Why Monthly, Not Whenever Something Breaks
A WordPress site isn't a brochure you print once. Plugins, themes and WordPress itself release updates constantly, hosting environments change underneath you, and the forms and payment flows your business relies on can quietly stop working without anyone noticing. Thirty to sixty minutes a month, done in the same order every time, catches most problems while they're still small. The checklist below is the routine we'd suggest for a typical small business site; a busy WooCommerce store will want some of these steps more often.
1. Check Your Backups Before Anything Else
Before you update anything, confirm that backups are actually running and that the latest one completed successfully. Check that copies are stored off-server — not just on the same hosting account as the site — so a hosting problem doesn't take your backups with it. Make sure you know how far back they go. And every few months, test a restore to a staging site: a backup you've never restored is an assumption, not a safety net. If a backup hasn't run, fix that first and leave the updates until you have a good one.
2. Update Core, Plugins and Themes — Carefully
Apply WordPress core, plugin and theme updates, but don't click 'update all' and walk away. Skim the changelogs for major version jumps, update anything business-critical (WooCommerce, page builders, membership or booking plugins) on a staging site first where you can, and check the site straight afterwards. While you're there, delete plugins and themes you no longer use rather than just deactivating them — inactive code can still carry vulnerabilities. Keep one default WordPress theme installed as a fallback, and look out for plugins that haven't been updated in a long time or have been closed on WordPress.org; those need replacing, not ignoring.
3. Review Who Has Access
Go to Users and check every account with Administrator or Editor access. Remove former staff, old freelancers and agencies you no longer work with, and downgrade anyone who has more access than they need. Make sure admin accounts use strong, unique passwords and two-factor authentication. Glance at your security plugin's scan results and any blocked login attempts, and check that your SSL certificate and domain name aren't close to expiry — an expired domain or certificate can take a site offline just as effectively as a hack.
4. Check Site Health and Your PHP Version
WordPress has a built-in Site Health screen (Tools → Site Health) that flags common problems like outdated software, missing modules and failed scheduled tasks — worth a two-minute look every month. Pay particular attention to PHP. WordPress.org currently recommends PHP 8.3 or greater, and according to php.net, PHP 8.2 stops receiving security fixes on 31 December 2026. If your host still runs your site on 8.2 or older, plan the upgrade now: test it on staging first, because older plugins and themes are usually what breaks.
5. Test the Things That Make You Money
Updates can break things that look fine on the surface. Submit every important form yourself and confirm the email actually arrives, including checking it hasn't landed in spam. If you take bookings or payments, run a test transaction end to end. Click through your main navigation and key landing pages on a phone as well as a desktop. Check Google Search Console for new crawl errors, 404s or indexing problems, and review your uptime monitoring for any outages during the month. Ten minutes here can save weeks of lost enquiries you never knew about.
6. A Quick Performance and Housekeeping Pass
Run your homepage and one or two key pages through PageSpeed Insights and compare the results with last month — a sudden drop usually points to a new plugin, an oversized image or a third-party script. Clear out spam comments and, with a fresh backup in place, let your optimisation plugin tidy old revisions and expired data from the database. Finally, keep a simple log of what you updated, what you checked and anything odd you noticed. When something does go wrong, knowing what changed and when makes it far quicker to fix.
Doing It Yourself vs Handing It Off
Everything on this list is within reach of a confident site owner — the hard part is doing it every month without fail. If it keeps slipping down the to-do list, that's exactly what our WordPress maintenance and support plans are for: updates, backups and routine checks handled on a regular schedule, so it doesn't depend on someone remembering. Either way, the important thing is that someone owns the routine. If you're not sure what state your site is in right now, our free website audit is a good starting point.