The WordPress maintenance checklist small businesses actually need
By Axyra Nova Editorial · 25 August 2026 · 5 min read · WordPress
A WordPress site is closer to a car than a brochure. It runs on a stack of software that keeps changing underneath it: the WordPress core, a theme, a dozen or more plugins, PHP on the server, and the browsers your customers use. When any one of those moves and nobody is watching, something eventually breaks. A form stops sending, a page slows to a crawl, or a security hole stays open for months.
The good news is that a simple, boring routine prevents almost all of it. This WordPress maintenance checklist is the one we use for small business sites. It is split into weekly, monthly and quarterly tasks so it fits around real work.
Why maintenance matters more than design
A beautiful site that loads slowly, shows a broken contact form or gets flagged as unsafe by a browser loses customers quietly. People rarely complain; they just leave. Maintenance protects three things:
- Revenue. Enquiry forms, booking widgets and checkout pages are where money arrives. If they fail silently, you lose leads you never knew existed.
- Reputation. A hacked site that redirects visitors to spam does real damage, and cleaning it up costs far more than preventing it.
- Search visibility. Google's guidance on page experience and helpful content rewards sites that load well and work reliably. You can read its own advice in the Search Essentials.
If you want a quick view of how your site is doing today, our agents run a site audit that checks for broken links, missing meta descriptions, mobile problems and slow pages.
Weekly tasks (15 minutes)
1. Check that your forms still arrive
Send a test message through every contact, quote and booking form. Confirm it lands in the right inbox and not in spam. This single habit catches more lost business than anything else on this list.
2. Review updates waiting in the dashboard
Open Dashboard → Updates. Note what is waiting, but do not click "update all" blindly on a live site. Small plugin updates are usually safe; major version jumps deserve a backup first and a quick test afterwards. The official Updating WordPress guide explains how core updates work.
3. Glance at uptime and errors
If you use an uptime monitor, check for any outages. If your host provides an error log, skim it for repeated PHP warnings. A plugin that throws errors every few seconds is a plugin about to cause trouble.
Monthly tasks (45 minutes)
4. Take and verify a backup
A backup you have never restored is a hope, not a backup. Once a month, download a full copy (files and database) and store it somewhere other than your hosting account. Every quarter, restore it to a staging site to prove it works. We cover a tested routine in WordPress backups that actually restore.
5. Apply updates in a safe order
- Back up.
- Update plugins one at a time on a staging copy if you have one.
- Update the theme.
- Update WordPress core.
- Click through your key pages: home, contact, booking, checkout.
If something breaks, you know exactly which update caused it.
6. Remove what you do not use
Deactivated plugins and unused themes still sit on the server and can still contain vulnerabilities. Delete them. Fewer moving parts means fewer things to patch and a faster site.
7. Check speed on a phone
Run your home page and your most visited page through PageSpeed Insights. Focus on the mobile result. Large images, too many fonts and heavy page builder sections are the usual culprits. Our guide to making an Elementor site load fast covers the fixes that matter most.
8. Scan for broken links
Old blog posts link to pages that have moved. Partners change their URLs. A monthly broken link check keeps visitors and search engines from hitting dead ends. Read more in Broken links: how to find them and why they cost you customers.
Quarterly tasks (2 hours)
9. Review user accounts and passwords
Remove accounts for people who no longer work with you. Make sure every administrator uses a strong, unique password and two-factor authentication. The WordPress hardening guide lists the settings that matter.
10. Check your PHP version and hosting
Ask your host which PHP version the site runs on. Old versions stop receiving security fixes and run slower. Most hosts let you switch versions from the control panel; test on staging first.
11. Audit your SEO basics
Look at page titles, meta descriptions, headings and image alt text on your top ten pages. Make sure your sitemap is submitted in Google Search Console. Google's SEO starter guide is a clear reference for what to check.
12. Review content that has gone stale
Prices change, staff leave, services evolve. Outdated content confuses customers and erodes trust. Update or remove anything that is no longer true, including the copyright year in the footer.
A simple maintenance log
Keep a one-page log with the date, what you updated, any problems, and how you fixed them. When something goes wrong six months from now, that log turns a two-day investigation into a ten-minute one. A shared spreadsheet is enough.
| Date | Task | Result | Notes |
|---|---|---|---|
| 1 Oct | Plugin updates (6) | OK | Booking plugin needed cache clear |
| 1 Oct | Backup + restore test | OK | Restored to staging in 12 min |
When to hand it off
If this routine feels like one more job you will never get to, it is worth paying someone to do it. A maintenance retainer usually costs far less than a single emergency clean-up. Whoever does it should give you a monthly report showing what was updated and what was found.
If you want to understand the platform yourself first, the free Beginner WordPress User course is a solid start, and the official WordPress documentation answers most day-to-day questions.
Frequently asked questions
How often should I update WordPress plugins?
Check weekly and apply updates monthly, or sooner for security releases. Always back up first and test key pages afterwards.
Is it safe to turn on automatic updates?
Automatic minor core updates are generally safe and recommended. Automatic plugin updates are convenient but can break things on complex sites, so enable them selectively for well-maintained plugins.
What is the single most important maintenance task?
A tested backup stored off the server. With a working backup, almost every other problem becomes recoverable.
How long does monthly maintenance take?
For a typical small business site, under an hour a month once the routine is set up. Use a plan that fits your workload if you would rather have agents track it for you.