A good website maintenance checklist breaks the work into weekly, monthly, quarterly and annual habits, so nothing important waits until something breaks. For a WordPress site that means tested backups, timely updates, security checks, speed monitoring, and a regular test of the forms that bring you leads. Most of it takes under two hours a month once the routine is in place.
In short:
- Weekly: confirm backups ran, apply updates (on a staging copy for anything big), and check that uptime and your contact form still work.
- Monthly: scan for malware, review users and plugins, check Core Web Vitals, and fix broken links and 404s.
- Quarterly: test a full backup restore, audit Search Console and analytics, and refresh your key pages.
- Annually: review hosting and PHP version, renew domain and SSL, and decide whether the site still fits the business.
- Doing it yourself works if you have the time and a staging site. Hiring it out makes sense when downtime would cost you real jobs or leads.
Why a maintenance routine matters for a Charleston business site
A website is not a brochure you print once. WordPress core, your theme and every plugin ship updates on their own schedules, hosting platforms change their software, and search engines change what they reward. A site that nobody checks slowly drifts: forms stop emailing, pages slow down, and a plugin with a known vulnerability sits unpatched.
The WordPress.org developer documentation is direct about this. Its Hardening WordPress guide tells site owners to keep WordPress and plugins current, remove plugins they do not use, and keep regular backups, including the database. None of that is exotic. It simply has to happen on a schedule.
The cost of skipping it is usually quiet. You do not get an alarm when a contact form stops sending, you just get fewer calls. That is why this checklist puts lead-routing tests next to security and speed. If your site already seems to underperform, our guide to why a Charleston website isn’t generating leads covers the bigger picture.
The cadence at a glance
Use this table as the one-page version. Time estimates are rough planning figures for a small business site with a handful of plugins, not measured benchmarks. A larger site, an online store or a heavily customized build will take longer.
| Cadence | Core tasks | Rough time (estimate) |
|---|---|---|
| Weekly | Confirm backup ran, check uptime alerts, apply updates, submit a test form | 15 to 30 minutes |
| Monthly | Malware scan, user and plugin review, speed check, broken links, Search Console errors | 1 to 2 hours |
| Quarterly | Test a backup restore, analytics and conversion check, content refresh, accessibility spot-check | 2 to 4 hours |
| Annually | Hosting and PHP review, domain and SSL renewal, plugin cleanup, plan for redesign or rebuild | Half a day |
Weekly tasks: the quick health pass
Confirm your backups ran
A backup you never check is a hope, not a backup. Each week, open your backup tool or host dashboard and confirm a recent copy of both files and database exists, and that it is stored somewhere other than the same server. The WordPress.org hardening guide recommends keeping periodic snapshots of the whole installation, including the database, in a trusted location, and notes that a tested backup matters most before updates that change the database.
Apply updates, with a safety net
Security and bug-fix releases for core, plugins and themes should go on promptly. For anything that touches checkout, booking or forms, test the update on a staging copy first, then push it live. Take a fresh backup immediately before you update. If you run many plugins, expect some weeks to need more attention than others.
Check uptime and run a test lead
Free uptime monitors will email or text you when the site goes down, so you are not relying on a customer to tell you. Then do the check most checklists skip: submit your own contact form with a test name and confirm two things. First, the notification email arrives (including in spam). Second, the lead lands in your CRM or booking tool with the right source. A form that submits cleanly but routes nowhere is one of the most expensive silent failures a small business site can have.
Monthly tasks: security, speed and links
Security review
- Users: remove accounts for former staff and contractors, and make sure only people who need administrator access have it.
- Two-factor authentication: the WordPress.org guidance recommends two-step authentication and strong, unique passwords. Confirm it is on for every admin.
- Login protection: limit login attempts or use a security plugin that throttles repeated failures.
- Malware scan: run a scan with your security plugin or host tool and review anything flagged.
- Unused plugins and themes: deactivate and delete what you are not using. Every installed plugin is something that needs patching.
Speed and Core Web Vitals
Run your key pages through PageSpeed Insights and check the Core Web Vitals report in Google Search Console. Google’s web.dev documentation defines the “good” thresholds, measured at the 75th percentile of page loads: Largest Contentful Paint at 2.5 seconds or less, Interaction to Next Paint at 200 milliseconds or less, and Cumulative Layout Shift at 0.1 or less.
