This is what I do every month on a WordPress site, with the WP-CLI commands for anyone who wants to do it themselves. Always with a backup first:
- Integrity of the core and of the plugins from the directory:
wp core verify-checksums and wp plugin verify-checksums --all. Any file that doesn't match the original gets reviewed before updating. - What's pending:
wp core check-update and wp plugin list --update=available. Plugins with published vulnerabilities first; major version jumps one at a time. - Administrators:
wp user list --role=administrator. Every account has to have an owner. - Scheduled tasks:
wp cron event list. A task with a name that doesn't match any plugin is a classic sign of reinfection. - Checks after updating: home page, contact forms, cart and checkout if there's a store, and the editor (Elementor or the block editor).
Abandoned plugins
WordPress.org shows a warning when a plugin hasn't been tested with the last three major WordPress releases, and it closes plugins with an unfixed vulnerability or whose author abandons them. A closed plugin gets no more patches: if you can't do without it, I suggest a maintained alternative and swap it with a backup first. Fewer plugins, fewer doors. If you want to check it yourself, the steps are in vulnerable WordPress plugins.
PHP version
WordPress recommends PHP 8.3 or later and warns that older versions no longer get security patches. Many hosts leave the site on the version it was installed with. Before moving up I check that the theme and plugins are compatible, on a copy if the site is large.
Elementor, WPML and premium licenses
Premium plugins (Elementor Pro, WPML, ACF Pro, WooCommerce extensions) update from their author's servers, and only with an active license. If the license has expired, the plugin stays on the version it had, flaws included. I use your licenses; if one has expired, I let you know before it becomes a problem. A "nulled" copy of a premium plugin can't be maintained: it's a very common source of infections and has to be replaced.
The two plans, their prices and what each one includes, side by side, are on the website maintenance page. Why maintenance costs what it costs, in how much website maintenance costs.
WordPress maintenance service: what to ask for
- That they back up before every update and keep the backup off your server
- That they tell you in writing, every month, what was updated and what wasn't
- That they watch security, not just uptime: file integrity and malware scans
- That it's clear what happens if you get hacked: is the cleanup included or is it another invoice?
- That there's no long-term contract and the site, the backups and the logins stay yours
If your site isn't WordPress or you run several platforms, see the general website maintenance page. If the WordPress site is already infected, the first step is hacked WordPress cleanup.