A practical WordPress care checklist for small businesses

A WordPress website is not finished when it launches. The software, extensions, hosting environment and content continue to change. A simple care routine makes those changes controlled and recoverable.

1. Know who controls the essentials

Record the domain registrar, DNS provider, website host, WordPress administrator and business email provider. Store access securely and make sure ownership stays with the business—not only with a former freelancer or agency.

2. Keep more than one useful backup

A backup is only valuable if it is recent, complete and restorable. Keep copies outside the live hosting account where possible, confirm the schedule and test a restore process periodically.

3. Update in a controlled order

Review available WordPress core, theme and plugin updates. Take a fresh backup first, use a safe test environment for higher-risk changes, then check important pages, forms and checkout after updating.

4. Watch the business-critical journeys

• Contact and quote forms
• Checkout, payment and order emails
• Booking or membership actions
• Mobile navigation and important links
• SSL, uptime and visible security warnings

5. Remove avoidable risk

Delete unused administrator accounts, themes and plugins; use strong unique access; enable appropriate multi-factor authentication; and do not share passwords in ordinary email or chat.

6. Review performance with context

Track slow templates, oversized images, heavy third-party scripts and hosting limits. Aim for a fast, stable user experience rather than chasing a single laboratory score at any cost.

7. Keep an incident note

Before anything breaks, record the hosting support route, backup locations and who is authorised to make decisions. During an incident, note symptoms, changes and times so recovery is based on evidence instead of guesswork.