Backup plan
What a full WordPress backup contains, how often to run it, where to keep it, how to test it.
Free printable checklist
Monthly maintenance
A one-page monthly routine for a WordPress site: backups tested, updates in a safe order, renewals, uptime, Search Console, forms and security checks.
KIT-07
PDF, 1 page, 6 KB
Download the PDF
One page. Prints on any black and white printer. No signup.
Backups first
- Last night’s backup finished and is stored off the server. Note date and size.
- Download a recent backup: the archive opens and the SQL file is complete.
- Quarterly: restore a backup to staging and test key pages and forms.
- Take an on-demand backup right before this session’s updates.
Updates, in order
- List pending updates in Dashboard, Updates.
- Read changelogs for builders, WooCommerce, gateways and major versions first.
- Update core, then risky plugins one by one, then the rest, then the theme.
- Clear page cache, server cache, CDN and builder CSS after updating.
- Check PHP version in Site Health. Plan an upgrade if it is near end of life.
Test what earns money
- Load the home page and two key pages privately, on phone and desktop.
- Submit every main form. Confirm the email arrives and the entry is stored.
- Shop: add to cart, reach checkout, place a test order in test mode if possible.
- Check the browser console and the PHP error log for new errors.
Health and visibility
- Uptime monitor: review downtime and confirm alerts reach a real person.
- Search Console: Pages, Security Issues, Manual Actions and unknown new owners.
- Site Health: fix new critical items (loopback, REST API, scheduled events).
Security and renewals
- Review admins: remove ex-staff, contractors and unexplained accounts.
- 2FA is on for every admin, and the security plugin or firewall is updating.
- Run a malware scan and
wp core verify-checksums. - Renewals register: what renews in the next 60 days, with reminders 60 and 14 days before.
- Auto-renew is on and the card on file is valid for anything due soon.
- Log what you did, versions changed and anything that broke, with the date.
Keep packing
The rest of the bag
Hack recovery
After a WordPress hack: contain it, keep evidence, find the way in, clean, harden, recover.
Pre-launch
Check DNS, SSL, WordPress settings, security, speed, SEO, forms and backups before a new or redesigned site goes live.
Switching hosts
Move a WordPress site to a new host without losing email, SSL, data or rankings: inventory, rehearse, cut over, then wait.
Site takeover access inventory
Every login, account and file to collect when you inherit a website, in the order that keeps it safe: domain first, backup before changes, then access, code and renewals.
Store fraud response
When a WooCommerce store is hit by card testing: confirm it, slow it down in the first hour, clean up the orders, report it and harden the checkout.
Renewals register
A fill-in register for everything a website renews, with the provider, account owner, who pays, renewal date, cost and cycle, auto-renew and sites for each, one row per item.