WordPress sites do not fail suddenly; they decay quietly until something visible breaks. Maintenance is the discipline that interrupts the decay — and it only happens when it has a schedule. Here is the rhythm we run, sized so it actually gets done.
Weekly — about 30 minutes
- Updates: core, themes, plugins — read the changelogs of anything major, update on staging first if the site earns money.
- Backups: confirm this week’s backups actually ran and are stored off-site. An unverified backup is a hope, not a backup.
- Security scan and a scroll through the security log for anomalies.
- Click the money paths: homepage, a key landing page, the contact form, checkout if you sell.
Monthly — about an hour
- Performance: spot-check Core Web Vitals in Search Console; investigate regressions while they are fresh.
- Database: prune revisions, expired transients, spam; watch the autoload size.
- Users: remove departed people, question every administrator account.
- Forms and email: submit each form; confirm notifications arrive (mail silently breaking is a classic).
- 404s: scan Search Console for new broken URLs worth redirecting.
Quarterly — a deeper session
- Restore drill: restore a backup to staging and boot it. This is the step everyone skips and the one that matters most.
- Stack review: PHP version current? Any plugin abandoned by its developer? Anything installed that nothing uses?
- Licences and renewals: premium plugin keys, domain and SSL expiry dates.
- Content pass: outdated prices, dead offers, stale team pages — decay users actually see.
The honest question
None of this is hard; all of it is relentless. If three months of it will realistically never happen in-house, that is not a personal failing — it is a staffing decision, and it is precisely what a maintenance plan exists to absorb. What matters is that the rhythm runs — not who runs it.