WordPress Maintenance Checklist 2026: Weekly and Monthly Must-Do Checks

---

Why I Built This Maintenance Routine

The database crash of 2024 wasn't dramatic. There was no warning, no obvious sign. One morning my site just... stopped loading. After 6 hours of debugging, the culprit was clear: wp_postmeta had 2.3 million rows, most of them orphaned garbage from deleted plugins and drafts. I had to rebuild from a week-old backup and lost several reader comments permanently.

That's when I created this checklist. Three years later, I run through it every month like clockwork. My sites went from "constantly having issues" to "set it and forget it for months."

The routine has three tiers: Weekly (15 minutes), Monthly (45 minutes), and Quarterly (2 hours). You don't do everything at once—you spread it out.

Weekly Tasks (15 minutes)

1. Check WordPress Dashboard Notifications

Every time I log into wp-admin, the first thing I look at is the top notification bar. WordPress 6.9 has improved notification categorization, but alerts still appear there first—plugin conflicts, theme errors, update notifications. Ignoring them is the fastest way to let a small problem become a disaster.

2. Update Plugins and Themes

I do this Wednesday mornings. My workflow:

1. Enable maintenance mode (5 minutes)

2. Batch update all plugins and themes

3. Check the site frontend after each major update

4. Disable maintenance mode

Critical rule: Always test updates on a staging environment first. This habit alone has prevented at least 5 production incidents on my watch.

My actual tools:

• Managed WordPress: Use the dashboard auto-update
• VPS self-hosted: SSH in and run `wp plugin update --all`

3. Verify Backup Status

Every Friday I open UpdraftPlus (or whichever backup plugin is installed) and confirm:

• The most recent backup completed successfully
• The backup file size looks reasonable (no zero-byte files)
• I can actually restore from the backup if needed

If a backup failed, I immediately trigger a manual backup and investigate. No exceptions.

Monthly Tasks (45 minutes)

4. Database Cleanup

This is the step most WordPress owners skip, and it's the #1 cause of slow sites. I access phpMyAdmin or SSH directly and run these SQL commands:

DELETE FROM wp_posts WHERE post_status = 'trash';
DELETE FROM wp_postmeta WHERE post_id NOT IN (SELECT ID FROM wp_posts);
DELETE FROM wp_commentmeta WHERE comment_id NOT IN (SELECT comment_id FROM wp_comments);
DELETE FROM wp_options WHERE autoload = 'yes' AND option_name LIKE '%_transient_%';

These clean up: trash posts, orphaned metadata, orphaned comment metadata, and expired transients. After running these on a typical 2-year-old WordPress site, database size drops 15-30%.

Never run these without a full backup first.

5. Review All User Accounts

I go to Users → All Users and check:

• Any unknown administrator accounts?
• Any accounts that haven't logged in over 90 days?
• Are all passwords strong (upper+lower+number+symbol)?

If I find a suspicious account, I delete it immediately. If I find weak passwords, I force a reset. In 2026, automated attacks scan for default admin accounts and brute-force weak passwords daily.

6. Plugin Audit

My rule: keep total plugin count under 15. If a plugin hasn't been updated in 3+ months, I either find a replacement or remove it entirely.

My audit process:

1. Plugin list → sort by "Last Updated"

2. Plugins not updated in 6+ months get marked red

3. Evaluate if each red plugin is truly necessary

4. Remove anything that isn't essential

7. SSL Certificate Check

I use this command to check certificate expiry:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

If the certificate expires in less than 30 days, I renew immediately. An expired SSL certificate triggers "Not Secure" warnings in browsers, tanking both SEO and reader trust.

Quick check command:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | grep "Not After"

Quarterly Tasks (2 hours)

8. Full Speed Test and Optimization

I run full PageSpeed Insights tests every quarter. Target metrics:

• First Contentful Paint: < 1.5 seconds
• Largest Contentful Paint: < 2.5 seconds
• Cumulative Layout Shift: < 0.1

If scores drop below 60, I take action:

1. Remove unused CSS/JS (Asset CleanUp plugin)

2. Convert all images to WebP and compress to under 1920px

3. Check server TTFB—if it's over 500ms, it's time to upgrade VPS

My recommended tools: Google PageSpeed Insights + GTmetrix + WebPageTest

9. Complete Security Scan

Once per quarter I manually run through these checks:

1. Wordfence file integrity scan—check for any modified core files

2. Review error_log for repeating PHP errors

3. Inspect .htaccess and wp-config.php for suspicious modifications

If anything looks off, I restore the file from the most recent clean backup and investigate how the modification happened.

10. Content Health Check

• Check for broken links (Ahrefs or Screaming Frog)
• Update outdated content (anything not touched in 18+ months)
• Remove thin content pages (under 300 words of actual content)

2026-Specific Considerations

WordPress 6.9 Collaboration Features

WordPress 6.9 introduced improved block collaboration features. If your team uses Gutenberg, ensure everyone knows how to use the new annotation system to avoid content conflicts during simultaneous editing.

PHP Version Check

WordPress 6.9 requires minimum PHP 8.1. Check your version:

php -v

If you're still on PHP 7.4 or earlier, upgrade now. PHP versions below 8.0 are no longer receiving security updates—staying on them is an open invitation for hackers.

Plugin Compatibility with Gutenberg 12.x

In 2026, many older plugins have conflicts with Gutenberg 12.x block editor. If a plugin's block editor stops working, the first thing to check is when the plugin was last updated.

My Actual Tool Stack

• **Backup**: UpdraftPlus (free tier is sufficient)
• **Security**: Wordfence (free tier includes firewall + malware scan)
• **Performance**: WP Super Cache + Asset CleanUp
• **Monitoring**: UptimeRobot for VPS setups
• **Database**: WP-Optimize

Quick Reference Checklist (Print and Pin It)

Weekly (15 minutes):
□ Check dashboard notifications
□ Update plugins and themes
□ Verify backup running

Monthly (45 minutes):
□ Clean database
□ Review user accounts
□ Audit plugin necessity
□ Check SSL certificate expiry

Quarterly (2 hours):
□ PageSpeed test + optimize
□ Full security scan
□ Content health check
□ Verify PHP version

The Bottom Line

WordPress maintenance doesn't require being a developer. What it requires is consistency. Build the habit before you need it, not after a crash. In my experience, after the first three months of strict adherence, the monthly check becomes muscle memory—30 minutes and you're done.

Your site stability isn't luck. It's process.

---

*Tools I actually use: Vultr VPS (my blog's server—reliable and good value) | DigitalOcean (great for beginners, transparent pricing)*