WordPress Maintenance Checklist for Agencies

Why frequency matters

Most checklists mix onboarding tasks with recurring tasks

The result: agencies either skip onboarding steps because they feel like maintenance, or repeat onboarding tasks weekly when they only need to happen once. Organizing by frequency makes the checklist usable as an actual operating procedure.

Onboarding tasks run once per site

Plugin install, verification, privacy confirmation, tracking setup, and baseline documentation. Once complete, they should never appear in your recurring review.

Using a portfolio dashboard to track setup state means you don't need to keep a separate spreadsheet to know which sites completed onboarding.

Recurring tasks run on a schedule

Weekly, monthly, and quarterly cadences each have different tools and owners. Mixing them into one list makes it easy to over-check some things and skip others entirely.

The weekly checklist should take under 10 minutes. Monthly takes 45–90 minutes depending on portfolio size. Quarterly is a deep review — budget a half day.

The checklist

30 WordPress maintenance tasks for agencies

Onboarding — new client site

Cadence: Once per new site

1
Create site record in portfolio dashboardTool: PortaviqBefore touching wp-admin — generates the Site Public ID and verification token.
2
Download Portaviq plugin ZIP and install in WordPressTool: Portaviq + WordPress Plugins → UploadUpload and activate. No coding required.
3
Paste setup values and click Verify ConnectionTool: WordPress Settings → PortaviqEnter App URL, Site Public ID, and one-time token. Verify must succeed before setup is complete.
4
Confirm site shows as active in portfolio dashboardTool: PortaviqSite should show as verified and heartbeat active within 60 seconds.
5
Confirm client's privacy notice covers analytics trackingTool: Legal reviewRequired before enabling pageview tracking. Do not enable tracking without confirmation.
6
Enable pageview tracking in plugin settingsTool: WordPress Settings → PortaviqOnly after privacy confirmation. Tracking is opt-in, not automatic.
7
Document baseline: active plugins, theme, PHP version, hostTool: Internal docs or project management toolBaseline snapshot makes future troubleshooting much faster.

Weekly maintenance tasks

Cadence: Every week

1
Open portfolio dashboard and scan for disconnected sitesTool: PortaviqAny site showing disconnected or heartbeat stale needs investigation before the client notices.
2
Check last heartbeat date for all active sitesTool: PortaviqStale heartbeats can indicate plugin deactivation, host migration, or PHP errors.
3
Check 7-day pageview activity across portfolioTool: PortaviqSites with zero activity that should have traffic are a signal to investigate.
4
Review pending plugin and theme updatesTool: ManageWP / MainWP / WP UmbrellaDon't apply yet — schedule for monthly update window unless critical security patch.
5
Check uptime monitoring dashboard for recent downtimeTool: ManageWP / WP Umbrella / UptimeRobotReview any downtime events from the last 7 days.
6
Review backup completion status for all sitesTool: ManageWP / UpdraftPlus / JetpackConfirm backups ran and completed without errors.
7
Flag anything that needs follow-up this weekTool: Internal task systemAdd tasks for any disconnected sites, stale heartbeats, or failed backups.

Monthly maintenance tasks

Cadence: Once per month

1
Apply plugin updates — staging environment firstTool: ManageWP / MainWP / WP UmbrellaRun visual regression check or manual QA before pushing to live. WP Umbrella includes automated visual regression.
2
Apply theme updatesTool: ManageWP / MainWPCheck for child theme compatibility issues before applying parent theme updates.
3
Apply WordPress core updatesTool: ManageWP / MainWPMajor core versions require more careful staging review than minor security releases.
4
Run full backup and verify off-site storageTool: ManageWP / UpdraftPlus / BackupBuddyConfirm backup completed, file size looks right, and off-site destination received it.
5
Run security scanTool: Wordfence / Sucuri / ManageWP SafetyReview scan output. Prioritize any detected malware or unauthorized file changes.
6
Check PHP version against host and plugin compatibilityTool: WP admin dashboard or hosting control panelFlag any sites running PHP below the supported minimum for their active plugins.
7
Audit WordPress user accountsTool: WordPress Users screenRemove or demote inactive administrator accounts. Confirm no unfamiliar accounts were added.
8
Check for unused plugins and deactivate or deleteTool: WordPress Plugins screenUnused active plugins are an attack surface. Deactivate first, delete after confirming no impact.
9
Send client maintenance reportTool: WP Umbrella / ManageWP / custom templateMonthly report confirms value delivery and reduces client churn. Include updates applied, backup status, and uptime.

