What WordPress Maintenance Actually Includes (2026 Checklist)
If you run a WordPress site, “maintenance” is easy to postpone until something breaks. An update sits unapplied. A backup exists only on the same host as the site. A domain renewal email lands in an inbox nobody checks. None of those failures announce themselves with a countdown on your homepage—they just fail. This post […]
If you run a WordPress site, “maintenance” is easy to postpone until something breaks. An update sits unapplied. A backup exists only on the same host as the site. A domain renewal email lands in an inbox nobody checks. None of those failures announce themselves with a countdown on your homepage—they just fail.
This post is a practical checklist of what WordPress maintenance actually includes in 2026, who should own each task (you or a care plan), and how that maps to Revive Guard plans—Monitor, Guard, and Shield—using what’s on our live pricing page. No fake rankings. No invented install counts. Just the work that keeps a site alive.
What “WordPress maintenance” means (vs hosting)
Hosting keeps the server running. WordPress maintenance is application-layer care: the CMS, themes, plugins, certificates, domain renewal awareness, backups you can actually restore, and someone answering when a check fails.
Your host may offer snapshots or “daily backups.” That helps—until the same failure that takes the site also takes the host’s copy. Maintenance, done properly, assumes the host can fail and still leaves you with an independent recovery path. That’s why Revive Guard stores backups off-host, encrypted, with access limited to the team protecting your site. We built that habit after years of restoration work at WaybackRevive—the parent practice behind Revive Guard (Wayback Revive LLC)—where preventable disasters showed up as emergency recoveries.
If you’re comparing tools vs humans: a maintenance plugin gives you buttons. A care plan transfers responsibility. This checklist is written so you can see the difference task by task.
The WordPress maintenance checklist (by cadence)
Use this as a ownership map. Rows marked with plan coverage use only live Revive Guard plan bullets from pricing.
Continuous (always on)
| Task | Why it matters | DIY owner | Revive Guard coverage |
|---|---|---|---|
| Uptime monitoring | Downtime you don’t know about is downtime you can’t fix | You or a monitor tool | All plans — checks every 5 minutes; alert after two failed checks, with a human notified |
| SSL certificate watch | Expired HTTPS breaks trust and SEO signals overnight | You (calendar + hosting panel) | All plans — alerts at 60 / 30 / 7 days |
| Domain expiry watch | Quiet expiry can hand your address to someone else | You (registrar emails) | All plans — same 60 / 30 / 7 day alerts |
| Vulnerability / malware awareness | Unpatched plugins are a common breach path | You (newsletters, scanners) | Guard & Shield — weekly malware scans; Monitor does not include malware scanning |
Weekly
| Task | Why it matters | DIY owner | Revive Guard coverage |
|---|---|---|---|
| Core, plugin, and theme updates | Most “hacked site” cleanups we see were missing a fix that already existed | You — with time to test | Guard & Shield — weekly updates |
| Snapshot before every change + rollback path | A routine update that can’t be undone becomes a rebuild | You — if you have a real recovery point | Guard & Shield — fresh snapshot before every change; auto-rollback if something breaks |
| Off-host backup + verify it exists | A backup you can’t restore isn’t a backup | You — preferably off the host | Monitor — weekly off-host backup, kept 30 days · Guard — off-host backups with 90-day retention · Shield — daily backups, kept 180 days |
| Backup verification | “File written” ≠ “site restorable” | You — periodic restore test | All plans that include backups — every backup is verified restorable (live standard) |
Monthly
| Task | Why it matters | DIY owner | Revive Guard coverage |
|---|---|---|---|
| Plain-language health report | You need a record of what changed without digging logs | You — if you keep notes | All plans — monthly health report + private portal |
| Broken-link hygiene (where relevant) | Dead links waste leads and frustrate visitors | You or an SEO tool | Guard & Shield — monthly broken-link audit (Guard+) |
| Support for odd breaks | Content quirks, plugin conflicts, “it looks wrong” tickets | You or a freelancer | Guard — 2 human support requests/month · Shield — unlimited priority support · Monitor — monitoring-first; one-time restore available as add-on |
Quarterly (or deeper cadence)
| Task | Why it matters | DIY owner | Revive Guard coverage |
|---|---|---|---|
| Deeper security / health audit | Surface checks miss drift over months | You or an agency sprint | Shield — quarterly security + SEO health audits |
| Plugin prune / unused software | Abandoned plugins enlarge the attack surface | You | Best-effort under Guard/Shield update workflow; Shield audits raise the bar |
| Content edits / small site changes | Busy owners still need copy and image updates | You | Shield — 2 hours of content edits/month |
| Account continuity | Who do you call when revenue is on the line? | You | Shield — dedicated account manager |
Soft checkpoint: If half these rows already feel like homework you won’t finish this month, compare plans on /pricing/ or start with a free evaluation—written findings in 48 hours, no card required.
What “good” maintenance looks like
A useful maintenance practice has three non-negotiables. They match how we run protection day to day (how it works):
- Restore-tested, off-host backups. Encrypted copies stored independently of your host. On Revive Guard, a backup that isn’t verified restorable doesn’t count. Retention grows with plan level (30 / 90 / 180 days).
