Most small business WordPress sites don’t fail all at once. They drift: updates pile up, a plugin nobody uses stays installed, a former contractor still has an administrator login, and one day the contact form stops delivering and nobody notices for weeks.
This checklist turns maintenance into a routine you can run yourself or hand to a vendor. The rhythm in the table at the end is a starting point; adjust it to how busy and how complex your site is.
1. Keep WordPress, plugins and themes updated
WordPress’s own hardening guide is blunt: older versions are not maintained with security updates. CISA makes the same point for all software: many updates exist to fix security problems, and it recommends turning on automatic updates where you can.
- Since WordPress 5.5, administrators can turn on automatic updates plugin by plugin (Plugins screen) and theme by theme (Appearance screen). By default WordPress checks for these twice a day and emails the site owner about successes and failures.
- Decide which plugins update automatically and which you update by hand. Low-risk utilities are good candidates for auto-updates. Plugins that run your store, bookings or page layouts are safer updated manually, with a backup first and a check afterward.
- If automatic updates don’t seem to run, open Tools, then Site Health. Auto-updates depend on WordPress’s scheduled tasks, and Site Health reports when those are failing.
- Read the update emails. A failed update you never look at is the same as no update.
2. Backups you have actually restored
A backup you have never restored is a hope, not a plan. The WordPress hardening guide calls for regular backups of the whole installation, files and database, kept in a trusted place, and for database backups you have tested and can easily restore.
- Files and database, bothThe database holds your pages and settings; the files hold uploads, themes and plugins. A backup missing either can’t rebuild the site.
- Stored off the serverIf the backup lives on the same hosting account, a hosting problem or a hacked account can take both.
- Kept long enoughKeep older copies as well as the latest. If a problem went unnoticed for weeks, you need a backup from before it started.
- Restore-tested on a scheduleRestore a recent backup to a staging copy and click through it. Write down how long it took; that is your real recovery time.
3. Admin accounts and multi-factor sign-in
In WordPress, an Administrator can do everything on a single site; an Editor can publish and manage everyone’s posts and pages; an Author can publish only their own. Give each person the lowest role that lets them do their job.
- List every user under Users. Remove former staff, old agencies and test accounts, or lower their role.
- Avoid obvious administrator usernames such as “admin”. The hardening guide suggests renaming an account that uses one.
- Use long, unique passwords from a password manager or generator, never your business name or a dictionary word.
- Turn on two-step (multi-factor) sign-in for every administrator. WordPress recommends it and points to two-factor plugins in the WordPress.org directory. CISA explains why it works: a stolen password alone is no longer enough to get in.
4. Audit your plugins
Every plugin is code running on your site. The hardening guide says to delete plugins you don’t use and to stick to the WordPress.org directory or well-known companies, never untrusted sources.
A plugin audit you can do in twenty minutes
- Question
- Is it active and doing a job you can name?
- If the answer is no
- Deactivate, test the site, then delete it.
- Question
- Does its WordPress.org page show a recent “Last updated” date?
- If the answer is no
- Look for a maintained alternative.
- Question
- Is it “Tested up to” a recent WordPress version?
- If the answer is no
- Treat it as a risk and plan a replacement.
- Question
- Did it come from WordPress.org or a known vendor?
- If the answer is no
- Replace it. Don’t keep “nulled” or unofficial copies.
- Question
- Is it the only plugin doing this job?
- If the answer is no
- Two plugins doing the same job, such as caching or SEO, often overlap or conflict. Keep one.
| Question | If the answer is no |
|---|---|
| Is it active and doing a job you can name? | Deactivate, test the site, then delete it. |
| Does its WordPress.org page show a recent “Last updated” date? | Look for a maintained alternative. |
| Is it “Tested up to” a recent WordPress version? | Treat it as a risk and plan a replacement. |
| Did it come from WordPress.org or a known vendor? | Replace it. Don’t keep “nulled” or unofficial copies. |
| Is it the only plugin doing this job? | Two plugins doing the same job, such as caching or SEO, often overlap or conflict. Keep one. |
5. Uptime, forms and the things owners never see
- Uptime monitoringAn external monitor that alerts you by email or text when the site stops responding. Make sure the alert goes to someone who will act on it.
- Form deliverySubmit every form and confirm the message reaches the inbox, not spam. Repeat after any change to plugins, email, DNS or hosting.
- Phone and booking linksTap the call button and open the booking link on a phone. Third-party booking pages change their links more often than you’d think.
- SpeedRe-check speed after adding plugins or large images. A free website teardown or PageSpeed test shows when the site slows down.
- Domain and certificate renewalsConfirm the domain is on auto-renew in an account the business controls, and that the HTTPS certificate renews without anyone stepping in.
6. A maintenance rhythm
A suggested routine for a typical small business site
- How often
- Weekly
- What to do
- Read update and uptime emails. Apply or schedule pending updates.
- How often
- Monthly
- What to do
- Test every form and the call button. Check Site Health. Re-check speed.
- How often
- Quarterly
- What to do
- Restore a backup to staging. Review users and roles. Run the plugin audit.
- How often
- Yearly
- What to do
- Review hosting, domain and certificate renewals, and who holds each login.
| How often | What to do |
|---|---|
| Weekly | Read update and uptime emails. Apply or schedule pending updates. |
| Monthly | Test every form and the call button. Check Site Health. Re-check speed. |
| Quarterly | Restore a backup to staging. Review users and roles. Run the plugin audit. |
| Yearly | Review hosting, domain and certificate renewals, and who holds each login. |
7. What to ask a WordPress maintenance vendor
If someone else looks after your site, these questions show quickly whether they have a real process. Good answers are specific.
- Which updates do you apply, how often, and what do you do before and after each one?
- Where are backups stored, how long are they kept, and when did you last test a restore?
- If an update breaks the site, how do you roll it back, and how will I hear about it?
- Who has administrator accounts on my site, and is multi-factor sign-in turned on for all of them?
- Do you test that forms actually deliver, or only that they submit?
- What do you report each month, and in what form?
- What is not included, such as content changes, hacked-site cleanup or plugin licences?
- Are the domain, hosting and every login in my business’s name, and can I leave with everything if I change providers?
Sources
Official documentation we checked when writing this guide.