content, so your site stays fast and safe.

By [Fernando Kylas](https://fkweb.dev/en/about/)13 October 20263 min read

WordPress runs a large share of the web, which makes it a large target. Most hacked WordPress sites are not victims of clever attacks. They are running a plugin that was last updated two years ago, on a password that has not changed since launch.

Regular care prevents nearly all of it. This is the checklist I work through on the sites I look after. Most of it takes under an hour a month once it is set up.

## Every week

**Check the site is up and working.** Load the homepage and one or two key pages. Better still, set up an uptime monitor that emails you when the site goes down.

**Look at form submissions.** If enquiries suddenly stop, check that the contact form still sends. Silent form failures are common after updates and email changes.

## Every month

**Back up first.** Before any update, make sure a fresh backup exists and is stored away from your hosting account. Daily automatic backups are better, with at least 30 days kept.

**Test a restore.** Once a quarter, restore a backup to a staging copy. It is the only way to know the backups actually work.

**Update WordPress core, themes and plugins.** Do it on a staging copy first if the site matters to your business. Read the changelog for major versions, then update the live site and check the key pages and forms.

**Remove what you do not use.** Every inactive plugin and theme is code that can still be attacked. Delete them, do not just deactivate them.

**Check for abandoned plugins.** If a plugin has not been updated in over a year, look for a maintained alternative.

**Review user accounts.** Remove people who have left, check that only the right people are administrators and make sure everyone uses a strong, unique password with two-factor login.

**Run a security scan.** A scanner such as Wordfence or your host’s malware checker will flag changed files and known vulnerabilities.

**Check speed.** Run your homepage through PageSpeed Insights. If the mobile score has dropped, look at recently added plugins, images and scripts.

**Look at Search Console.** Check for new errors, pages dropped from the index and security warnings.

## Every quarter

**Check your PHP version.** Old PHP versions stop receiving security fixes. Your host’s control panel shows which one you run; ask them before you upgrade.

**Review your hosting.** Is the site fast enough, is support helpful, do you have staging and backups included? Cheap hosting often costs more in time.

**Clean the database.** Old revisions, spam comments and expired transients slow the site down. A plugin such as WP-Optimize can tidy them, after a backup.

**Check renewals.** Domain, hosting, SSL and premium plugin licences. An expired domain is the most avoidable outage there is.

## Every year

**Review your content.** Update or remove pages that are out of date, check that contact details and prices are still right, and fix broken links.

**Review who has access.** Hosting, domain registrar, DNS, analytics and the WordPress admin. Write it down in one place.

## When something goes wrong

If the site shows a white screen, an error or strange content, do not panic and do not start deleting plugins on the live site. Take a backup of the current state, then restore the last good backup or work on a copy. If the site has been hacked, change every password after the clean-up, not before, or the attacker may simply log in again.

## Doing it yourself, or not

Everything here is within reach of a careful site owner. The hard part is remembering to do it every month, and knowing what to do when an update breaks something. If you would rather not think about it, my [WordPress care](https://fkweb.dev/en/services/wordpress-maintenance/) plans cover all of this, with a short monthly report.

## Related services

-   [WordPress care](https://fkweb.dev/en/services/wordpress-maintenance/)

[All insights](https://fkweb.dev/en/insights/)

Next step

## Have a project in mind? Let us talk it through.

Tell me what exists today and what needs to change. I reply within 2 business days, in English or French.

[Start a project](https://fkweb.dev/en/contact/)Or email me directly

[thatsme@fernandokylas.com](mailto:thatsme@fernandokylas.com)