WordPress Maintenance: What I Actually Do Every Month

Website maintenance is one of those line items that turns up on an invoice and nobody can quite tell you what it bought. I have sat with small businesses in Hull paying forty quid a month for what turned out to be a plugin emailing a backup to somebody who left the company in 2023.

So here is the actual list. This is what I do on a WordPress site I look after, roughly in the order I do it, and what happens if you skip each one.

Updates, on a copy first

Core, plugins and themes all get updates, and most of them are fine. The ones that are not will take your site down on a Tuesday morning.

So updates go onto a staging copy first. I run them there, click through the pages that matter, the homepage, a service or product page, the contact form, and only then do the same on the live site. Twenty minutes instead of two. Those eighteen extra minutes are the entire job.

If your site auto-updates everything with nobody watching, you are running a small lottery every week.

Check the backup actually restores

Almost everyone has backups. Far fewer people have ever restored one.

Once a month I take the most recent backup and restore it somewhere that is not the live site, then look at it. Twice in my career that has caught a backup which had been silently failing for weeks. A backup you have never tested is a hope, not a backup.

The plugin audit

Every site I inherit has plugins nobody uses. A slider from the old design. Two SEO plugins quietly fighting each other. Something a previous developer installed to solve one problem in 2021 and never took out.

Each one is code running on every page load and another possible way in. I go down the list and ask one question: does this do something the business needs. If nobody can answer, it comes out, after a backup.

This is usually where the speed comes from too. Removing four plugins beats most of what a caching plugin will do for you, which is half of what I do on a slow site.

PHP version and hosting

Old PHP versions stop getting security fixes. Hosts do not always move you along, and plenty of sites are sat on a version that went out of support a while back. I check it, and if it is behind I test the bump on staging before asking the host to change anything.

I also look at whether the hosting plan still fits. A site that has doubled its traffic on the same cheap shared plan feels slow for reasons no plugin will fix.

Does the contact form still work

This is the one that costs real money and nobody notices.

Forms break quietly. A plugin update changes something, the hosting mail setup shifts, an email provider tightens its rules, and enquiries stop arriving while the business assumes it is a quiet month. I send a test through every form on every site I look after, every month, and read it at the other end.

If you do nothing else off this list, do that one.

Speed, and whether it changed

I run the homepage and one inner page through a speed test and write the numbers down. That is mostly to spot a change rather than to chase a perfect score. A site that was fine last month and slow this month has had something added to it, and it is far easier to find that when you know it happened in the last four weeks.

The boring security checks

• Admin accounts: who still has one, and does that person still work there

• Failed login attempts, and whether that number has jumped

• SSL certificate expiry, because auto-renewal does occasionally fail

• Broken links and 404s, which annoy people and waste Google's time

• Search Console, for anything it has flagged since last month

What I do less often

Not everything is monthly. Every three months or so I look at the bigger picture. Is the content still true. Are the opening hours right. Are there pages nobody has visited in a year. Does the site still say what the business actually does now, which changes more often than people expect.

Can you just do this yourself

Yes, honestly. If you are comfortable in WordPress, the form test, the admin account check and the plugin audit are the three highest value things on the list, and none of them need a developer. Do those every quarter and you will dodge most of the disasters I get called about.

What you are paying someone for is the staging setup, somebody noticing the PHP version before it bites, and being able to ring a person when it does break rather than starting a search for a developer with your site already down.

How I do it

I look after a handful of WordPress sites in and around Hull on this basis. No plugin bundle, no dashboard you have to log into. You get a short email each month saying what I did, what I changed and anything I think you should know about.

If you are not sure what your current maintenance is buying you, book the free thirty minute surgery and bring your last invoice. I will tell you straight whether it looks like decent value.