WordPress Maintenance Checklist for Bloggers: Weekly to Yearly

A good WordPress maintenance checklist splits the work by cadence: back up and update weekly, check PHP, Site Health and Search Console monthly, test a restore and prune plugins quarterly, and review hosting and your domain yearly. Most blogs need about an hour a month, all with free tools, to block the usual causes of hacks and outages.

This blog maintenance checklist is the do-it-yourself version of what maintenance companies charge a monthly fee for. Every task comes with a short how-to and a free tool, and the summary table doubles as a printable page you can tick off each month. If you only have 15 minutes today, start with the quick-start list.

Short on time? Do these five things today

On October 21, 2026, the PHP project shipped an emergency release to fix PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a web server without logging in. WordPress runs on PHP, so every self-hosted blog is in scope. The official PHP security advisory says updating is the only complete fix, because no configuration change fully closes the hole.

1. Back up now. Run your host's backup tool or a free backup plugin, and download one copy to your computer.
2. Check your PHP version. Go to Tools > Site Health > Info > Server. You want PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same branch.
3. Ask your host if you are behind. On shared hosting, the host installs patch releases. If your number is lower, open a support ticket and ask when the patched build arrives, or switch to a patched branch in your control panel.
4. Install pending updates. Open Dashboard > Updates and update plugins, themes and WordPress itself.
5. Check that nothing broke. Load your homepage, a recent post and the login page in a private browser window.

If you run PHP 8.1 or older, the PHP project no longer ships regular releases for your version, so moving to a supported branch is now urgent rather than optional.

The WordPress maintenance checklist at a glance

If you have ever wondered how to maintain a WordPress website without paying anyone, this table is the answer on one page. Print it or copy it into a notes app, and work down it on a fixed day. Each task is explained in the sections below.

Your first pass will take longer than these times. After two or three rounds, the routine gets fast because you know where everything lives.

What should you do every week?

Weekly maintenance comes down to two things: a fresh backup and current software. Together they take about 20 minutes, and they matter most on the day something goes wrong.

Back up your files and your database

A WordPress backup has two halves. The database holds your posts, comments and settings, while the files hold your themes, plugins, uploads and the wp-config.php file. You need both to restore a site, and downloading your files does not capture the database.

The WordPress backup handbook suggests weekly backups for smaller sites and daily backups for busy ones, and recommends keeping several recent copies in different places. A free setup that meets that bar:

• Turn on your host's automatic backups if your plan includes them.
• Add a free plugin such as UpdraftPlus and send copies to Google Drive or Dropbox.
• Download one full backup to your own computer each month.

That gives you three copies in three places, so one failed backup or a locked hosting account never wipes out your work.

Update plugins, themes and WordPress core

Open Dashboard > Updates after your backup finishes, not before. Read the list, then update in small batches and reload the site between batches, so you know which update caused any problem. By default, WordPress installs minor core releases, which carry security fixes, on its own; major releases wait for you.

Plugin auto-updates are worth turning on for small, well-maintained plugins. Keep large plugins that control your layout or store, such as page builders and shop plugins, on manual updates so you can check them yourself. When a changelog mentions a security fix, install it the same day.

Check that the site works

Open your homepage, a recent post, your contact page and the login screen in a private browser window, and send yourself a test message through your contact form. Between checks, a free uptime monitor such as UptimeRobot emails you when your site stops responding, which beats hearing about an outage from a reader.

Clear spam and check your users

Empty the spam folder under Comments, then glance at Users. An administrator account you did not create is a red flag for a hacked site: change your passwords, remove the account and scan the site with a security plugin straight away.

What belongs in a monthly WordPress maintenance routine?

Monthly checks catch slow problems: an aging server setup, pages slipping out of Google and load times that creep up. Block out about 45 minutes on the same day each month, such as the first Monday.

Check your PHP version and patch level

PHP is the language WordPress runs on, and your host decides which versions you can pick. The current WordPress requirements recommend PHP 8.3 or greater. Each PHP branch gets two years of bug fixes and two more years of security fixes, then reaches end of life and stops receiving patches.

Find your exact version under Tools > Site Health > Info > Server and check two numbers: the branch (such as 8.3 or 8.4) and the patch release after it. This table shows where each branch stands as of October 2026.

In cPanel, the version switch usually sits under MultiPHP Manager or Select PHP Version, while managed hosts put it in the site settings. Switch on a staging copy first if your host offers one, click through your key pages, and switch back if anything breaks.

Run WordPress Site Health

WordPress Site Health, under Tools > Site Health, is a free built-in checkup that many bloggers never open. Its Status tab sorts findings into critical issues, recommended improvements and passed tests, and its Info tab lists your server, database and plugin details.

Fix critical issues first. Common ones include an outdated PHP version, plugins waiting for updates, background updates that fail and error messages shown to visitors. Recommended improvements are usually smaller, such as removing inactive themes. Collect anything you cannot fix yourself into one support ticket for your host; the Info tab has a button that copies all your site details for them.

Review Google Search Console

Search Console shows problems your dashboard never will: pages Google cannot index, security warnings and manual penalties. If you have not connected your blog yet, start by learning how to set up Google Search Console.

