Site compromises we investigate are rarely sophisticated. They are usually a known vulnerability in a component that had an update available, an administrative account that should have been removed, or a credential reused from somewhere that was breached. Maintenance is unexciting and it is what actually prevents these.

Weekly

  • Apply security updates to your platform, plugins, themes, and dependencies.
  • Check that backups ran and that the most recent one is a sensible size.
  • Scan error logs for repeated failures — they frequently precede an outage.
  • Confirm forms and checkout still work end to end, ideally automatically.

Monthly

  • Review user accounts and remove anyone who has left or no longer needs access.
  • Remove plugins and integrations nobody uses. Deactivated is not removed, and inactive code is still attack surface.
  • Check certificate and domain expiry dates. Both produce total outages and both are entirely avoidable.
  • Review performance on a real mobile device and a throttled connection.

Quarterly

  • Perform an actual restore from backup into a staging environment and time it.
  • Review security headers and whether they still match the site's behaviour.
  • Rotate administrative credentials and API keys, and remove unused ones.
  • Check accessibility with a keyboard and a screen reader on key journeys.

The restore test is the one people skip

Backups fail silently and frequently: excluded directories, a database dump that was never included, credentials that expired months ago. The only way to know is to restore one. Doing this quarterly into a staging environment converts a hope into a verified capability, and it is the difference between a bad afternoon and a catastrophe.

Removal beats maintenance

Every plugin, integration, and account you keep is something to patch, review, and eventually be compromised through. The cheapest maintenance task available is deleting things nobody uses, and most sites have a surprising amount of it.

Write it down and assign it

Maintenance that belongs to everyone belongs to nobody. Put the schedule in a document, assign each item to a named person, and record when it was last done. That record is also what you will want when an insurer or client asks how the site is maintained.