WordPress Maintenance Checklist: 24 Tasks from Daily to Yearly

WordPress runs a huge share of the web because it's flexible: thousands of themes, tens of thousands of plugins, and a database that holds everything. That flexibility is also why WordPress sites need regular maintenance. Every plugin is code from a different developer, updated on a different schedule, and any one of them can change how your site looks, works or appears to Google.

Almost every WordPress problem starts with a change. An update to core, a theme or a plugin. A settings page someone saved. A new plugin installed to solve one problem that quietly causes another. So this checklist doesn't just tell you which updates to run. For each task, it tells you what to check afterwards so you know nothing broke.

Why WordPress needs more maintenance than most platforms#

On hosted platforms like Shopify or Squarespace, the company running the platform handles most of the software. With self-hosted WordPress, you're responsible for:

• WordPress core, which gets security releases several times a year.
• Your theme, which controls layout and often your SEO tags.
• Every plugin, each with its own update schedule and its own quality bar.
• PHP and the server, which your host manages but you choose versions for.
• The database, which grows with revisions, spam, transients and logs.

Each layer can break the others. A plugin update can conflict with your theme. A PHP upgrade can break an old plugin. A caching plugin can serve a stale version of a page after you fixed it. Maintenance is how you keep all those layers working together.

WordPress maintenance schedule at a glance#

Daily (automatic): set these up once#

1. Uptime and SSL monitoring#

Use an external monitor that checks your site every few minutes and alerts you when it goes down or when your SSL certificate is close to expiring. It has to be external: a plugin running inside WordPress can't tell you WordPress is down.

2. Automatic backups#

Use a backup plugin or your host's backup system to take daily backups of both files and the database, and store them off the server (cloud storage, not the same hosting account). For busy WooCommerce stores, more frequent database backups are worth it, because orders change constantly.

3. Security scanning#

A security plugin can scan for malware, flag known-vulnerable plugins, limit login attempts and alert you to suspicious changes. Turn on its email alerts so findings reach you without logging in.

Weekly WordPress maintenance tasks#

4. Verify your backups actually ran#

Open your backup plugin or hosting panel and confirm the newest backup is recent and roughly the same size as previous ones. Backup jobs fail quietly, for example when storage fills up or an API key for the cloud destination expires.

5. Update WordPress core, themes and plugins#

Go to Dashboard > Updates and review what's waiting. A sensible routine:

• Security releases: apply promptly. Minor core releases (like 6.x.1) are usually security and bug fixes.
• Major updates to core, your theme, a page builder or WooCommerce: read the changelog, and test on a staging copy first if your host provides one.
• One at a time for important plugins. If something breaks after updating ten plugins at once, you won't know which one did it.
• Take a backup first, or confirm today's automatic one exists.

If you use automatic plugin updates (available per plugin since WordPress 5.5), the next step matters even more, because updates will happen when you're not watching. Our guide on how to safely update WordPress plugins covers a full update process.

6. Check your key pages after every update#

This is the step most WordPress maintenance checklists leave out, and it's the one that catches real damage. After updates, check the pages that matter:

• Layout: does the page still look right on desktop and mobile? Page builder and theme updates are the usual cause of broken layouts.
• Key buttons and forms: are your contact form, booking widget, add-to-cart and checkout buttons still there?
• SEO tags: is the page title still correct? Is there a noindex tag that wasn't there before? SEO plugin updates and theme changes both touch these.
• Tracking: is your analytics or tag manager code still on the page? Theme updates that replace header templates are a classic way to lose it.

You can spot-check tags with our meta tag checker and tracking with the analytics tag checker. For more than a few pages, automate it (more on that below).

7. Test forms and WooCommerce checkout#

Submit your contact forms and confirm the emails arrive. WordPress sends mail through PHP by default, which many hosts restrict or which lands in spam, so many sites use an SMTP plugin. When that plugin's credentials expire, every form on the site stops delivering, while still showing visitors a success message.

If you run WooCommerce, place a test order using your payment gateway's test mode, and confirm the order email arrives.

