'corePHP'
Recurring Care · Checklist
The Website Maintenance & Security Checklist
The routine that keeps sites from going down and getting hacked. Organized by how often each task needs to happen. Skip the cadence and small problems become outages and breaches.
The honest truth: most sites get attention only when something breaks. By then it is a fire drill. This checklist is the boring, scheduled work that prevents the fire. If no one owns it, it does not happen.
Weekly
Apply and test core, plugin, and theme updatesOutdated components are the top hack vector. Update on a staging copy, test, then push live.
CriticalVerify backups ran and spot-check a restoreA backup you have never restored is a hope, not a safety net.
CriticalReview uptime and security alertsScan the week's monitoring for downtime, failed logins, and malware flags.
HighClear the error and 404 logBroken links and recurring errors cost rankings and conversions. Fix the repeat offenders.
Standard
Monthly
Run a full malware and vulnerability scanCatch anything the daily monitor missed. Patch what it finds.
CriticalAudit user accounts and permissionsRemove old logins, enforce strong passwords and two-factor, confirm least-privilege access.
HighCheck page speed and Core Web VitalsPerformance drifts as content and plugins pile up. Catch the slide before visitors do.
HighTest key forms and checkout end to endAn update can silently break a contact form or payment flow. Submit a real test.
CriticalReview storage, database size, and old dataBloat slows the site and inflates backups. Prune logs, spam, and stale revisions.
Standard
Quarterly
Full backup restore drill to a staging siteProve you can actually recover, not just that backups exist. Time how long it takes.
CriticalRenew and verify SSL, domain, and licensesAn expired certificate or domain takes a site offline instantly. Track every renewal date.
HighReview hosting capacity and PHP versionConfirm you are on a supported, secure stack with room to grow.
HighAccessibility and broken-link auditSweep the whole site for dead links and accessibility gaps that accumulate over time.
Standard
Always have ready
An incident plan and a number to callWhen something breaks, who responds, how fast, and what is the SLA? Decide before the outage, not during it.
CriticalOff-site backups you controlBackups stored only on the same server disappear with the server. Keep copies elsewhere, that you own.
High
Reality check: this is several hours of skilled work every month, every month, forever. Most teams either let it slide or pull a developer off revenue work to do it. A managed care plan is usually cheaper than either, and it never gets skipped.
How exposed are you right now?
Take the free Website Care & Risk Scorecard. In five minutes it scores your security, backups, updates, uptime, and support, then shows exactly what a managed care plan would cover for your site.
Get your risk score at corephp.com →