WordPress Maintenance Checklist: What You Should Be Doing Monthly

Every WordPress site we take over from another agency tells the same story: plugins six months out of date, no real backup strategy, a malware scanner that hasn't been run since the handover, and a database that has been quietly bloating for years. The site still loads, so nobody noticed. Then one morning, it doesn't — and someone is paying us $3,000 to rebuild a compromised site instead of $100/month to prevent the compromise.

WordPress runs 43% of the web because it's flexible, extensible, and open. The trade-off: it needs maintenance. Not a huge amount — but consistently, monthly, without fail. This is the exact checklist we run for every client on our managed plan, and the one we'd hand to any in-house marketing manager who wants to maintain a WordPress site themselves.

Why monthly (and not less often)

Monthly is the cadence that balances effort against risk. Weekly is overkill for most sites. Quarterly is too long — plugin vulnerabilities are typically patched within days of disclosure, and sitting on an unpatched version for three months is asking to be compromised. Monthly catches every meaningful issue while keeping the workload manageable.

The rhythm also matches how WordPress itself releases. Minor security patches land roughly every 4-8 weeks; major releases every 3-4 months. Monthly maintenance keeps you inside both windows.

1. Core, plugin, and theme updates

This is the single most important line item on the checklist. Outdated plugins are the #1 cause of WordPress hacks. Full stop.

Our update order, every time:

1. Run a full backup first. Even if you have daily automated backups, trigger a fresh one before touching anything.
2. Apply updates on a staging site. Any managed host worth using (Kinsta, WP Engine, Cloudways) gives you a one-click staging environment.
3. Update core first, then plugins, then theme. This order minimises compatibility weirdness.
4. Test the critical flows. Contact forms, checkout, login, any feature your business actually relies on.
5. Push to production. If staging passed, deploy. If something broke, you have time to troubleshoot without a live outage.

Turn on automatic updates for minor core releases and plugins you trust (Gravity Forms, WooCommerce, Rank Math, WP Rocket). Leave major updates manual.

2. Backup verification

Every site has a "backup". Almost none of them actually get tested. The difference between a backup that exists and a backup that works is usually discovered at the worst possible moment.

Our monthly backup discipline:

• Verify the schedule ran. Open your backup plugin (UpdraftPlus, BlogVault, Jetpack Backup) and confirm the last 30 days of backups exist.
• Confirm off-server storage. A backup on the same server as the site is worthless if the server is compromised. Push to S3, Google Drive, Dropbox, or a dedicated backup service.
• Test a restore. At least once per quarter, restore a backup to a staging site. If the restore fails, you need to know now.
• Confirm the database is included. Some misconfigured backup plugins only back up files. Without the database, you lose every post, user, and order.

3. Security scans and malware checks

Run a monthly security sweep. The stack we use:

• Wordfence or Sucuri — full malware scan and vulnerability check.
• Patchstack — a vulnerability database and virtual patching service that covers plugins before the plugin authors even ship fixes.
• Google Search Console — check the Security Issues report. If Google flagged your site, you'll see it here first.
• VirusTotal — submit your domain and check against 70+ antivirus databases.

Also review your users list. Delete inactive admin accounts. Rotate any passwords that haven't been changed in a year. Enforce 2FA on every admin.

4. Speed and Core Web Vitals audit

WordPress performance drifts over time. Each new plugin, each new page builder block, each new image adds weight. The monthly audit catches that drift before it kills your rankings.

Run your five most important pages through:

• PageSpeed Insights — check Core Web Vitals (LCP, INP, CLS) on mobile.
• GTmetrix — waterfall view to identify the slowest resources.
• Search Console's Core Web Vitals report — real-user field data across your whole site.

If something regressed, it's almost always either a new plugin loading scripts site-wide, an unoptimised image a content team uploaded, or a caching layer that got invalidated. Our full breakdown of performance-first web design covers the underlying fixes.

5. Broken link and 404 sweep

Broken internal and outbound links hurt user experience and, at scale, hurt SEO. Our monthly sweep:

• Screaming Frog SEO Spider — free up to 500 URLs, catches every internal 404 and redirect chain.
• Ahrefs Site Audit — if you already pay for Ahrefs, run a fresh crawl every month.
• Google Search Console — the Pages report shows which URLs Google is hitting that 404.

Fix by: updating links that moved, redirecting old URLs to new destinations (301), and removing outbound links to dead sites. Never leave 404s alive on important pages.

6. SEO and analytics review

This is where WordPress maintenance crosses over into growth. Each month, we pull a quick report:

• GSC impressions and clicks — trending up, down, or flat vs last month?
• Top 20 queries — any new keywords gaining ground?
• Top 20 pages — which pages are driving traffic? Which regressed?
• GA4 conversions from organic — is organic traffic still converting?
• Rank tracking — track 30-50 commercial keywords in Ahrefs or SEMrush.

The pattern we look for: pages that lost traffic month-over-month usually need a content refresh. Pages that gained often deserve more internal links pointing at them.

7. Form and transactional email testing

This is the step almost every agency skips, and it's the one that hurts clients the most. A contact form that's silently failing because your SMTP plugin broke is a revenue leak nobody notices.

Every month, submit every form on the site. Verify:

• The form actually submits without error.
• The notification email arrives in your inbox.
• It doesn't land in spam.
• The CRM integration fired (HubSpot, Mailchimp, Pipedrive, etc.).
• The user sees a confirmation page or message.

For ecommerce sites, add a test order to the checklist. Add to cart, checkout, receive the order confirmation email. Every month, without exception.

8. Database cleanup and optimisation

WordPress databases accumulate junk: post revisions, auto-drafts, trashed comments, expired transients, orphan metadata. On a five-year-old site, cleaning the database can shave 20-40% off its size.

Tools: WP-Optimize, Advanced Database Cleaner, or the WP-CLI command wp db optimize. What to clean:

• Post revisions older than 30 days (keep the last 5)
• Trashed posts and comments
• Spam comments
• Expired transients
• Orphan post meta
• Unused tags

Always back up before running database cleanup. Always.

9. Content, comments, and media audit

Monthly content hygiene:

• Moderate comments — approve, reply, or trash anything pending.
• Check the Media Library — delete unused uploads (WP Media Cleaner helps).
• Review scheduled posts — confirm upcoming content is set to publish correctly.
• Check legal pages — privacy policy, terms, cookie banner still compliant with current regulations.
• Review the footer year — yes, really. Change "© 2024" to the current year if your theme doesn't do it automatically.

A monthly schedule that actually sticks

The checklist only works if it gets done. What works in practice:

1. Pick one day per month — first Monday of the month, every month.
2. Block 90 minutes — a well-maintained site takes about that long end to end.
3. Document what you did — a simple running log (Google Doc or Notion page) covering date, updates applied, issues found, actions taken.
4. Automate the scans — Wordfence, UpdraftPlus, and ManageWP can handle most routine tasks automatically. The monthly review confirms they actually ran.
5. Outsource if you can't commit — a managed WordPress plan at $100-200/month is cheaper than a single emergency recovery.

If monthly maintenance isn't a skill your team has — or shouldn't be spending time on — talk to us. We maintain WordPress for Toronto businesses so they can focus on what actually grows their business. Or keep exploring how we approach web design and long-term site care.