8. Confirm analytics is recording#

Glance at yesterday's traffic in Google Analytics. A sudden drop to near zero almost always means the tracking code disappeared, not your visitors. Our guide to Google Analytics not tracking lists the common causes.

Monthly WordPress maintenance tasks#

9. Check Tools > Site Health#

WordPress has a built-in health check at Tools > Site Health. It flags outdated PHP versions, inactive plugins and themes, failed scheduled events, disabled automatic background updates, missing modules and HTTPS problems. Work through anything listed under "critical issues" first.

10. Confirm "Discourage search engines" is off#

Go to Settings > Reading and make sure "Discourage search engines from indexing this site" is unchecked. This box is often ticked on staging sites and then carried over at launch, or ticked during maintenance and forgotten. When it's on, WordPress asks search engines not to index your site.

Also check your SEO plugin (Yoast, Rank Math or similar) hasn't set important posts or pages to noindex. Our noindex checker shows the robots tags on any page.

11. Review your SEO plugin's output on key pages#

SEO plugins generate your titles, meta descriptions, canonical tags and sitemaps. After plugin updates, settings imports or a switch between SEO plugins, check that your key pages still have the titles and canonicals you intended, and that your XML sitemap still loads and lists your important pages.

12. Clear spam and moderate comments#

Delete spam comments and review pending ones. Large amounts of spam bloat the database, and unmoderated spam links on your pages hurt trust. If you don't use comments at all, turn them off under Settings > Discussion.

13. Find broken links and 404s#

Check your key pages for broken internal and external links with our broken link checker, and review 404 errors in Search Console. In WordPress, changing a post's slug or deleting a page are the usual causes. Fix internal links, and redirect removed URLs to their closest replacement with a redirection plugin or your SEO plugin's redirect feature.

14. Look at the PHP error log#

PHP warnings and errors often point to a plugin that's about to break. Your host's control panel usually shows the error log. You can also enable logging by setting WP_DEBUG and WP_DEBUG_LOG to true in wp-config.php, which writes errors to wp-content/debug.log. Keep WP_DEBUG_DISPLAY off on a live site so errors aren't shown to visitors, and turn logging back off when you're done.

15. Check speed and page weight#

Run key pages through PageSpeed Insights and compare with last month. Common WordPress culprits are large images uploaded without compression, a new slider or page builder element, and plugins that each add their own scripts and styles to every page. Our page size checker shows what a page is made of.

Quarterly WordPress maintenance tasks#

16. Remove unused plugins and themes#

Deactivated plugins and themes still sit on the server, and outdated ones can still be exploited. Delete plugins you don't use, and keep only your active theme plus one default WordPress theme as a fallback. Also question the active ones: can two plugins be replaced by one?

17. Clean up the database#

Over time the database fills with post revisions, auto-drafts, trashed posts, spam comments and expired transients. A database cleanup plugin can remove these. Always take a backup first. To stop revisions piling up in future, you can limit them with define( 'WP_POST_REVISIONS', 10 ); in wp-config.php.

18. Test a backup restore#

Restore your latest backup to a staging site and confirm it works: pages load, images appear, you can log in, WooCommerce orders are there. A backup you've never restored is untested.

19. Review users and roles#

Go to Users and remove accounts for people who no longer need access. Check that each person has the lowest role that lets them do their job: editors don't need to be administrators. Turn on two-factor authentication for every administrator account.

20. Check scheduled tasks#

WordPress runs scheduled tasks (WP-Cron) when people visit the site, so on low-traffic sites they can run late or not at all. If scheduled posts are missing their publish time or backups aren't running on schedule, consider setting up a real server cron job to trigger WP-Cron, which most hosts support.

Yearly WordPress maintenance tasks#

21. Review your PHP version and hosting#

Check which PHP version your site runs (Site Health shows it) and whether it still receives security support on php.net. Upgrading PHP usually makes WordPress faster, but test on staging first, because old plugins sometimes break on newer versions. Review whether your hosting plan still fits your traffic.

