Use this WordPress maintenance checklist to plan weekly, monthly and yearly tasks: updates, backups, users, plugins, security, speed, PHP, domain and SSL, plus Site Health and WooCommerce checks.
A WordPress maintenance checklist is a short list of jobs you repeat on a schedule: updates, backups and tests weekly, user and plugin reviews monthly, and PHP, domain, SSL and restore checks every few months or yearly. The intervals here are our suggestion, not an official rule. WordPress's own maintenance lessons use looser ones, and a shop that takes orders daily is better served by tighter ones.
In short
Maintenance is five kinds of work: keep software current, keep copies, keep access tight, check that things still work, and remove what you no longer use. WordPress's site maintenance and housekeeping lessons suggest upgrade checks every three to six months, three to twelve backups a year and dead-link checks every six months to a year. We use shorter intervals, because WordPress's guidance is to always keep plugins and themes updated, and a store has orders to protect.
| Task | What to do |
|---|---|
| Updates | Under Dashboard > Updates, apply core, plugin, theme and translation updates after a backup. On a store, try big ones on staging: how to update safely |
| Backup check | Confirm the last backup ran, looks the right size and sits away from the server: how to back up WordPress |
| Forms and email | Send the contact form and confirm it arrives |
| Uptime | Read alerts, then open the home page, a product and the checkout on a phone |
| Site Health | Read new critical or recommended items under Tools > Site Health |
All five intervals are ours.
| Task | What to do |
|---|---|
| Users and roles | Remove people who left, and confirm each Administrator is needed and uses two-factor login. wp user list --role=administrator lists them (roles) |
| Plugins and themes | Delete inactive ones and check last updates. wp plugin list --fields=name,wporg_status,wporg_last_updated helps |
| Broken links | Search Console's Page indexing report lists URLs that returned "Not found (404)". Run a link checker on key pages |
| Security scan | wp core verify-checksums and wp plugin verify-checksums --all, your host's scan and Search Console's Security issues report |
| Speed | PageSpeed Insights on the home page, a category and a product, compared with last month: see the speed guide |
| Database cleanup | After a backup, empty spam comments and delete expired transients with wp transient delete --expired or WooCommerce > Status > Tools. Leave orders, revisions and unknown tables alone |
The monthly rhythm is ours, tighter than the official intervals above and than the routine in our security checklist, which reviews roles every few months. A checksum mismatch is a reason to look, not proof of a hack: the commands cover only core and directory plugins, and the plugin check ignores small changes such as readme.txt unless you add --strict. WP-CLI needs SSH access. If a scan finds something, follow that checklist.
| Task | What to do |
|---|---|
| PHP version | Shown in WooCommerce > Status. WordPress recommends PHP 8.3 or greater, as do WooCommerce's requirements. On 21 October 2026, php.net listed security support for PHP 8.2 until 31 December 2026 and for 8.3 until 31 December 2027. Change it through your host, after a backup and a staging test |
| Domain and SSL | Check the registrar's expiry date, auto-renewal, card validity and contact email. View the certificate's expiry in your browser. Let's Encrypt has ended its expiry emails, so do not wait for a warning |
| Restore test | Restore a stored backup to staging and time it |
| Plugin replacement | Replace abandoned, overlapping or idle plugins: best WooCommerce plugins |
| Content refresh | Update prices, delivery times, policies and old posts |
| Accessibility | Run W3C's easy checks on the home page, product, cart, checkout and contact form. They are quick, not exhaustive |
| Privacy pages | Check that Settings > Privacy has a policy page and that it matches what the site now does: plugins, analytics, forms, WooCommerce retention. Have a lawyer review your pages |
| Licences | List each paid plugin and theme with its support and update expiry. DevMarket items show both |
Our suggestion: PHP and domain checks quarterly, a restore test every few months as in our security checklist, and the rest yearly.
Tools > Site Health has two tabs (documentation). Status sorts results into critical issues, recommended improvements and passed tests. Info is a detailed read-out you can copy for a support request. According to the developer reference, as of 2026 the tests cover:
The reference shows a weekly background run, which feeds the Site Health Status widget on the Dashboard. It does not check whether a backup exists, whether the site is up, whether checkout works or whether there is malware. WooCommerce adds its own system status report under WooCommerce > Status.
An uptime monitor is a service outside your server that requests a page at intervals and alerts you when it fails. Our suggestions: watch the home page and one page that needs the database, such as a product, because a cached home page can look fine while the shop is broken. Your host may include basic monitoring, and independent services exist: compare check interval, alert channels and where checks run. WordPress also emails the Settings > General address about auto-updates and critical errors: make sure someone reads it.
transactional-emails, records each email as sent, failed, disabled or skipped. If emails go missing, WooCommerce's email FAQ suggests a From address on your own domain and a dedicated SMTP provider.| Area | Site owner | Developer or agency | Host |
|---|---|---|---|
| Updates | Picks when the shop can pause, checks checkout | Updates on staging, then live | Offers PHP versions and staging, if included |
| Backups | Knows where copies are, asks for a restore result | Sets schedule, offsite storage, restore tests | Server backups, if included |
| Access and security | Approves accounts, reports oddities | Audits roles, scans, hardens | Patches the server, controls panel logins |
| Orders and renewals | Reviews failed payments, stock, domain and licences | Fixes gateway and plugin faults | Provides server logs and HTTPS |
Plans differ, so ask each party in writing what is included. A small site without a developer can run the weekly and monthly lists itself.
Keep one page the next person can find: registrar and expiry date, host and plan, PHP version, administrators, theme, plugins with purpose and licence expiry, backup location and last restore test, payment gateways and test mode, email service, and who receives alerts. Never store passwords in it: use a password manager.
Look weekly, audit monthly and review the bigger items every few months or yearly. WordPress's own lessons allow longer gaps, so these tighter intervals are our suggestion.
No. It does not check backups, uptime, checkout or malware. Add a backup check, an uptime monitor and a manual checkout test.
Updates, a backup stored elsewhere, a user review, renewal dates for the domain and certificate, and an uptime alert.
The tasks are the same whoever does them. Decide who does each one, then ask any provider what is included.
Start with how to back up WordPress, then plan updates with how to update WordPress and WooCommerce safely. When something breaks, see how to fix common WordPress errors, and for deeper work use the security checklist and the speed guide. You can also browse WordPress plugins on DevMarket.
Fix the WordPress critical error and white screen of death calmly: back up, read the logs, find the cause by elimination, then handle database, 500, memory, maintenance mode, 404 and login errors.
9 min read
Choose a WordPress theme by testing, not by demo. Compare block and classic themes, sources, speed, accessibility, RTL support, WooCommerce, builder lock-in and licence terms on a staging copy.
9 min read
Learn how to back up WordPress: what a complete backup contains, host, plugin and manual methods, where to store copies, how often to run them for blogs and stores, and how to restore and test.
9 min read
Every item on DevMarket has a human-reviewed release, an instant licence key and clear update and support terms.