Quarterly maintenance tasks

Cadence: Every 3 months

1
Test a full backup restore on a staging environmentTool: ManageWP / UpdraftPlusA backup you have never tested restoring is not a backup. Do this once a quarter, not just when you need it.
2
Check SSL certificate expiry datesTool: SSL checker tool or hosting dashboardFlag any certificates expiring within 60 days. Auto-renewal is common but not guaranteed.
3
Check domain expiry datesTool: Registrar dashboard or WHOISDomains can expire even when auto-renewal is on. Confirm payment methods are valid.
4
Review Core Web Vitals in Google Search ConsoleTool: Google Search ConsoleFlag any URLs with poor CWV scores — LCP, INP, CLS. These affect search ranking.
5
Review plugin health: flag abandoned or unsupported pluginsTool: WordPress Plugins screen + WordPress.org changelogsPlugins with no updates in 12+ months and low compatibility ratings are a risk. Plan replacements.
6
Verify off-site backup storage quota is not near limitTool: Google Drive / Dropbox / S3 storage dashboardBackup destinations that hit quota silently fail to receive new backups.
7
Review care plan scope with clientTool: Client call or emailQuarterly scope review prevents scope creep and catches changes to the site that affect the plan (e.g., new WooCommerce added).
8
Verify contact info and escalation path for the clientTool: CRM or internal docsConfirm you have the right person to call if the site goes down at 2am.

Tools by category

What agencies use for each maintenance category

No single tool covers all 30 tasks. Most agency stacks combine two to four tools.

Portfolio visibility and setup tracking

Portaviq — tracks plugin connection health, heartbeat, setup pipeline, and pageview activity across your client portfolio. Handles onboarding tracking and the weekly portfolio scan.

Request Early Access

Bulk maintenance operations

ManageWP (cloud), MainWP (self-hosted), or WP Umbrella (SaaS) — handle bulk updates, backups, uptime monitoring, security scans, and client reports. Covers weekly review and monthly operations.

WP Umbrella includes visual regression testing on updates and built-in client reporting. MainWP is free to self-host with paid extensions. ManageWP has the most generous free tier.

Backups

UpdraftPlus (free tier available), BackupBuddy, or ManageWP/WP Umbrella built-in. Ensure off-site storage is configured (Google Drive, S3, Dropbox) and test restores quarterly.

A backup without a tested restore path is not a backup. Build the quarterly restore test into your process, not just your checklist.

Security scanning

Wordfence (free tier), Sucuri SiteCheck, or ManageWP / WP Umbrella built-in security modules. Monthly scan minimum; weekly for sites with active user logins.

Scanning is detection, not prevention. Complement with strong password enforcement, two-factor on admin accounts, and XML-RPC disabled.

Connection health

The maintenance task most checklists miss

Most WordPress maintenance checklists cover updates, backups, uptime, and security. They do not cover whether your portfolio management tools are still connected.

Plugins can disconnect silently

A plugin deactivated by the client, a migration that changed domain or siteurl, or a PHP error introduced by an update — all can silently break a plugin connection without triggering an uptime alert.

Heartbeats tell you before symptoms do

A heartbeat gap — the plugin stopping its regular check-in — is an early signal that something changed on the site. Seeing this in your weekly scan lets you investigate before the client notices any impact.

Setup can be incomplete without anyone knowing

Sites that were partially onboarded — installed but not verified, or verified but tracking never enabled — stay in a grey state unless the agency has a portfolio view that surfaces incomplete setup explicitly.

