How to Maintain and Secure Client WordPress Sites: An Agency Checklist

With two or three client sites, you can keep maintenance in your head. Somewhere around ten, things start to slip: a plugin nobody has updated since spring, a backup job that quietly stopped, an admin account for a contractor who left last year. Nothing is broken yet, which is why it gets ignored.

This is the list we use for client sites, grouped by how often each job comes round. Copy it, cut what doesn’t apply, and put it in your task tracker as recurring work.

Every week

Updates

Run core, theme and plugin updates on staging first. Then click through the pages that make money: the homepage, the contact form, the checkout if there is one. Only push to production once staging looks normal.

Security releases are the exception to the weekly rhythm. When a plugin you run publishes a fix for a known vulnerability, patch it the same day.

Most maintenance horror stories we hear start with someone pressing “update all” on a live site.

Backups

• Daily backups of files and database for stores and sites that change often; weekly is enough for a small brochure site.
• Keep copies off the server. A backup on the same disk disappears with the site.
• Keep more than one restore point, so you can go back past a problem that went unnoticed for a few days.

Monitoring

Set up uptime alerts that reach a person, not an inbox nobody reads. Add regular malware scans and keep an eye on failed logins and new admin accounts you didn’t create.

Every month

Restore a backup

Pick a site and restore its latest backup to staging. If the restore fails or takes half a day, you want to find out now and not during an outage.

Clean up plugins and themes

Delete inactive plugins and themes rather than leaving them switched off. Look for plugins that haven’t had an update in a year or more and plan a replacement. Check that premium licences are still active, otherwise updates stop arriving without any warning.

Review users

Remove former employees, freelancers and old agency accounts. Give everyone the lowest role that lets them do their job, and turn on two-factor authentication for administrators.

Quick speed and SEO check

Run a speed test on the main templates and look at Search Console for new errors. If the numbers have dropped, our WordPress speed optimization checklist is the next step.

Send the report

A short monthly report lists the updates, backups, scans and fixes, plus a line on performance. Clients who can see the work keep paying for it. Clients who can’t see it start asking why they pay.

Once per site: hardening

Do these when you take a site on, then leave them alone:

• SSL everywhere, with HTTP redirected to HTTPS.
• Login attempts limited and the login page protected.
• File editing in the WordPress admin switched off.
• Correct file permissions, and wp-config.php locked down.
• A web application firewall at the host, the CDN or plugin level.
• Security headers where they don’t break anything.
• API keys and other secrets kept out of the theme.

When something goes wrong

Write the plan down before you need it. Ours looks like this:

1. Put the site into maintenance mode, or restore the last clean backup.
2. Find the cause: the plugin, the vulnerability or the change that triggered it.
3. Rotate passwords and keys if it was a security incident.
4. Tell the client what happened and what you did, in plain words and without blaming a plugin author.

Selling it as a care plan

Everything above is what a client pays for in a care plan. Our guide to WordPress care plans for agencies covers how to package and price it.

When there are too many sites

Running this list once is easy. Running it every month on every site you manage is a job of its own, and it’s the job our white label maintenance team does for agencies: updates on staging, backups, security, fixes and reports with your logo.

Talk to us about maintaining your clients’ sites.