A very common call we get: the contact form stopped sending emails, and nobody noticed for weeks. The site looked fine and loaded fine, but every inquiry went nowhere. That is what poor WordPress website maintenance usually looks like. Nothing dramatic happens. Small things break quietly, and you find out late.
The short answer: a WordPress site needs a light check every week and a proper round of checks once a month. That covers updates, backups, security, uptime, speed, broken links, forms, SSL and Google Search Console. Below is the exact monthly checklist we follow and how often each task should run. We also cover what a maintenance plan costs in India in 2026, and when it makes sense to do it yourself versus handing it to someone.
Why WordPress Website Maintenance Matters
WordPress is not a “build once and forget” system. Your site runs on WordPress core, a theme, a set of plugins, a PHP version on the server and a database. Each of these gets updated by different people on different schedules. When one moves and the others don’t, things can break.
Plugins are the most common weak point. In most hacked WordPress sites, the way in is an outdated plugin, not WordPress core itself. A plugin that was safe last year might have a known security hole today, and bots scan the web for exactly those holes.
Regular maintenance is cheaper than fixing a hacked site, and it keeps rankings steady.
The Monthly WordPress Maintenance Checklist
Here is the list we work through on client sites. Some items run daily on autopilot. The monthly pass is where a person confirms it all works.
1. Take a backup before you touch anything
Backups come first, always. Before any update, take a full backup of files and database. Beyond that, you want automatic backups running on a schedule: daily for shops and sites that change often, weekly for simple brochure sites.
Two rules matter more than the tool you use. Keep at least one copy off the server (cloud storage, not just your hosting account). And test a restore now and then. A backup you have never restored is a guess, not a backup.
2. Update WordPress core, plugins and themes
Minor WordPress releases (security and bug fixes) usually update on their own. Major releases, plugins and themes need attention. Our approach:
- Read the changelog for big plugin updates, especially page builders, WooCommerce and form plugins.
- Test updates on a staging copy first if the site makes money or has custom code.
- Update one group at a time, then check the front end. If something breaks, you know what caused it.
- Delete plugins and themes you don’t use. Deactivated plugins still sit on the server and can still be exploited.
Also check your PHP version in the hosting panel. Old PHP versions stop getting security fixes, and newer plugins slowly stop supporting them.
3. Run a security check
A security plugin or server-level scanner should run daily. Once a month, review what it found. Look at:
- Malware scan results and any changed core files.
- The list of admin users. Remove old staff, freelancers and anyone who no longer needs access.
- Failed login attempts. A spike means someone is trying to brute-force their way in, so make sure login limits and two-factor login are on.
- Plugins that have been removed from the WordPress.org directory or not updated in a long time. Those are good candidates to replace.
4. Check uptime
Set up an uptime monitor that pings your site every few minutes and alerts you by email or WhatsApp if it goes down. In the monthly review, look at the downtime log. Short blips are normal. Repeated outages at the same time of day usually point to a hosting limit.
5. Test page speed
Run your home page and two or three key pages (a service page, a product page, the checkout) through PageSpeed Insights each month. You’re not chasing a perfect score. You’re watching for a sudden drop. A drop means something changed: a new plugin, a huge image, a new tracking script.
6. Find and fix broken links
Links break when pages get renamed or deleted, or when the sites you link to go away. Run a crawl with a link-checking tool once a month. Fix internal broken links directly, and set up 301 redirects for any old URLs that still get visits or have backlinks pointing to them.
7. Test every form
This is the one people skip, and it’s the one that costs the most. Fill in every form on the site yourself: contact, quote request, newsletter signup, booking. Check that the email arrives, that it doesn’t land in spam, and that any connected tools (CRM, Google Sheets, WhatsApp alerts) actually received the entry.
Forms break silently because WordPress sends mail through the server by default, and hosting mail is unreliable. Using a proper SMTP setup fixes most of this, but you still need to test.
8. Confirm the SSL certificate
Most hosts renew free SSL certificates automatically, but renewals can fail, especially after a DNS change or host migration. Check the expiry date once a month. Also check for “mixed content” warnings, where some images or scripts still load over plain http and the padlock disappears.
9. Review Google Search Console
Search Console tells you what Google sees. Each month, look at:
- Page indexing report: are important pages dropping out of the index?
- Core Web Vitals: any pages flagged as poor on mobile?
- Security and manual actions: this should always be empty.
- Performance: a sharp fall in clicks often means a technical problem, not just a ranking change.
If you’re also investing in rankings, this monthly check feeds straight into your SEO services work. A site that is technically healthy is much easier to rank.
10. Quick content and admin tidy-up
Update the footer year, old offers and outdated prices. Clear spam comments and old revisions. Check your sitemap still loads. It takes minutes and stops the site looking abandoned.
