Backup plan
What a full WordPress backup contains, how often to run it, where to keep it, how to test it.
Free printable checklist
Pre-launch
Check DNS, SSL, WordPress settings, security, speed, SEO, forms and backups before a new or redesigned site goes live.
KIT-03
PDF, 1 page, 7 KB
Download the PDF
One page. Prints on any black and white printer. No signup.
Domain, DNS and SSL
- Registrar: auto-renew on, registrar lock on, 2FA on, contact email monitored.
- Record every DNS entry before changes: A, AAAA, CNAME, MX, TXT (SPF, DKIM, DMARC), CAA.
- Pick one canonical host. 301 every variant to it over https. Test with
curl -I. - HTTPS works on every page with no mixed content, and certificate renewal is automatic.
- Add HSTS only after HTTPS has been stable for a while. Never preload on launch day.
WordPress settings
- Settings, Reading: “Discourage search engines” is OFF on the live site.
- Permalinks set to the final structure now. Changing them later breaks URLs.
- Timezone, site title and admin email set. Staging URLs replaced via
wp search-replace. - PHP on a supported version. WP_DEBUG false, and no public wp-content/debug.log.
Security
- No user named admin. Every admin has a unique password and 2FA.
- Delete unused plugins, themes and test accounts. Deactivated code can still be attacked.
- Disable XML-RPC if nothing uses it (some apps and plugins do).
- Set DISALLOW_FILE_EDIT to true in wp-config.php.
Speed and search
- Page caching on, images resized and compressed. Test key templates in PageSpeed Insights.
- Every page has a unique title and meta description, and one H1.
- robots.txt does not block the site, and the XML sitemap loads (core: /wp-sitemap.xml).
- Redesign: map every old URL to its new page with a 301, and test the whole list.
- Submit the sitemap in Search Console after launch and watch the Pages report.
Forms, legal and safety net
- Send site mail via SMTP or a transactional service, with SPF and DKIM aligned to your domain.
- Submit every form. Notifications and autoresponders land in the inbox, not spam.
- Privacy policy published. Cookie consent in place if your tracking requires it.
- Accessibility: alt text, keyboard navigation, visible focus, 4.5:1 text contrast.
- Full backup taken just before launch and stored off the server. Schedule confirmed.
- Uptime, SSL expiry and domain expiry monitoring on, alerting a real person.
Keep packing
The rest of the bag
Hack recovery
After a WordPress hack: contain it, keep evidence, find the way in, clean, harden, recover.
Switching hosts
Move a WordPress site to a new host without losing email, SSL, data or rankings: inventory, rehearse, cut over, then wait.
Site takeover access inventory
Every login, account and file to collect when you inherit a website, in the order that keeps it safe: domain first, backup before changes, then access, code and renewals.
Store fraud response
When a WooCommerce store is hit by card testing: confirm it, slow it down in the first hour, clean up the orders, report it and harden the checkout.
Monthly maintenance
A one-page monthly routine for a WordPress site: backups tested, updates in a safe order, renewals, uptime, Search Console, forms and security checks.
Renewals register
A fill-in register for everything a website renews, with the provider, account owner, who pays, renewal date, cost and cycle, auto-renew and sites for each, one row per item.