What to do regularly.
WEEKLY
Apply security updates Check for unexpected user accounts Check backups ran
MONTHLY
Run a malware scan Review who has access Check for files you did not create Check your site appears correctly in search
QUARTERLY
Audit plugins and remove unused ones Review all accounts and remove those no longer needed Test a backup restore Review cron jobs
ANNUALLY
Full review of everything installed Review your documentation Check registrar and hosting account security
AFTER ANY CHANGE
Check the site works Check nothing unexpected was added
WHO DOES IT
Someone specific.
Security that is everyone's responsibility is nobody's.
WHAT TO RECORD
What you checked and when.
WHY THE ROUTINE MATTERS
Compromises happen to neglected sites far more than to maintained ones.
