Maintenance is not a monthly click on “update all.” A useful service preserves recovery options, makes controlled changes, exercises the site’s important functions and reports evidence. The exact checks should reflect what the website actually does.
Establish a baseline and scope
Record WordPress, PHP, theme and plugin versions, hosting limits, DNS provider, certificate dates and critical workflows. Identify custom code, licences and integrations that need special handling.
Define who may approve changes and how urgent problems are escalated. Without scope, maintenance either misses risk or changes too much.
Verify backups before updates
Confirm a recent off-server file and database backup exists, has plausible size and is readable. Periodically restore one into isolation; job-success email alone is insufficient.
Record recovery point and retention. Keep backups outside the public web directory and restrict access to personal data.
Review health and logs
Check WordPress Site Health as a lead, not a verdict. Review recent PHP, web-server and application errors for repeated failures, fatal errors and exhausted resources.
A compact useful extract might include:
timestamp | URL/task | error signature | count | first/last seenDo not publish logs containing paths, tokens, email addresses or request data.
Apply updates in a controlled order
Review changelogs, compatibility and known site customisations. Test high-risk core, PHP, WooCommerce or builder changes in staging when impact justifies it. Take a current backup immediately before production changes.
Update in small groups and validate between them. Keep a rollback package; reverting the database after new submissions can lose data.
Test critical functions
Exercise login, editor save, media, navigation, search, forms, email and scheduled tasks. Add sandbox checkout or membership tests where relevant. Confirm mobile interactions and JavaScript controls.
Automated uptime does not prove these paths work. Store test outcomes and clean up test records.
Check hosting resources
Review disk, inode usage, database size, PHP workers/memory and backup growth. Identify log floods, abandoned archives and temporary files before quotas cause an outage.
Do not delete unfamiliar files solely to reduce usage. Classify them, preserve evidence if suspicious and clean through the responsible component.
Review database and scheduled workload
Inspect table growth, failed scheduled actions and overdue cron events. Repeated queues may indicate a blocked API, insufficient workers or a plugin retrying bad data. Optimise tables only with a reason and a current backup; routine database “cleaning” can remove sessions, revisions or operational records the owner still needs.
Record which large tables are expected and compare trends month to month. Growth rate often provides a better early warning than a one-time size threshold.
Inspect security without duplicating incident response
Review administrator accounts, unexpected plugin/theme changes and available security alerts. Confirm least privilege and remove expired temporary access.
If compromise indicators appear, stop routine updates and move to an incident process that preserves evidence and checks persistence.
Verify DNS, TLS and external dependencies
Monitor certificate and domain expiry, DNS changes and third-party credential failures. Confirm SMTP authentication, API integrations and webhook health through safe test paths.
Keep a non-secret dependency register so a departing provider account does not silently own a critical service.
Report changes and unresolved risk
A monthly report should state what was checked, changed, tested, deferred and why. Include backup timestamp, versions, notable errors and recommended action with priority.
Avoid vanity scores without context. The owner needs decisions and evidence, not a long automated screenshot.
Define emergency coverage
Recurring service should state response hours, what qualifies as urgent and which work is outside scope. Keep authorised hosting and DNS access available without sharing passwords in email.
Monthly maintenance reduces avoidable emergencies, but it cannot promise zero faults. Its value is faster detection, tested recovery and a known repair route when something changes.