A WordPress site needs the same checks every month: backups, updates, a security scan, uptime, your domain and DNS, your forms and your analytics. Work through the list below in order. Back up first, so you can roll back anything an update breaks.
Every WhatArmy care plan runs the backup, update, security, uptime, domain and DNS checks for you, from $150 a month. See the care plans.
Every month
1. Back up the site and test a restore
Back up the files and the database, and keep the copies somewhere other than your web server. A backup you have never restored is a guess, so restore one to a staging site now and then and check that it works. Our plans back up every day and keep the copies for 30 days, 90 days or a year or more, depending on the plan.
2. Update WordPress, plugins and themes
Run the updates after the backup. Read the changelog for any major version before you click update, and try big updates on a staging site first. After updating, open the homepage, a blog post, your contact form and any page that takes payments.
3. Remove what you don’t use
Delete plugins and themes you have turned off. Code that sits on the server still gets attacked, even when it’s inactive.
4. Scan for malware and check blacklists
Run a security scan. Then check Google Safe Browsing for your domain. A site on a blacklist loses traffic and its email goes to spam.
5. Check uptime and speed
Look at last month’s uptime report. If you don’t have one, set up a monitor that checks the site every few minutes and alerts you when it goes down. Run your homepage and your busiest page through PageSpeed Insights and compare the scores with last month.
6. Check your domain, DNS and SSL certificate
Note when the domain expires and turn on auto-renew. Confirm your DNS records haven’t changed without anyone knowing. Check that the SSL certificate is valid and renews on its own. A lapsed domain takes the website and your email down together.
7. Test your forms
Fill in every form on the site and confirm the email arrives. A form can stop sending without anyone noticing. If mail doesn’t arrive, work through the email fixes.
8. Check Google Analytics and Search Console
Confirm GA4 is still recording visits and form submissions. Open Search Console and look for new errors under Pages and Core Web Vitals.
Every quarter
- Read your top ten pages for anything out of date: prices, staff, dates, offers.
- Run a broken link check and fix or redirect what it finds.
- Review user accounts. Remove anyone who has left, and give each person the lowest role they need.
- Check your privacy policy and cookie banner against the tags the site loads today. Cookie compliance covers what has to happen before a tracking tag fires.
Every year
- Renew the domain and hosting, and check the hosting plan still fits your traffic.
- Review premium plugin and theme licenses. An expired license stops the updates.
- Decide which old posts and pages to update, merge or retire.
Rather not do this yourself? Every WhatArmy care plan covers it, from $150 a month. See the care plans.
