The difference between a WordPress site that runs for ten years and one that gets abandoned in two is not skill or budget. It is whether someone runs the same boring checklist every week.
Here is the full weekly checklist. None of this is glamorous; all of it matters.
Tuesday: maintenance day
Why Tuesday? Because Mondays are recovery from the weekend, and Friday updates lead to weekend emergencies. Pick a fixed day and do not move it.
1. Backup the site (10 minutes)
Before any update, take a fresh backup. Off-site, not on the same server. UpdraftPlus, BlogVault, or your host's native backup tool. Verify the backup actually completed — a failed backup that you did not notice is the same as no backup.
2. Update WordPress core if needed (5 minutes)
Major releases come every 4-5 months. Minor releases (5.x.1, 5.x.2) come more often and are usually security-only. Apply minor releases immediately after backup. Major releases get a 24-hour delay so any release-day bugs surface in the WordPress community first.
3. Update plugins (10 minutes)
This is where most maintenance breaks happen. Update plugins in batches of 5-10, reload the site between batches, and back out any update that breaks something. The site testing must happen on real pages — admin works, but the public site is what matters.
4. Update themes (5 minutes)
Same approach. If you have made customizations directly to a theme (rather than a child theme), updates can wipe them — verify you have a child theme structure first.
5. Visual diff check (5 minutes)
Open three or four key pages — homepage, contact, the most-used product page. Compare them to last week. Some plugin updates silently break layouts in ways that are obvious to humans but invisible to monitoring tools.
6. Clear caches (1 minute)
Object cache, page cache, CDN cache. Updates change what the site outputs; caches still hold the old version. Always clear after a maintenance run.
Daily: the lighter checks
These run automatically if you have monitoring set up.
- Uptime check every 5 minutes from at least three geographic regions.
- SSL certificate check. Most certs auto-renew, but verify weekly. An expired SSL cert breaks the site instantly.
- Malware scan daily. Wordfence does this automatically; Sucuri does it externally. Pick one.
Monthly: the bigger picture
1. Performance audit (10 minutes)
Run PageSpeed Insights and pull Core Web Vitals from Search Console. New plugins, new images, and bloat creep in over time. Catch it monthly before it gets noticed by users.
2. Database optimization (5 minutes)
WP-Optimize or equivalent. Removes post revisions, expired transients, spam comments. Always with a fresh backup first.
3. Backup restore test (15 minutes)
Restore last week's backup to a staging environment and confirm it works. A backup you have never restored is not a backup, it is hope. Once a month, prove it works.
4. Customer report
If you maintain sites for clients, send a one-page monthly report: uptime percentage, updates applied, fixes performed, any incidents. Even if nothing notable happened. Customers who see consistent reports stay; customers who hear silence churn.
What goes wrong without this
Skip maintenance for six months and you accumulate: 80+ plugin updates, several missed security patches, one or two near-miss SSL expirations, slowly degrading speed, and a backup system you have never tested. The site does not break in any single moment — it gets brittle until something small finally tips it over.
The work itself is 30-45 minutes per week per site. The real question is whether someone is reliably doing it.