This is the actual routine behind healthy WordPress sites. Whether you do it yourself or pay someone, this is what “maintained” means. Copy it.
Weekly (± 30 minutes)
- Update plugins, themes and core — one at a time, checking the site after each. Never batch-update blind.
- Confirm backups ran — a backup system that silently stopped is worse than none, because you’ve stopped worrying.
- Skim the site — homepage, contact form (send a real test), checkout if you sell. Two minutes.
- Check uptime reports — any outages your monitor caught?
Monthly (± 1 hour)
- Run a malware scan and review the results, don’t just run it.
- Audit users — remove accounts that shouldn’t exist, downgrade roles that don’t need admin.
- Test a restore — restore last week’s backup to a staging area. A backup you’ve never restored is a hope, not a plan.
- Clean the database — spam comments, post revisions, expired transients.
- Check speed — one PageSpeed test on your homepage; investigate if it’s drifted.
- Review forms and emails — deliverability rots quietly.
Quarterly (± 1 hour)
- Remove unused plugins and themes — deactivated code is still attack surface.
- Check PHP version against what your host offers.
- Review SSL certificate renewal and expiry.
- Walk the site as a customer — every menu item, every key journey, on a phone.
- Check Google Search Console for crawl errors, security flags, and dead pages.
The honest question
That’s roughly 4–6 hours a month, done carefully, every month, forever. If you’ll genuinely do it — brilliant, this checklist is yours. If you know you won’t (most owners stop by month three), that’s exactly what a flat-fee plan is for. This checklist is literally what WP Hero does, from R499/month.