The WordPress Maintenance Routine That Prevents Disasters

Weekly: the fifteen-minute pass

• Apply plugin, theme, and core updates, after your backup runs, not before.
• Skim the site: homepage, a post, a form submission; monitoring tells you it is up, only eyes tell you it is right.
• Clear the comment and form spam queue before it becomes archaeology.

Monthly: the health check

Verify a backup by actually restoring it somewhere, since an untested backup is a hope, not a plan. Review users and remove departed admins. Check Site Health for PHP version warnings and run a scan with your security plugin. Then audit the plugin list with one question per row: what would break if I deleted this? Deactivated plugins are still attack surface; remove them entirely.

Quarterly: the deeper look

Update PHP to a supported version on staging first; the performance gain is free. Prune post revisions and orphaned tables bloating the database. Re-test the site on mobile and check Core Web Vitals, because themes and tag managers drift slower every quarter. Review admin passwords, enforce two-factor, and confirm your license keys and renewals will not lapse silently.

Or outsource the calendar

None of this is hard; it is just relentlessly forgettable, which is why maintenance contracts exist. Whether it is your team or a vendor, the deliverable is the same: a boring site, and boring is what winning looks like in operations.