If a page slips, the usual fixes for WordPress are the same few: compress and properly size images, remove plugins you do not need, use caching, and make sure hosting is not the bottleneck. Hosting matters more than most owners expect, which is why we treat it as part of the build on our managed WordPress hosting page rather than an afterthought.
Broken links, 404s and redirects
Scan for broken internal and outbound links, then check Search Console for pages returning 404. When you move or rename a page, add a 301 redirect to its closest replacement so visitors and search engines land somewhere useful. Redirect chains (A to B to C) are worth flattening while you are in there.
Quarterly tasks: prove it works
Test a real restore
Once a quarter, restore your latest backup to a staging site and confirm the pages, images, forms and logins all work. This is the only way to know your backups are usable. It is also the task most often skipped, and the one you will be most grateful for after a bad update or a hack.
Search Console and indexing
Review the indexing report for pages that are excluded or erroring, confirm your sitemap is submitted and current, and look for sudden drops in impressions on your top pages. A noindex tag left over from a staging build is a classic way to disappear from Google without noticing.
Analytics and conversion tracking
Confirm that your analytics tag fires on every page and that your conversion events (form submissions, calls, bookings) still record. Compare the number of leads in your inbox or CRM to the number your analytics reports. A big gap means tracking is broken somewhere.
Content freshness and accessibility spot-check
Review your service pages, pricing language, hours, staff pages and any dated claims. Outdated details cost trust. While you are there, run a quick accessibility pass: image alt text, color contrast, keyboard navigation and form labels. Our website accessibility checklist walks through it in more detail.
Annual tasks: the foundations
- Domain and SSL renewal: confirm auto-renew is on, the payment card is current, and the registrant email is one you still read. An expired certificate throws a browser warning that scares visitors away.
- PHP version and hosting: check that your host runs a supported PHP version and that your plugins are compatible with it. Hosting that was fine three years ago may be holding the site back now.
- Plugin and theme audit: replace abandoned plugins, consolidate overlapping ones, and cut anything redundant.
- Big-picture review: ask whether the site still reflects the business. If you are patching around an outdated design, these signs your site needs a redesign will help you decide.
What a WordPress care plan should cover
If you decide to hand this off, here is what to look for in any care plan, from any provider:
- Automated off-site backups, plus a restore test on a stated schedule.
- Core, plugin and theme updates with staging for risky changes.
- Uptime monitoring with a named person who responds.
- Security scanning, login protection and user audits.
- Monthly performance and Core Web Vitals review.
- Form and lead-routing tests, not just “the site loads.”
- Clear reporting in plain English, and a defined response time for problems.
We cover how one local plan is structured in our Charleston WordPress care plan article, so this checklist stays focused on the tasks themselves.
DIY or hire it out?
Doing it yourself is realistic if you are comfortable in the WordPress dashboard, have a staging environment, and will actually put the weekly and monthly blocks on your calendar. It is the cheapest option in dollars, and the most expensive in attention.
Hiring makes sense when any of these are true: the site drives a meaningful share of your leads or revenue, you run bookings or e-commerce, you have had a plugin conflict or hack before, or you simply would rather spend those hours on customers. The middle path is also common: you handle content and test leads, and a professional handles updates, backups, security and speed. If you are weighing outside help, our piece on how to hire a WordPress developer in Charleston covers what to ask.
What does website maintenance cost?
We are not going to quote a market average here, because published ranges vary widely by provider, site complexity and what is included, and we would rather not repeat a figure we cannot verify. A fair way to compare is by scope: ask each provider what is covered (backups, updates, security, speed, lead testing, support hours), how often they do it, and what happens when something breaks outside the plan. A cheap plan that only runs updates is not the same product as one that tests restores and your contact form. Get written scopes and compare like for like.
How CORE CONNECT helps
The CORE Team builds and looks after WordPress sites for Charleston and Mount Pleasant businesses, and we treat maintenance as part of results, not a separate chore. If you would like a second set of eyes on your site, or want to know which of these tasks are overdue, book a conversation with the CORE Team. We will tell you what we see, and if DIY is the right answer for you, we will say so.
