WordPress maintenance: a weekly, monthly and yearly checklist

WordPress itself is well maintained and rarely the problem. The risk lives in everything added on top of it, and it grows every year.

Almost half of them were cross-site scripting (XSS) flaws. The pattern is clear: every plugin you install is code you are trusting, and every abandoned plugin is a door left open.

The schedule#

Updates without surprises#

• WordPress applies minor and security releases automatically, and has done since version 3.7. Leave that switched on.
• Plugins and themes can auto-update too (since WordPress 5.5), but for a business site it is safer to batch them weekly on a staging copy and check the important pages before going live.
• Keep PHP on a supported version. PHP 7.4 stopped receiving security fixes in November 2022, yet it is still common on older hosting.

Settings worth changing#

These lines in wp-config.php close common gaps:

// Stop anyone editing theme and plugin code from wp-admin.
define( 'DISALLOW_FILE_EDIT', true );

// Keep automatic security releases for WordPress core.
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

// Always use HTTPS for logins and wp-admin.
define( 'FORCE_SSL_ADMIN', true );

Then, in WordPress itself:

• Turn on two-factor authentication for every administrator.
• Give people the lowest role that lets them do their job. Most editors do not need to be administrators.
• Delete plugins and themes you are not using, rather than just deactivating them.
• Prefer plugins with recent updates and active support. Check the “Last updated” date before installing.

Backups that actually work#

Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offsite. For a website, that usually means your host’s daily snapshot, an independent daily backup to cloud storage, and a monthly copy kept somewhere else entirely.