Portaviq adds connection health to your weekly scan

The weekly portfolio scan in Portaviq shows each site's connection status, last heartbeat date, and setup completion state — so disconnected or incomplete sites surface before the client notices.

Request Early Access Read the full workflow guide

How this compares

This checklist vs. WP Umbrella's 27-task version

WP Umbrella's checklist (27 tasks)

Comprehensive and widely cited. Strong on the operations side: backups, updates, security, performance. Does not separate onboarding from recurring tasks, and does not cover plugin connection health or portfolio-level visibility.

This checklist (30 tasks)

30 tasks organized by frequency: onboarding once, then weekly, monthly, and quarterly. Adds three categories WP Umbrella's version doesn't cover: portfolio connection health, plugin heartbeat monitoring, and setup pipeline completion.

Neither list is exhaustive — the right checklist for your agency depends on your stack, client mix, and care plan scope. Use this as a starting template and add or remove tasks based on your specific portfolio.

FAQ

Questions about WordPress maintenance for agencies

What should be included in a WordPress maintenance checklist?

A complete WordPress maintenance checklist should cover four cadences: onboarding tasks (site record creation, plugin install, backup setup), weekly tasks (portfolio scan, plugin heartbeat check, uptime review), monthly tasks (updates, security scan, user audit, client report), and quarterly tasks (backup restore test, SSL and domain expiry, Core Web Vitals review, care plan scope review). A comprehensive checklist runs to 28–32 tasks.

How often should WordPress sites be maintained?

Agencies typically run three tiers: weekly checks (connection status, uptime, updates pending), monthly operations (apply updates, run security scan, send client report), and quarterly reviews (backup restore test, SSL/domain expiry, user audit, care plan review). Sites with active editorial calendars or e-commerce may need weekly update reviews rather than monthly.

How do agencies track maintenance tasks across multiple WordPress sites?

Most agencies use a combination of: a WordPress management tool for bulk operations (ManageWP, MainWP, WP Umbrella), a portfolio visibility dashboard for connection status and activity tracking (like Portaviq), and a project management tool for per-client task completion. A portfolio dashboard that shows plugin heartbeat, setup state, and recent activity helps make weekly reviews faster than opening each wp-admin manually.

What is a WordPress care plan?

A WordPress care plan is a recurring service covering regular maintenance tasks for a client's WordPress site — typically backups, plugin and theme updates, security monitoring, uptime monitoring, and a monthly report. Care plans are usually billed monthly and range from $50–$200/month per site depending on scope.

What are the most important WordPress maintenance tasks?

The highest-priority tasks are: regular backups with off-site storage and a tested restore path, plugin and theme updates (applied after staging test), uptime monitoring, security scanning, and user account audits. For agencies managing multiple sites, plugin connection health monitoring and portfolio-wide visibility are equally important — gaps that go unnoticed cause client escalations that would otherwise be preventable.

How do I build a WordPress care plan offering?

Start with the core four: backups, updates, monitoring, and a monthly report. Pick one tool for bulk operations (ManageWP or WP Umbrella are good starting points). Establish a documented workflow for each cadence — onboarding, weekly, monthly, quarterly. Set client expectations upfront: what is covered, what is not, and what triggers a scope conversation. As your portfolio grows, add a portfolio visibility layer so you can scan all sites without manual checking.

Related guides

How to manage multiple WordPress sites

The full workflow guide for agencies managing 5–50 client sites — tools, workflow by situation, and how to add portfolio visibility.

Read the workflow guide

Plugin setup guide

Step-by-step guide: install the Portaviq plugin, paste setup values, verify the connection, and enable tracking.

Read the setup guide

WordPress portfolio audit

Not sure where the gaps are in your current client portfolio? Request a free portfolio audit — we review setup state and flag what needs attention.

Request free audit

Track your WordPress maintenance checklist in Portaviq

Portaviq gives you the portfolio view that makes weekly checklist reviews faster. Early Access is open for WordPress agencies managing multiple client sites.