Most WordPress problems I am asked to fix were preventable. A plugin that was not updated for a year, a backup that only existed on the same server that got hacked, a contact form that quietly stopped sending emails months ago. This checklist is the routine I use for the WordPress websites I look after.
The short version
Weekly: back up, update, check the site and its forms. Monthly: review security, speed and Search Console. Yearly: renew domain and hosting, review plugins and your PHP version, and test a full restore.
Weekly tasks
- Take a backup and keep it off the server. Back up both the files and the database, and store a copy somewhere other than your hosting account (cloud storage, for example). A backup on the same server is lost if the server is.
- Update WordPress, plugins and your theme. Update with a fresh backup in place. For an online store or a heavily customised site, test updates on a staging copy first.
- Check the website after updating. Open the home page, a key service page and, for a store, add a product to the cart and go to checkout. An update can break a layout or a checkout without any error message.
- Test your contact form and WhatsApp button. Send yourself a test enquiry. Forms often fail silently when email settings or a plugin change.
- Glance at uptime. A free uptime monitor emails you when the site goes down, so you hear it before a customer tells you.
Monthly tasks
- Review admin users. Remove staff who have left and any account you do not recognise. Unknown admin users are a common sign of a hack.
- Turn on two-factor authentication for every admin account, and use unique passwords.
- Remove plugins and themes you do not use. Deactivated plugins can still be attacked if they have a security hole.
- Check speed on mobile. Run your main pages through Google PageSpeed Insights. Large images are the usual cause of a slow site; compress them before uploading.
- Open Google Search Console. Look at Pages (indexing problems), Security issues, and Performance to see which searches bring visitors.
- Fix broken links on your important pages, especially links to products or services that no longer exist.
Every few months
- Restore a backup to a test site. A backup you have never restored is a guess, not a backup.
- Review plugins that are no longer maintained. If a plugin has not been updated by its developer for a long time, plan to replace it.
- Update your content. Prices, opening hours, staff, promotions and phone numbers go out of date quietly, and customers notice.
Yearly tasks
- Renew your domain and hosting on time, and make sure the renewal reminders go to an email someone actually reads. An expired .my or .com domain takes the website and email down together.
- Check your PHP version in the hosting panel. Old PHP versions stop receiving security fixes, and newer versions are faster.
- Review premium licences. Paid themes and plugins usually need an active licence to receive updates.
- Review your privacy notice if your forms collect personal data, in line with Malaysia's Personal Data Protection Act.
Checklist at a glance
| Task | How often | Why it matters |
|---|---|---|
| Off-site backup (files and database) | Weekly, daily for stores | Recover from hacks, mistakes and server failure |
| Core, plugin and theme updates | Weekly | Most hacks use known holes in old plugins |
| Test forms and checkout | Weekly and after updates | Broken forms lose enquiries silently |
| Admin users and 2FA | Monthly | Stops the most common way in |
| Speed check | Monthly | Slow sites lose visitors and rankings |
| Search Console review | Monthly | Spot indexing and security problems early |
| Test restore | Every few months | Proves your backups work |
| Domain, hosting, PHP, licences | Yearly | Avoid outages and unsupported software |
Do it yourself or hire someone?
If you are comfortable in the WordPress admin and can set aside an hour a week, you can follow this list yourself. Most business owners prefer to spend that hour on their business. That is what our WordPress maintenance plans cover, from RM199 a month, with WhatsApp support when you need a change. If your site is already broken or hacked, read what to do when your WordPress website is hacked.
Frequently asked questions
How often should I update WordPress plugins?
Check for updates at least once a week and apply them with a backup in place. Security updates should be applied as soon as possible, because attackers look for sites that have not installed them.
Is automatic updating safe?
Automatic updates are fine for small, simple sites and for minor WordPress releases. For online stores and customised sites, review updates first, because an update can break checkout or a custom feature.
How much does WordPress maintenance cost in Malaysia?
It depends on the size of the site and how much help you need each month. Our plans are RM199, RM449 and RM1,199 (e-commerce) a month. See website maintenance costs in Malaysia for typical ranges.