FIELD GUIDE · MAINTENANCE

A practical WordPress maintenance and recovery routine

Build a reliable process around backups, updates, access and regular checks—without treating maintenance as a one-click task.

A healthy WordPress site is not a site that never needs attention. It is a site whose owner can notice a problem, understand the likely impact and recover with confidence. That requires a routine: protect the data, make changes deliberately, check important journeys and keep a record. The exact schedule depends on how quickly your content and customer data change, how important the site is to your work, and the support available from your host.

This guide is a practical starting point, not a guarantee against outages or attacks. Use the instructions that apply to your own hosting environment, and involve a qualified professional for unfamiliar server, database or security work. A staging environment makes testing safer; it does not eliminate the need for a complete backup or an agreed rollback plan.

Start with an inventory

List the site’s domain registrar, hosting provider, WordPress administrator accounts, theme, plugins, backup location and any connected services. Record who owns each account and how to contact the provider during an outage. Keep this inventory in a secure location accessible to authorized people. Do not store passwords or recovery codes in an unprotected document; use an appropriate password manager.

Identify the journeys that matter most. For an information site, those may be navigation and contact. A store may also depend on checkout, payment confirmations and fulfillment; a membership site may depend on sign-in and access rules. Write a short test for each journey, including what a successful result looks like. These tests become your checklist after updates and restores.

Check the WordPress dashboard under Tools → Site Health for issues and information about the installation. Treat the results as useful signals, not a substitute for monitoring or professional assessment. Record WordPress, PHP, plugin and theme versions before making significant changes, so you can explain the environment if something fails.

Make backups useful, not merely automatic

A complete WordPress backup needs both the database and the site files. The database holds content and settings; uploads, plugins, themes and other files are separate. Understand which parts your host or backup tool captures, how often it runs and how long each copy is retained. Confirm that backups are protected from unauthorized access and stored separately from the site where appropriate.

Choose frequency according to the amount of data you can afford to lose. A site that receives orders throughout the day has different needs from a rarely changed brochure site. Schedule a backup before updates or major configuration changes, and keep more than one recovery point. If a backup fails silently, the schedule provides no protection, so review notifications and logs.

Test restoration periodically on an isolated staging site. Check that the restored database, media, theme and plugins work together and that important pages load. Document who can perform the restore, how long it takes and what happens to content or transactions created after the backup. Never restore over a production database without considering what recent data would be replaced.

Keep your backup access separate from the site’s ordinary administrator access when practical. If an account or server is compromised, copies stored only in the same environment may also be at risk. Ask your provider about retention, encryption, off-site storage and recovery procedures. A backup is valuable because it can be restored, not because a dashboard shows a green check.

Plan updates in small, observable steps

Keep WordPress core, active plugins and themes supported and up to date. Read release notes and compatibility information, especially for major updates or extensions central to the site. Automatic updates can be appropriate, but their behavior depends on the installation and configuration; check your own settings rather than assuming every component updates itself.

Before a planned update, take a verified backup and test the current critical journeys. On a staging copy, update one component or a small related group, then repeat the checks. Note versions and results. If you encounter a problem, compare logs and recent changes, and consult the developer’s documentation. Schedule production changes when someone is available to monitor the site and roll back if necessary.

After updating production, check the public home page, a typical content page, navigation, login and the contact form. Include any store, booking or membership workflow that matters to the site. Test in a private browser window and on a phone-sized viewport. Clear caches if needed, then confirm the new version is actually being served. A successful update message does not prove that every customer journey works.

Remove unused extensions only after checking whether their data is needed and what uninstalling does. Deactivation and deletion are not the same operation. Keep a record of decisions and avoid leaving unsupported software active indefinitely. Do not modify a parent theme’s files directly; updates may replace them. A child theme or an appropriate custom plugin can keep intentional customizations separate.

Review access and security

Give each person their own account with only the permissions they need. Review administrator access regularly, remove access when it is no longer needed, and protect recovery methods. Use unique passwords and a password manager. Where supported, enable multi-factor authentication and keep recovery codes in a secure place. Never share a single administrator account simply for convenience.

