WordPress powers a huge share of the web, which makes it the most attacked platform on the web, and the sites that get hurt are overwhelmingly the neglected ones. Almost every WordPress emergency, the hack, the white screen, the lost database, is deferred maintenance arriving with interest. The routine that prevents them fits in a calendar.
Weekly: the fifteen-minute pass
- Apply plugin, theme, and core updates, after your backup runs, not before.
- Skim the site: homepage, a post, a form submission; monitoring tells you it is up, only eyes tell you it is right.
- Clear the comment and form spam queue before it becomes archaeology.
Monthly: the health check
Verify a backup by actually restoring it somewhere, since an untested backup is a hope, not a plan. Review users and remove departed admins. Check Site Health for PHP version warnings and run a scan with your security plugin. Then audit the plugin list with one question per row: what would break if I deleted this? Deactivated plugins are still attack surface; remove them entirely.
Quarterly: the deeper look
Update PHP to a supported version on staging first; the performance gain is free. Prune post revisions and orphaned tables bloating the database. Re-test the site on mobile and check Core Web Vitals, because themes and tag managers drift slower every quarter. Review admin passwords, enforce two-factor, and confirm your license keys and renewals will not lapse silently.
Or outsource the calendar
None of this is hard; it is just relentlessly forgettable, which is why maintenance contracts exist. Whether it is your team or a vendor, the deliverable is the same: a boring site, and boring is what winning looks like in operations.