--- title: "What monthly WordPress care actually includes" description: "A WordPress care checklist: tested updates, recoverable backups, monitoring, security, forms, checkout and a clear monthly report." url: "https://djwp.xyz/blog/monthly-wordpress-care-checklist/" date_modified: "2026-09-08" Category: "Website care" --- # What monthly WordPress care actually includes > Monthly care should cover routine updates tested on a staging copy before release (with urgent security fixes handled promptly), backups stored off the server and test-restored periodically, uptime and error monitoring, security housekeeping such as user accounts and PHP versions, and functional checks of forms, checkout and search visibility. A short monthly note should say what changed and what needs a decision. ## Why care is more than updates WordPress sites rarely break in dramatic ways. More often, a contact form stops sending, a plugin update changes a layout on one template, an old administrator account is forgotten, or a [noindex](/glossary/#noindex) setting survives a staging copy into production. These problems can go unnoticed for weeks unless someone checks the site’s settings and customer journeys. This is the checklist we work through on sites we look after. You can use it to check what your current provider does, or to do it yourself. ## Updates, tested before release - **Routine updates to core, plugins and themes** go to a [staging copy](/glossary/#staging-environment) first, then are checked on the key templates: home, a service page, a blog post, the contact page and, for stores, product, cart and checkout. - **Changelogs are read** for major versions. A plugin that changes its settings screen or drops a feature deserves a decision, not an automatic update. - **Urgent security fixes** do not wait for the monthly round: they go out promptly, with a recoverable backup and checks proportionate to the risk. - **Stale plugins are reviewed.** A long gap between releases or a closure in the WordPress.org directory is a reason to check compatibility and security status, and to plan a calm replacement if needed. - **PHP version** is kept on a supported release. Old PHP versions stop receiving security fixes, and hosts eventually force upgrades on their own schedule. ## Backups you can actually restore Check where your host stores backups, how long it keeps them and whether you could recover them if the hosting account became unavailable. A useful backup routine has three parts: automatic backups of files and database, [a copy stored somewhere else](/glossary/#off-site-backup), and a periodic test restore to a separate environment, especially after the backup process changes. ## Monitoring that tells you first - **[Uptime monitoring](/glossary/#uptime-monitoring)** from outside the server, with alerts to someone who will act on them. - **Error logs** reviewed for new PHP warnings and fatal errors, which often appear before visitors notice anything. - **SSL certificate and domain renewal** dates, which still cause outages on otherwise healthy sites. - **[Core Web Vitals](/glossary/#core-web-vitals)** and page speed, checked after updates that touch the theme or add scripts. ## Security housekeeping - Review user accounts: remove people who no longer need access, and make sure each person has their own login with the lowest role that works. - Require strong passwords and two-factor authentication for administrators. - Confirm file permissions and that debug output is off in production. - Check that the site is not listing directories or exposing backups and logs publicly. ## Functional and search checks - **Send a test enquiry** through every form and confirm it arrives. Email delivery breaks quietly when DNS, hosting or a mail plugin changes. - **For stores, test checkout** on staging with the payment provider’s test mode, and check stock changes, tax, shipping and order emails. - **Search Console**: look for new indexing errors, manual actions, sudden drops in indexed pages and sitemap problems. Confirm the [robots.txt](/glossary/#robots-txt) file and the WordPress search-visibility setting have not changed. - **Broken links and redirects** after content changes, especially when pages are renamed or removed. ## A short monthly note Care should end with a few lines in plain language: what was updated, what was checked, anything that failed and was fixed, and anything that needs your decision, such as a plugin to replace or a PHP upgrade to schedule. That note is also a record when something goes wrong months later. Small content edits and minor fixes often fit into the same routine. If you are inheriting a site with no history at all, start with the list in [what to send before a website fix](/blog/what-to-send-before-website-fix/). Our [support and maintenance](/services/support-maintenance/) page describes how we handle this for clients. ## Key takeaways - Routine updates go to a staging copy first; urgent security fixes go out promptly, with a backup ready.- Keep an independent backup copy and test a restore periodically.- Forms, checkout and search visibility can fail silently; test them, do not assume.- A short monthly report turns maintenance from a black box into decisions you can make. ## Questions ### Can I just turn on automatic updates? For minor WordPress core releases, which are mostly security and maintenance fixes, automatic updates are sensible. For plugins and themes, especially on stores or sites with custom code, test routine updates on a staging copy first. An automatic update that breaks checkout at night is costly. ### How often should backups run? Choose a schedule based on how much recent content or order data the business can afford to lose. Whatever the schedule, keep a copy off the server and test a restore periodically. ### Is a security plugin enough? It helps, but it does not replace updates, strong unique logins, two-factor authentication for administrators, removing unused accounts and plugins, and backups you can restore. ## Sources - [Hardening WordPress (WordPress Developer Resources)](https://developer.wordpress.org/advanced-administration/security/hardening/)- [Backing up WordPress (WordPress Developer Resources)](https://developer.wordpress.org/advanced-administration/security/backup/)- [Supported PHP versions (php.net)](https://www.php.net/supported-versions.php)- [Page indexing report (Search Console Help)](https://support.google.com/webmasters/answer/7440203) --- **[Read full article: What monthly WordPress care actually includes](https://djwp.xyz/blog/monthly-wordpress-care-checklist/)**