Review hosting, registrar, DNS, backup and email accounts too. A strong WordPress password cannot protect a site if an attacker controls its domain or hosting account. Ask your provider how it handles account recovery and security notifications. Keep contact information current so important alerts reach someone who can act.

Check the installed plugins and themes for anything unexpected. Monitor security notices from the software you actually use and act according to the severity and your risk. Security plugins and firewalls may help, but no single tool guarantees safety. If you suspect compromise, preserve evidence, contact the host, follow a recovery plan and check for unauthorized accounts or changes after cleanup.

Keep sensitive logs and backups private. Error messages, database exports and configuration files may reveal personal information or credentials. Share only what a trusted support person needs, and use a secure channel. Do not expose debug output to visitors, and do not leave temporary troubleshooting settings enabled after the investigation.

Check performance and availability with context

Visit the site as a logged-out user and note whether pages load and key actions work. Monitor availability if your hosting plan or monitoring service supports it. An alert should lead to a concrete response: who receives it, what they check and when they escalate. A monitoring service can have its own false alarms, so confirm the symptom before changing the site.

For performance, compare the same page under similar conditions and look for changes after releases. Large images, caching configuration, slow plugins, server resources and third-party services can all affect loading. Optimize based on evidence rather than disabling features indiscriminately. Record the page, device, location and test conditions; a single score is not a complete description of user experience.

Review broken links and redirects as content changes. Test important pages on desktop and mobile, including keyboard navigation and readable text. Check that images have appropriate alternative text and that interactive controls are understandable. Accessibility is an ongoing practice, not a one-time badge, and automated checks do not replace human testing.

Test contact forms and email delivery

Identify the real mailbox that should receive submissions and confirm someone monitors it. Send a test from the published form using an address you can access. Confirm that the success or error message is understandable, that the message reaches the intended inbox and that a reply goes to the submitter. Check the spam folder and repeat from another mailbox if delivery is inconsistent.

Use a valid sender address on the site’s domain and configure the form’s reply-to field for the visitor’s address where supported. Your email provider or host can help set up authenticated sending and DNS records such as SPF and DKIM. A form reporting that it sent a message does not prove the message arrived. Check the actual inbox and message headers, and resolve delivery issues before launch.

Tell visitors what information you collect and how it is used in an appropriate privacy notice. Avoid requesting passwords, payment details or authentication codes through a general contact form. Agree on who can access messages, how long they are retained and how deletion requests will be handled. Review applicable privacy and legal requirements with a qualified adviser; a generic template cannot decide what your site needs.

Use a repeatable schedule

Frequently: review availability and important alerts, confirm backups completed, and inspect critical business journeys. The right interval can be daily or more frequent for an active site and less frequent for a small, low-change site. Investigate a failed backup promptly rather than waiting for the next routine review.

Regularly: review available updates and relevant security notices, apply tested changes, inspect administrator access and check your contact inbox. Confirm that monitoring reaches a person who can act. Record unusual changes and support requests in a simple maintenance log.

Periodically: perform a restore test, review plugins and themes, check external links and run through mobile and accessibility checks. Verify account owners and emergency contacts. Compare actual recovery time with your expectations and adjust the process if it takes too long or depends on one unavailable person.

Prepare a recovery playbook

Write down how to reach the host, find logs, access backups and temporarily take an affected feature offline. Identify who can approve a restore and who communicates with users. Include a decision point for transactional data: determine which orders, bookings or submissions could be lost and how they will be reconciled. Practice on staging before an emergency.

When an incident occurs, record the symptom and time, protect the current state, then make one change at a time. Restore only when the scope and consequences are understood. After service returns, test the original failure and the critical journeys, document what is known and create follow-up actions. If the cause is uncertain, distinguish a hypothesis from a confirmed finding.

Further reading: WordPress backups · Updating WordPress · Site Health · Contact Form 7 mail best practices.