- Snapshot before updates, with a rollback path. We take a fresh snapshot before every core, plugin, or theme change. If an update breaks the site, we restore to how it was—usually within minutes—and hold the update until a fix exists. Activity shows up in your portal. (We do not describe this as “staging” unless your stack already has one; the live guarantee is snapshot + rollback.)
- A human when checks fail. Tools can page you. Someone has to decide whether it’s a false positive, a malware incident, or a restore. On Monitor you’re alerted immediately and can buy a one-time restore. Guard prioritizes restore (typically same-day). Shield includes a 4-hour emergency restore SLA in writing.
Visibility matters too. Clients see uptime, backups, updates, and alerts in a private portal—so “taken care of” isn’t a black box.
DIY reality check (short)
You can own this checklist yourself. Many site owners do—until travel, a busy season, or a single missed renewal email. The risk isn’t ignorance; it’s discipline under distraction. Hosting dashboards, registrar portals, plugin changelogs, and backup logs all compete with running the business the site is supposed to support.
If you’re weighing DIY vs paying for care, the next cornerstone in this series covers that decision directly. For now: be honest about which rows above already slipped last month. That honesty is more useful than any generic “hours per month” estimate.
How Revive Guard approaches maintenance
Revive Guard is the prevention product of Wayback Revive LLC / WaybackRevive. We spent years restoring hacked, expired, and broken sites. The patterns were uncomfortable: domain expiry, host-only backups, and unapplied updates showed up again and again. Care plans exist so those recoveries become rare.
Path for new clients
- Request a free evaluation — about two minutes: URL + biggest concern.
- A real person reviews your site within 48 hours and sends written findings (and an honest plan suggestion) whether or not you join. We check CMS/update status, plugins and known vulnerabilities, hosting context, SSL, domain expiry, and existing backups.
- If you accept, your invite activates the portal. Install a lightweight plugin; monitoring starts; the first backup runs overnight. Onboarding is meant to take under ~10 minutes of your time (how it works).
Capacity note: We accept a maximum of 26 new clients a month—roughly one proper onboarding per working day. That’s a quality constraint, not a countdown timer. At capacity, you join a waitlist and we tell you where you stand.
Plan fit (honest summary)
- Monitor · $49/mo — Know when something’s wrong. Uptime, SSL/domain watch, weekly off-host backup (30 days), monthly report. No WordPress updates or malware scans. Extra sites +$29/mo. One-time restore available for $99 if you need it.
- Guard · $99/mo — Fully managed for business sites. Everything in Monitor, plus weekly WP/plugin/theme updates with snapshot + rollback, weekly malware scans, 90-day backup retention, monthly broken-link audit, 2 support requests/month. Extra sites +$49/mo. Priority restore, typically same-day.
- Shield · $179/mo — Revenue-critical. Everything in Guard, daily backups (180 days), written 4-hour restore SLA, 2 hrs content edits/month, dedicated account manager, unlimited priority support, quarterly security + SEO health audits. Includes up to 3 sites; extra +$59/mo.
No setup fee. Cancel anytime. 7-day money-back when you start. Full matrix: /pricing/.
WaybackRevive alumni get a personal invite path and skip the public queue—we already know the stack. Everyone else starts with the evaluation.
FAQ
Are hosting backups enough?
Usually not as your only copy. Host backups often live on the same infrastructure as the site; the failure that takes one can take both. Independent, encrypted off-host backups mean recovery doesn’t depend on the company that just failed you. That’s why every Revive Guard plan that includes backups stores them separately from your host.
Do you use staging, or snapshot-before-update?
Live protection emphasizes a verified snapshot before every change and automatic rollback if something breaks. That’s the workflow we commit to in product copy. If your host already offers staging and you want it in the loop, say so in the evaluation—we’ll be honest about what fits your stack rather than overselling a lab environment we don’t claim by default.
Can I cancel anytime?
Yes. Month-to-month, no annual lock-in, plus a 7-day money-back guarantee at the start. On cancellation, we’ll hand you your most recent full backup on request.
Why an evaluation instead of instant signup?
Because we take responsibility for sites we protect. A person reviews every website before we commit. You get written findings within 48 hours free—whether or not you join—so the process works in your favor either way.
Which plan do most business sites need?
Many business sites land on Guard (updates, malware scans, longer retention, human support). Brochure or portfolio sites that mainly need eyes on uptime and renewals may be fine on Monitor. Revenue-critical sites that need a written restore clock and a dedicated manager belong on Shield. We’ll say if the cheaper plan is enough after we see your site.
Next step
If you want a clear picture of where your site stands—without a sales script—request a free evaluation. Two minutes to submit. Within 48 hours, a real person sends written findings. If you already know you want coverage compared side by side, start at /pricing/ and come back to the evaluation when you’re ready.
Maintenance isn’t a badge. It’s a list of jobs that either get done on schedule or become tomorrow’s emergency. This checklist is the list. Who owns each row is the decision.
Want a real person to check your site?
Free evaluation — written findings within 48 hours. No card required.
Request a Free Evaluation