Websites rarely fail all at once. A contact form stops sending, a plugin its author abandoned two years ago develops a security hole, a domain renewal notice goes to a former employee's inbox, and nobody notices until customers do. A website maintenance checklist spreads the routine over weeks, months and years, so each job is small and nothing depends on someone's memory. The list below fits most WordPress, WooCommerce and Magento sites; a simple brochure site can skip the store items.

Weekly website maintenance checklist: updates and what customers touch

  • Back up, then update. Core, theme and plugin or extension updates, applied after a fresh backup, and on a staging copy first for larger releases.
  • Test what earns money. Send a test through every contact form, and on a store place a test order through checkout and payment.
  • Review alerts from uptime monitoring and security scans instead of letting them pile up in a mailbox.
  • Clear spam: junk comments, fake registrations and bogus form entries.

These are the WordPress maintenance tasks that slip most often, because each one takes only a few minutes and none feels urgent until it is.

Monthly website maintenance

  • Test website backups by restoring one. A backup that has never been restored is a hope, not a plan. Restore to a test location and click through a few pages.
  • Review users. Remove administrator accounts that belong to former staff or agencies, and check that everyone left has only the role they need.
  • Audit plugins. Delete deactivated plugins, and look for ones that have gone a long time without updates or have been closed on WordPress.org. Replace them before they become a security problem.
  • Check Search Console for new crawl errors, security issues or manual actions.
  • Measure speed on the home page and a key landing page, so a slow drift is caught early. Our article on why a slow website costs sales explains what to look for.
  • Look for broken links and stale content: old prices, staff who have left, expired offers.

Monthly website maintenance is also the right moment for small website updates and optimization, such as compressing newly added images and cleaning out old post revisions.

Quarterly and yearly checks

  • PHP version update. PHP 8.1 and older no longer receive security fixes, and PHP 8.2 receives them only until December 31, 2026, according to the PHP supported versions page. Test the site on the newer version in staging before switching; older plugins are the usual source of trouble.
  • Domain renewal. Turn on auto-renewal, confirm that the registrar's contact email reaches someone who still works for you, and keep the registrar lock on.
  • SSL certificates. Maximum certificate lifetimes started shrinking in March 2026 under industry rules and will keep shrinking, so renewal has to be automated. Check that it is, and that no manually installed certificate is quietly approaching expiry.
  • Hosting review: disk space, database size, server software versions and whether the plan still fits your traffic.
  • Policy pages: the privacy policy, cookie settings and terms still match how the site actually collects data.
  • Accessibility spot check, using only the keyboard on the main pages and forms.

What to automate and what to check by hand

Automation handles the repetitive parts well: scheduled off-site backups, uptime monitoring that raises an alert within minutes, certificate renewal, and WordPress's own automatic installation of minor security releases. Judgment is still needed for the rest. Major plugin updates can change behavior, a checkout can fail while every automated check stays green, and only a person notices that a page looks wrong on a phone. Good routines automate the collection of information and leave the decisions to a human. That is how our website care plans are built: updates tested on staging or applied right after a fresh backup, daily off-site backups, security monitoring and a monthly report of what was done.

How often should a website be updated?

Security updates as soon as they are released and tested, which for an active WordPress site usually means every week. Content whenever the business changes: services, prices, opening hours, the team. A redesign has no fixed schedule; it is due when the site no longer fits how customers use it or how the business sells. If updates keep getting postponed because nobody has time, that is usually the point at which handing the routine to someone else pays off.

Frequently asked questions: website maintenance checklist

What is the difference between hosting and maintenance?

Hosting keeps the server running; maintenance keeps your site on that server healthy. A host may patch the operating system and back up the server, but it rarely updates your plugins, tests your forms or repairs a broken page for you.

Can automatic plugin updates replace maintenance?

They help with small security releases, but an automatic update that breaks the checkout overnight is still a broken checkout. Automatic updates work best alongside monitoring, backups and someone who checks the result.

What should we keep if we change maintenance providers?

An administrator account in your own name, the registrar and hosting logins, and a copy of the latest backup stored somewhere you control. Nobody outside the business should hold the only key to your site.

Prefer to hand the checklist to someone else? Our website maintenance and care plans cover tested plugin updates, daily off-site backups, security monitoring and monthly reports for WordPress and Magento sites. If a site already shows signs of trouble, start with our guide to the warning signs of a hacked website. Whether you need website maintenance services in Los Angeles, Long Beach or elsewhere, send us your site address and platform, and we can suggest a plan that fits.