The maintenance checklist most WordPress sites are missing

Weekly: the visible layer

This is the part most teams already do, but the order matters.

• Apply core, theme and plugin updates on a staging copy first.
• Run a quick visual check of the homepage, a key template and the checkout or contact flow.
• Confirm forms actually deliver mail, not just show a success message.
• Review error logs for new warnings introduced by the update.

Monthly: the layer that prevents incidents

Restore one backup into a throwaway environment and load the site. A backup that has never been restored is a promise, not a guarantee — and the failure mode is always discovered on the worst possible day.

Then review the plugin roster. Anything unmaintained for a year, anything installed for a campaign that ended, anything duplicating a feature the theme already provides — remove it. Every plugin is code you inherited and are responsible for.

Quarterly: access and posture

Audit every account with admin rights and remove the agencies, contractors and former staff who no longer need them. Enforce individual logins rather than a shared one, require two-factor authentication for administrators, and rotate any credential that has ever been sent over chat or email.

Finish with a look at the hosting layer: PHP version, TLS configuration, cache behaviour and whether the firewall rules still match how the site is actually used.