Each month, open the Pages report and compare the indexed count with last month. A sudden drop, or a growing list of pages crawled but not indexed, points to a technical or quality problem worth fixing before it spreads. Then open the Security issues and Manual actions reports; both should say no issues were detected.

Find and fix broken links

Broken links frustrate readers and waste the value your links pass around your site. Check the Not found (404) row in the Pages report, then run the free version of a crawler such as Screaming Frog SEO Spider to catch dead outbound links. While you fix them, add a few links from newer posts to older ones using a simple internal linking system.

Check page speed

Run your homepage and your most visited post through PageSpeed Insights, a free Google tool, and note the scores in a spreadsheet. You are watching for change, not chasing a perfect score. A sudden slowdown usually traces back to a new plugin, an oversized image or a hosting problem, and it is far easier to find in the month it starts.

Which WordPress maintenance tasks should you do every quarter?

Quarterly tasks are the ones people skip, and they decide whether a bad day becomes a disaster. Put them on your calendar for January, April, July and October.

Test-restore a backup

A backup you have never restored is a hope, not a plan. Restore your latest backup to a staging site (many hosts include one) or to a local copy using a free tool such as Local, then click through a few pages and log in. The WordPress handbook also advises checking automated backups against an occasional manual one, to confirm the process actually works.

Delete unused plugins, themes and users

Every inactive plugin and theme is code that can still be attacked, even when it is switched off. Delete anything you have not used in three months, but keep one default WordPress theme as a fallback. On WordPress.org, a plugin page warning that it has not been tested with the latest three major releases is a sign the plugin may be abandoned, so look for a maintained alternative.

Under Users, remove people who no longer write for you, and move anyone who only writes posts from Administrator down to Author or Editor.

Clean the database

Post revisions, spam comments and expired temporary data called transients pile up in the database over time. A free plugin such as WP-Optimize clears them in a few clicks. Take a fresh backup first. To slow the buildup, you can cap revisions by adding this line to wp-config.php:

define( 'WP_POST_REVISIONS', 10 );

Refresh your best posts

Maintenance is not only technical. Pick the five posts that bring in the most search traffic and check their facts, dates, screenshots and outbound links. Out-of-date advice on a popular post costs you reader trust every day it stays live.

Then run each post through a free SEO page audit and fix what it flags. Change the published date only when you have made real updates.

For the post that earns the most, go one step further and work through an on-page SEO checklist line by line.

What should you check once a year?

Yearly tasks protect the things outside WordPress that your blog depends on: your domain, your host and your accounts.

Domain, hosting and SSL

Log in to your domain registrar and confirm that auto-renew is on, the card on file has not expired and the contact email is one you still read. A lapsed domain takes your blog offline, and once the grace period ends someone else can register it.

Then review your hosting plan with three questions. Does the host offer PHP 8.3 or newer? Are automatic offsite backups included? What will the plan cost at renewal, since introductory prices often rise? Finally, confirm your SSL certificate (the padlock that enables HTTPS) renews automatically. Many hosts issue free certificates that do, but check yours.

Passwords, two-factor and admin accounts

Change your WordPress admin and hosting passwords if you have ever shared them, and store them in a password manager. Turn on two-factor authentication for every administrator with a free plugin such as Two Factor or the security plugin you already use. Remove access for anyone who no longer needs it.

Privacy policy and cookie consent

WordPress includes a privacy policy helper under Settings > Privacy. Review your policy each year against the plugins, analytics and ad networks you actually run. Rules differ by country: in the UK, sites need consent before setting non-essential cookies such as advertising cookies, while US rules vary by state. If you use Google AdSense, Google requires a certified consent tool for visitors from the UK, the European Economic Area and Switzerland. Treat this as general information, not legal advice.

What do you do when an update breaks your site?

Even careful updates fail now and then. Work from the gentlest fix to the most drastic:

1. Check your email. When a plugin or theme causes a fatal error, WordPress emails the site admin a recovery mode link that lets you log in and deactivate the culprit.
2. Disable the plugin by hand. If you cannot log in, open your host's file manager or an SFTP app, go to wp-content/plugins and rename the folder of the plugin you just updated, for example by adding -off to its name. WordPress deactivates it.
3. Do the same for a theme. Rename the active theme's folder in wp-content/themes, and WordPress falls back to a default theme if one is installed.
4. Restore your backup. If the site is still broken, restore the backup you took before updating, then update again one item at a time.
5. Report it. Post the error on the plugin's support forum so the developer can fix it.

Keep a simple maintenance log, even a note with the date, what you updated and anything odd you saw. When something breaks weeks later, the log tells you where to start looking.

Do you need a paid WordPress maintenance plan?

Most search results for this topic are agencies selling monthly care plans. They can be worth it for some sites, but a personal blog rarely needs one if you follow the routine above.

Prices for hosting and care plans change often, so compare current offers on each provider's official pricing page. If you are still building a blog that makes money, put your budget into content and do the maintenance yourself until the site earns enough to justify paying someone.

Whatever you choose, keep your own offsite backup and your own logins. A plan should save you time, not lock you out of your own site.