What to do, and how often.
WEEKLY
Apply available updates, having backed up Check the site loads correctly, including a form or a checkout Check backups ran
MONTHLY
Run a malware scan Review administrator accounts, investigating anything unfamiliar Check disk and inode usage Check for errors in the log
QUARTERLY
Review installed extensions and remove what is unused Check the PHP version is still supported Test a restore from backup Review file permissions Change administrator passwords
ANNUALLY
Full review: is the platform still right, is anything abandoned, does the site still do what it needs to
ACROSS SEVERAL SITES
Keep a list: what is installed where, versions, and when each was last updated. Without it, something will be forgotten.
THE TWO THAT MATTER MOST
Applying updates, and confirming backups actually work.
Those two prevent most of what goes seriously wrong. Everything else is refinement.