22. Audit your plugin stack#

Look at every active plugin: when was it last updated, is it still maintained, is there a better-supported alternative? A plugin that hasn't been updated in a long time is a risk even if it still works today.

23. Run a full site audit#

Crawl the whole site for broken pages, redirect chains, duplicate titles, missing descriptions and pages that shouldn't be indexed. Then use a year of Search Console data to refresh pages that lost traffic.

24. Renew and review#

Confirm your domain auto-renews, review premium plugin and theme licenses (an expired license often means no more security updates), and update legal pages and the footer copyright year.

The real risk: changes nobody notices#

Notice how many of these tasks exist because something changed without anyone noticing: a layout broken by a theme update, a noindex tag from a settings reset, a tracking code lost with a header template, a form that stopped sending when SMTP credentials expired.

The common thread is that WordPress sites change all the time, often through automatic updates, and most changes are fine. The skill is spotting the few that aren't. That's much easier when you have a record of how your key pages looked when everything was working, and compare against it after every change.

If you manage WordPress sites for clients#

For agencies, multiply this checklist by every client site and add the need to show your work. Three habits help:

• Same key pages for every client: homepage, main service pages, contact, and the checkout or booking flow.
• A baseline after every approved change, so you can compare what a page looked like before and after any update.
• A monthly report listing updates applied, uptime, and issues found and fixed. It's what makes care plans renew.

How MyKavo helps with WordPress maintenance#

MyKavo is our product, so here's exactly where it fits on this checklist.

The MyKavo WordPress plugin is free on WordPress.org. Connect it to your MyKavo account and it records every plugin, theme and core update, so when a change shows up you can see which update caused it. With Safe Updates (Pro and Agency plans), MyKavo checks your key pages right after each update.

MyKavo itself monitors the pages you choose against an approved baseline and alerts you when something important changes:

• After updates (task 6): before-and-after screenshots show broken layouts, and missing buttons or forms are flagged.
• SEO settings (tasks 10 and 11): a page flipping to noindex is critical, and canonical or title changes are flagged with the old and new values.
• Tracking (task 8): a disappearing analytics, tag manager or payment script is a high-severity alert.
• Broken links (task 13) and page weight (task 15): grouped alerts for internal links that start failing, and warnings when pages get much heavier.
• Uptime and SSL (task 1): availability checks every few minutes and warnings before certificates expire.
• Buttons and forms: on Pro and Agency, monitor specific elements like a checkout button or booking form and get alerted when they disappear or change.

Honest limits: MyKavo doesn't run your updates, take backups, clean your database or scan for malware. Keep your backup and security plugins for those. It watches the pages you choose: 5 on the free plan, 15 per website on Pro, and 25 per website on Agency.

If something breaks and you don't have a developer, our team can fix it at a fixed price agreed up front. See MyKavo Services.

Your WordPress maintenance checklist#

Daily (automatic)

1. Uptime and SSL monitoring
2. Automatic off-server backups
3. Security scanning

Weekly

4. Verify backups ran
5. Update core, themes and plugins
6. Check key pages after every update
7. Test forms and WooCommerce checkout
8. Confirm analytics is recording

Monthly

9. Check Tools > Site Health
10. Confirm "Discourage search engines" is off
11. Review SEO plugin output on key pages
12. Clear spam and moderate comments
13. Find broken links and 404s
14. Look at the PHP error log
15. Check speed and page weight

Quarterly

16. Remove unused plugins and themes
17. Clean up the database
18. Test a backup restore
19. Review users and roles
20. Check scheduled tasks

Yearly

21. Review PHP version and hosting
22. Audit your plugin stack
23. Run a full site audit
24. Renew domains and licenses, update legal pages

The bottom line#

WordPress maintenance is mostly about change: applying the updates that keep the site secure, and catching the rare update that breaks something important. Keep the routine on a schedule, and after every update, confirm your key pages still look, work and appear to Google the way they did before.

MyKavo and its free WordPress plugin do that check for you after every update, on every site you manage. Start monitoring free: one website and five key pages, no card needed.