Website Maintenance Checklist: Weekly, Monthly and Yearly Tasks
A website is never finished. Regular maintenance keeps it secure, fast and accurate. Use this checklist to stay on top of it.
3 min read · Evergreen guideKeeping a WordPress Site Secure: Practical Habits That Prevent Hacks
Most compromised websites are hacked through outdated software, weak passwords or abandoned plugins. These habits close the common doors.
Key takeaways
- Keep the core software, themes and plugins updated, and remove what you don’t use.
- Use strong, unique passwords and two-factor authentication for every admin account.
- Give each user only the access they need.
- Combine a firewall, malware scanning and off-site backups for layered protection.
How sites usually get hacked
Most attacks are automated. Bots scan the internet for known weaknesses: outdated plugins with published vulnerabilities, weak or reused passwords, and abandoned themes. Your site doesn’t need to be important to be targeted. It just needs to be vulnerable.
1. Update consistently
- Apply updates to the WordPress core, themes and plugins promptly, especially security releases.
- Delete inactive plugins and themes. Even disabled code can be exploited.
- Choose plugins that are actively maintained and widely used, and avoid “nulled” or pirated premium plugins, which often contain malware.
2. Lock down logins
- Use long, unique passwords stored in a password manager.
- Turn on two-factor authentication for all administrator and editor accounts.
- Limit login attempts and block repeated failures.
- Don’t use “admin” as a username.
3. Apply least privilege
Give each person the lowest role that lets them do their job. Content writers don’t need administrator access. Remove accounts promptly when people leave or projects end, and review the user list regularly.
4. Secure the hosting environment
- Use reputable hosting with server-level firewalls and isolation between accounts.
- Keep the server’s PHP version current and supported.
- Use HTTPS everywhere.
- Restrict file permissions, and disable file editing from the WordPress dashboard.
- Use secure file transfer (SFTP), not plain FTP.
5. Add protective layers
- Web application firewall: filters malicious traffic before it reaches your site.
- Malware scanning: detects changed files and injected code.
- Activity logging: records logins and changes so you can investigate issues.
- Uptime and blacklist monitoring: alerts you if your site goes down or is flagged.
6. Back up independently
Keep automated, off-site backups with several versions. If the worst happens, a clean backup lets you recover quickly, and enough history lets you go back to before the infection began.
If your site is compromised
- Put the site in maintenance mode if it is harming visitors.
- Change all passwords: WordPress, hosting, database and file access.
- Restore from a clean backup, or have the malware professionally removed.
- Update everything and remove the vulnerability that allowed access.
- Request a review from search engines if your site was flagged.
- Monitor closely in the following weeks.
Our Website Maintenance Pro and Business plans include malware scanning, clean-ups and monitored backups. Our Cloud Services add firewalls and server-level protection.
Frequently asked questions
Is WordPress insecure?
The core software is actively maintained and secure when kept updated. Most problems come from outdated plugins and themes, weak passwords and poor hosting, all of which are preventable.
Do security plugins slow down a site?
Some can add load. Server-level firewalls and well-configured, lightweight tools provide protection with minimal impact. Choose tools carefully rather than stacking several.