WordPress Maintenance Checklist Table (With Frequency)
Save this table. It shows how often each task should run for a typical business site. Busy online stores should move most items one step more frequent.
| Task | How often | Automated or manual | What to look for |
|---|---|---|---|
| Full backup (files + database) | Daily for shops, weekly for brochure sites | Automated | Off-site copy exists, restore tested every few months |
| Plugin and theme updates | Weekly or every two weeks | Manual review | Changelog notes, front end still works after update |
| WordPress core updates | Minor: automatic. Major: within a few weeks of release | Mixed | Compatibility with theme and key plugins |
| Malware and security scan | Daily | Automated | Changed files, suspicious users, login attempts |
| Uptime monitoring | Every 1 to 5 minutes | Automated | Repeated outages, slow response times |
| Page speed test | Monthly | Manual | Sudden drops on key pages |
| Broken link scan | Monthly | Tool + manual fixes | 404s, old URLs needing redirects |
| Form testing | Monthly, and after every update | Manual | Email delivered, not in spam, CRM received it |
| SSL certificate check | Monthly | Manual | Expiry date, mixed content warnings |
| Search Console review | Monthly | Manual | Indexing drops, Core Web Vitals, security issues |
| Database cleanup | Monthly | Plugin or manual | Revisions, spam, expired transients |
| User and access review | Quarterly | Manual | Old admins, shared logins |
| PHP version check | Quarterly | Manual | Version still getting security support |
What Goes Wrong When a WordPress Site Is Left Alone
Plenty of sites are built well and then not touched for a year or two. The problems that follow are almost always the same:
- Hacked site with spam pages. Hundreds of pages selling pills or betting links appear in Google under your domain. Cleanup takes time, and getting Google to trust the site again takes longer.
- Update gap too big to jump. When a site is two years behind, updating everything at once often breaks the theme or page builder. What would have been ten small updates becomes a repair job.
- Host forces a PHP upgrade. Hosts retire old PHP versions. An outdated theme then throws a fatal error and the site shows a blank white page.
- Dead forms and lost leads. Like the broken form in the opening example, inquiries vanish and nobody knows.
- Expired SSL or domain. Browsers show a “Not secure” warning and visitors leave. Or worse, the domain itself lapses.
Sometimes a neglected site is past saving and a rebuild costs less than patching it. That’s a call we make case by case as part of our website development services.
WordPress Maintenance Plan Cost in India (2026)
Prices vary a lot, so here are typical ranges we see in the Indian market in 2026, and what drives them. USD is in brackets for overseas clients.
| Plan type | Typical monthly cost | Usually includes | Good for |
|---|---|---|---|
| Basic care | ₹2,000 to ₹5,000 ($25 to $60) | Updates, backups, uptime and security monitoring, monthly report | Small brochure sites with few plugins |
| Standard business | ₹5,000 to ₹12,000 ($60 to $145) | Everything in basic, plus staging tests, speed checks, form testing, broken links, Search Console review, 1 to 3 hours of small edits | Service businesses that depend on leads |
| WooCommerce / high traffic | ₹12,000 to ₹30,000+ ($145 to $360+) | Daily backups, checkout and payment testing, priority support, more edit hours, performance tuning | Online stores, membership and booking sites |
What pushes the price up:
- Number of plugins and custom code. More moving parts means more testing after each update.
- Ecommerce. A broken checkout costs real money every hour, so stores need tighter checks and faster response. If you run a store, this goes hand in hand with good ecommerce website development from the start.
- Response time promises. “Fixed within 4 hours” costs more than “fixed within 2 working days”.
- Included edit hours. Some plans are pure maintenance. Others include time for content changes and small new features.
- Who built the site. Taking over an unknown site usually needs a one-time audit and cleanup before the monthly plan starts.
Be careful with very cheap plans that just click “update all” with no backup or testing.
DIY vs Hiring Someone for WordPress Maintenance
You can do this yourself. Plenty of small business owners do. It comes down to time, comfort and how much the site matters to your income.
DIY works when
- The site is simple, with a well-known theme and under 15 plugins.
- You’re comfortable restoring a backup if an update goes wrong.
- A day of downtime would be annoying but not costly.
- You will actually block an hour on the calendar every month and stick to it.
Hiring makes sense when
- The site brings in leads or sales every day.
- It has custom code, WooCommerce, a booking system or a membership area.
- You don’t know how to fix a white screen or a plugin conflict.
- Your time is better spent on the business.
A middle path also works: you handle content and form tests, and a developer handles updates, backups and security. Agencies and businesses with many sites sometimes go further and bring in a dedicated WordPress developer who looks after the whole portfolio.
Frequently Asked Questions
How often should a WordPress website be maintained?
Backups, security scans and uptime monitoring should run automatically every day. Plugin updates are best checked weekly or every two weeks. A full manual review of speed, forms, links, SSL and Search Console should happen once a month.
Is it safe to turn on auto-updates for all plugins?
For small, simple plugins it is usually fine. For page builders, WooCommerce, form plugins and anything with custom code, auto-updates can break the site without anyone noticing. Update those manually after a backup, and test afterwards.
What does a WordPress maintenance plan cost in India?
In 2026, typical plans range from about ₹2,000 a month for a basic brochure site to ₹30,000 or more for a busy WooCommerce store. The price depends on plugin count, custom code, ecommerce, response times and how many edit hours are included.
Does my hosting company handle WordPress maintenance?
Usually only partly. Most hosts take server backups and keep the server running, and managed WordPress hosts may update core. They generally don’t test your plugins, forms, speed or Search Console. That part is still on you or your developer.
What should I do if my WordPress site gets hacked?
Change all passwords (WordPress, hosting, database, FTP), restore from a clean backup if you have one, then update everything and remove unused plugins. If there is no clean backup, get a developer to do a proper malware cleanup.
Keep Your Site Healthy Without the Monthly Headache
WordPress website maintenance is not hard, but it has to happen every month, not once a year when something breaks. Use the checklist and table above. If you’d rather have someone else handle updates, backups, security and monthly checks, our team in Kolkata looks after WordPress sites for businesses in India and overseas. Get in touch with us and tell us about your site. We’ll start with a quick health check and suggest a plan that fits.
