Outsource Web Dev Florida

WordPress Website Maintenance Checklist

By Jeremy Kenerson, Founder and CEO at DeskTeam360

Last updated . The WordPress and Google guidance was checked October 1, 2026. DeskTeam360's details were checked September 25, 2026.

A WordPress website maintenance checklist covers backups, updates, security, speed, a test of forms and key pages, and a yearly review, with a set time for each task and a way to prove it was done. Copy the table below into each site's record, tick each line when it's done, and keep the dates. That dated record is what lets someone else pick up the work.

DeskTeam360 publishes this site, and its own maintenance work comes up below as one example.

What goes on a WordPress website maintenance checklist?

Six groups of tasks go on it: backups, updates, security, speed, a check that forms and key pages still work, and a yearly review. The timings below are suggestions. Adjust them to how often each site changes.

Task Suggested timing How to tell it's done
Confirm a backup ran Weekly The newest backup carries this week's date
Back up before any update Every update A fresh backup exists from the same day
Update WordPress, plugins and themes Monthly, or when a security fix comes out The site shows no updates waiting
Test forms and checkout After each update A test entry or test order arrives where it should
Check page speed Monthly The main pages meet Google's three targets
Clear out unused plugins and themes Every three months Only the plugins the site uses are installed
Review user accounts Every three months Every account belongs to someone who still needs it
Restore a backup to a copy Twice a year The copy opens and matches the live site
Yearly review Once a year Every line in the yearly list below is ticked

For the short week-by-week version, see WordPress maintenance.

To explain to a client why the list matters, see why website maintenance matters.

What should you do before you run a WordPress update?

Back up first, every time. WordPress.org says to always move WordPress to its latest version and to back up the site before you begin, and to back up the database before every upgrade as well as on a regular schedule.

Before you click update:

  1. Take a fresh backup of the files and the database.
  2. Make sure the backup opens. A backup you can't restore won't save you.
  3. Read the release notes for any plugin that jumps a full version.
  4. Pick a quiet hour when few visitors are on the site.
  5. Know the fix for a stuck update. While it updates, WordPress puts the site in maintenance mode using a temporary .maintenance file. If that file stays behind, visitors keep seeing "Briefly unavailable for scheduled maintenance," and deleting the file clears it.

For the checks to run once an update is done, see WordPress maintenance tips.

Which security checks belong on the checklist?

Updates come first on the security list, because older versions of WordPress don't get security updates. WordPress.org also says to keep plugins current, for both security and speed.

Add these lines:

  • Core updates. Most sites have applied small and security core updates by themselves since version 3.7 of WordPress. Confirm that they did.
  • Plugin and theme updates. Plugins have been able to update automatically since WordPress 5.5. Decide which ones may update alone.
  • User accounts. Remove people who left, and lower any role that's higher than the person needs.
  • Unused plugins and themes. Delete what the site doesn't use.
  • Alerts. Read every security and uptime alert, and note what you did about it.

To split these checks between you and a helper, you can get DeskTeam360's Task Delegation Template.

Get the Task Delegation Template

Which speed checks belong on the checklist?

Check the main pages against Google's three targets once a month. Those targets are main content showing within 2.5 seconds, a response to taps and clicks in under 200 milliseconds, and layout shift under 0.1.

How to run the check:

  • Use Google's own report. Google points site owners to the Core Web Vitals report in Search Console, and its web.dev guide names PageSpeed Insights as another tool with data from real visitors.
  • Write down the numbers. Note all three for the home page and each main page, with the date.
  • Flag what slipped. Mark any page that got worse since last month.

For what to fix when a page is slow, see website speed optimization.

What goes on a once-a-year WordPress checklist?

Once a year, step back from the routine and check the things that rarely change: what renews, who has access, what the site still needs, whether a full restore works, and whether the checklist still fits the site.

  1. Renewals. List the domain, hosting and paid plugin renewal dates, and whose card pays for each.
  2. Access. Confirm every login, from hosting to the domain, is in the site owner's name.
  3. Plugins. Ask of each plugin whether the site still needs it.
  4. A full restore test. Restore a backup to a copy of the site and click through every main page.
  5. Content. Find pages that are out of date, such as old prices, staff or offers.
  6. The checklist. Add tasks the site now needs, and drop the ones it doesn't.

How do you hand the checklist to someone else?

Give them the checklist, the dated record of past work and a login of their own, then agree who signs off each month. The record matters as much as the list, because it shows what was done last and when.

  1. Share the checklist and the record. Both in one place you control.
  2. Create a separate login for them. Never share yours.
  3. Agree who checks the work and who tells the client.
  4. Ask for the record to be updated after every task.

As one example, website maintenance comes with DeskTeam360's plans, and it covers updates, security monitoring, speed work, backups and uptime monitoring. A North American account manager assigns and manages each upkeep task, and checks it before the client sees it. For agencies, the work is done under the agency's name, and its clients never see DeskTeam360.

For handing client sites to a support partner, see white label WordPress support.

More on WordPress and website maintenance

To hand parts of this checklist to a helper with clear write-ups, you can get DeskTeam360's Task Delegation Template.

Get the Task Delegation Template

Sources

All checked October 1, 2026. DeskTeam360's pages were checked September 25, 2026.

What changed

  • October 26, 2026: First version of this page.