WordPress maintenance checklist: what to check every month on client sites

Most WordPress maintenance work is done the day something breaks. The monthly check is what makes those days rare. This guide is a checklist you can run on every client site once a month, in a fixed order, in about twenty to thirty minutes per site. It works with plain WordPress and the tools you already use.

Before you start: one sheet per site

A checklist only works if you know what you are checking against. Keep one short record per client site, and update it whenever something changes:

• Access. Where the site is hosted, who has an administrator account, and where the hosting and domain logins live (in your password manager, not in the sheet).
• Stack. Theme or page builder, the plugins that matter most (shop, forms, membership, multilingual) and which of them are premium with a licence.
• Key pages. The five to ten pages that must always work: homepage, contact, the pages that bring in leads or sales, and for shops the cart and checkout.
• What the client pays for. The care plan decides how deep you go each month.

1. Updates: catch up and review what changed

Start with updates, because most of the other checks only make sense on an up-to-date site.

• Open Dashboard → Updates and note what is waiting: WordPress core, plugins, themes and translations.
• Check premium plugins separately. They often only show an update when the licence is active on that domain, so an expired licence can hide a security fix for months.
• Read the changelog of anything with a major version jump, anything that touches the shop or checkout, and the page builder. These are the updates to test on a copy first; small fixes in simple plugins carry far less risk.
• Remove plugins and themes that are deactivated and no longer needed. Inactive code can still be a security risk.

If your updates run automatically during the month, this step is a review rather than a chore: look at what was updated, what was held back or failed, and why.

2. Backups: prove that you can restore

Almost every agency has backups. Far fewer have restored one recently. Once a month:

• Check that the last backup is recent and complete: both the files and the database, not just one of them.
• Check where backups are stored. A backup that only lives on the same server as the site disappears with that server.
• Restore one backup to a separate location, such as a staging site or a local copy, and open a few pages. Too much for every site? Rotate, so each site is tested a few times a year.
• Before a big change, like a redesign or a move to new hosting, make an extra backup that you keep longer than the usual retention.

3. Security: users, vulnerabilities and surprises

• Users. Go through Users and filter on Administrator. Remove former staff, freelancers who finished their job and accounts nobody recognises.
• Known vulnerabilities. Compare the installed plugins and themes with a vulnerability database, or use a security plugin that does this for you. Prioritise anything rated high or critical, and anything for which no fix exists yet.
• Unexpected content. Search the site for links to pharmacies, casinos or other spam. Injected links are a common sign of a hack.
• Logins. Make sure administrators use strong, unique passwords, and turn on two-factor authentication where the client agrees.

4. Health: PHP, SSL, domain and disk space

Tools → Site Health in WordPress is a good starting point; it flags an outdated PHP version, missing modules and failing scheduled tasks. Add a few checks it does not cover:

• PHP version. Note which version each site runs and when it stops receiving security support. Plan upgrades ahead of time, after checking that the theme and plugins support the newer version.
• SSL certificate. Check that it renews automatically and when it expires.
• Domain. Note the renewal date. An expired domain takes the site and the client’s email down at once.
• Disk space and limits. A full disk breaks backups and updates first. Check free space, and the PHP memory limit if the site is large.
• Errors. Look at the PHP error log, or ask the host for it. A fatal error that only appears on one page can go unnoticed for weeks.

5. Speed and findability

• Run Google PageSpeed Insights on the homepage, on mobile and desktop, and write down the scores. One measurement says little; the trend over a few months shows whether a plugin, a new script or growing content is slowing the site down.
• Check that the site is visible to search engines: Settings → Reading should not have “Discourage search engines from indexing this site” ticked, and the homepage should have a title, a meta description and no noindex. If you have access to Google Search Console, look at the indexing report and any new errors.
• Remove what slows the site down: oversized images, unused plugins that still load scripts, and old revisions in the database (back up first).

6. Content: links, forms and checkout

• Check for broken links and images, starting with the site’s own pages. Links to other sites break silently when those sites move or disappear.
• Submit every important form once, and check that the message arrives where the client expects it. Mail delivery often breaks without any error on the site.
• On shops, add a product to the cart and open the checkout. Do not place a real order on a live shop unless the client has agreed to a test order and knows how it will be cancelled.
• Click through the key pages on a phone. Layout problems after an update are often visible only at mobile width.

7. The monthly report

Clients do not see maintenance; they only see the invoice. A short report changes that. Keep it to one page, in the client’s language:

• What was updated, and anything that was held back and why.
• Backups: when the last one ran, and when a restore was last tested.
• Security: vulnerabilities fixed, users removed, anything that needs the client’s decision.
• Speed and findability: the scores and the trend, with one recommendation at most.
• What you suggest for next month, such as a PHP upgrade or a renewal that needs the client’s card.

Run the checklist in the same order every month, and keep notes per site. After a few rounds you will see which sites need more attention.

How Verploy handles the monthly checklist

Verploy runs most of this checklist daily. Every update is checked, and the risky ones are tested on a copy first: Verploy compares key pages on desktop and mobile, tests forms and the checkout on the test copy, and only then puts the update live, with an automatic rollback if something breaks after going live. Backups run nightly on the hosting the client already has, are encrypted and stored in the EU, and a restore test shows that a backup can be restored without touching the live site. The site page shows PHP version, SSL, disk space and known vulnerabilities, fatal PHP errors on the live site, a daily PageSpeed score, findability of the homepage in Google, and broken links and images. The monthly client report brings it together with your own logo, in the client’s language. More on the WordPress maintenance for agencies page.