A year-end WordPress maintenance checklist

The end of the year is a good time to give your WordPress site a full check. Take a backup you know you can restore, update WordPress, its themes and its plugins, and make sure the site runs on a supported PHP version, because PHP 8.2 stops receiving security fixes on 31 December 2026. Then run Site Health, remove the plugins, themes and user accounts you no longer need, and test every form and checkout. The checklist takes about an hour for a typical site, and each step links to a guide that shows how.

1. Take a backup you can restore

Every other step changes something, so start with a backup. WordPress's own update guide says the same: back up first, and check the backup is there and usable.

A good backup holds the website files and the database, and is stored somewhere other than the server the site runs on. On Noiz hosting you can download a full backup from Plesk, and our Plesk backup overview explains the options. Keep your own copy of the site and of anything else you cannot afford to lose, mail included.

2. Update WordPress, themes and plugins

As at October 2026, the current WordPress release is 7.1.3, and WordPress 7.2 is scheduled for 8 December 2026. WordPress officially supports only the latest version. Its security team back-ports critical fixes to older versions as a courtesy, but a site that stays behind falls further out of step each year.

Follow WordPress's own guide to updating WordPress, then update themes and plugins. If a plugin update fails or leaves the site broken, our guide to reinstalling or updating a plugin without losing data shows the recovery.

While you are on the Plugins screen, decide which plugins should update automatically. Since WordPress 5.5 you can switch automatic updates on or off plugin by plugin and theme by theme. WordPress advises turning them on only where you can roll back, which means regular automatic backups.

3. Move off PHP 8.2 before 31 December

PHP is the language WordPress runs on, and each PHP version has a fixed end of life. As at October 2026:

WordPress recommends PHP 8.3 or later. If your site still runs on 8.2 or older, test it on a newer version and switch before the year ends. On Noiz Premium hosting you choose the PHP version per site; our guide shows how to change the PHP version in Plesk. Legacy plans have no PHP version choice, so if you are unsure which version your site runs, ask us.

4. Run Site Health

WordPress has a built-in check at Tools > Site Health. Its Status tab lists critical issues and recommended improvements, such as background updates not working, an outdated PHP version, plugins waiting for updates, or errors shown to visitors. Its Info tab lists inactive plugins and themes, the number of users and whether anyone can register.

Work through every critical issue. Most have a one-line fix.

5. Remove what you do not use

Every installed plugin and theme is code on your server, even when it is switched off. WordPress's hardening guide is plain about it: if you are not using a plugin, delete it.

• Deactivate and delete unused plugins.
• Delete themes you do not use, keeping your active theme and, if it is a child theme, its parent.

6. Replace abandoned plugins

A plugin that nobody maintains will not get fixes when a flaw is found. Two signs on its WordPress.org page tell you to look closer:

• "This plugin hasn't been tested with the latest 3 major releases of WordPress." The author has not confirmed it works with recent versions. It may still be fine, but it deserves a check.
• "This plugin has been closed." WordPress.org closes plugins for guideline breaches, security issues or at the author's request. A closed plugin can no longer be downloaded or updated through WordPress.

Our guide on when to replace an outdated or abandoned plugin shows how to tell the difference and what to do.

7. Review users and administrator accounts

People leave, agencies change, and accounts stay behind. For each user, ask whether they still need access and whether they need the role they have.

• Delete accounts for people who no longer work on the site. WordPress asks whether to delete their posts or give them to another user, so nothing is lost by accident.
• Rename any account called "admin" or "webmaster". These are the first names attackers try.
• Make sure every administrator has a strong, unique password and two-factor sign-in. Our guide shows how to set up two-factor authentication in WordPress.

8. Revoke application passwords you no longer need

Application passwords let scripts, apps and AI assistants work with your site without your main password. They cannot be used to sign in to the dashboard, but they can still read and change content. Open Users > Profile for each administrator, check the list and its "last used" dates, and revoke any you do not recognise or no longer use.

9. Test forms, checkouts and logins

Updates can break the parts of a site that make it useful. After the steps above, test them yourself:

• send a message through each contact form and check it arrives
• place a test order or booking if the site takes them
• sign out and sign in again
• check the pages your visitors use most

If spam has been getting through your forms or comments, our guide to stopping comment and form spam covers the built-in settings first.

10. Clear out the media library

Unused images and old uploads fill your disk and make every backup bigger. Our guide to cleaning up your WordPress media library shows how to find and remove them safely.

11. Check what renews in the new year

Make a list of what the site depends on and when each renews: the domain name, the hosting, and any paid plugin or theme licences. An expired domain takes the site and its email offline. An expired plugin licence usually means no more updates, which brings you back to step 6.

Let Noiz do the weekly part

This checklist is a yearly reset. The updates, restore points and checks in it are weekly work. WordPress Care does that work for you: weekly updates of core, themes and plugins with a restore point first, checks after every cycle, security patching, and clean-up and recovery if the site is hacked or breaks.

Sources

Checked 19 October 2026. Version facts are as at October 2026.

WordPress

• WordPress releases
• WordPress 7.2 schedule
• WordPress requirements
• WordPress security
• Updating WordPress
• Plugin and theme auto-updates
• Site Health screen
• Hardening WordPress
• Application passwords
• Plugin developer FAQ: closed plugins

PHP

• PHP supported versions
• PHP unsupported branches

Noiz

• WordPress Care
• Shared hosting
• Noiz help centre: the guides linked in each step, at docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.