The WordPress maintenance checklist for 2026
Quick answer
A complete WordPress maintenance routine for 2026 covers four layers each week: backups verified and tested, core and plugin updates applied in staging, security scans and uptime reviewed, and performance metrics checked against last month. Monthly, you also audit users, prune unused plugins, and review the database. None of these are optional if the site matters to your business.
Daily (5 minutes if monitoring is set up right)
Check uptime monitor for any incidents in the last 24 hours.
Confirm last night's offsite backup actually completed.
Glance at security scan summary for new alerts.
Weekly (30 to 60 minutes)
Apply core, plugin, and theme updates in staging first, smoke test, then promote to production.
Read PHP and server error logs for repeating warnings that hint at a future outage.
Restore the most recent backup into a sandbox and confirm it actually works. A backup you have not tested is not a backup.
Run a security scan and review the firewall log for new IPs and patterns.
Check Core Web Vitals in CrUX or PageSpeed Insights and note any regressions.
Monthly (2 to 3 hours)
Audit user accounts, remove anyone who left, rotate admin passwords.
Audit plugins: anything not updated in 12 months gets replaced or removed.
Optimize the database, prune post revisions, transients, and expired sessions.
Review pages with broken links and fix or redirect them.
Send the client a one-page summary of what was done and what changed.
Quarterly
Full security hardening review: WAF rules, file permissions, login lockout, 2FA on every admin.
Disaster recovery drill: restore the full site from cold backup to a fresh server and time it.
PHP version review. Confirm you are on a supported version.
Common questions
How long does WordPress maintenance take per week?+
For a typical business site, 30 to 60 minutes if you have monitoring and staging set up. For a fleet, you batch and automate so the per-site time drops to minutes.
Do I need a plugin like ManageWP?+
Tools help, but they do not replace judgement. A dashboard that says everything is green can still hide a failing backup or a slow query.
Want help with this?
The pages below go deeper, by service and by city.
Want this handled for you?
Book a call and we will review your site before recommending anything.