What WordPress already does for you
WordPress installs minor core releases automatically by default; the upgrade documentation says existing installs receive minor core updates out of the box, and major releases are automatic by default only on new installs from version 5.6. Plugins and themes are different: since WordPress 5.5 administrators can switch on auto-updates plugin by plugin and theme by theme, auto-updates run twice a day by default, and WordPress emails the site owner when they succeed or fail.
Auto-updates rely on WP-Cron, so if scheduled tasks stop running, updates stop too. The WordPress documentation suggests checking Tools, Site Health for cron errors when auto-updates are not happening.
For a course site, the safe split is to allow automatic minor core updates and auto-updates for low-risk plugins, and to update the LMS, membership, payment and checkout plugins by hand through staging.
The calendar
| Frequency | Task | Time | Done when |
|---|---|---|---|
| Weekly | Read update and auto-update emails; note any failures | 5 min | No failed updates outstanding |
| Weekly | Log in as a test student, open a lesson, check a download | 5 min | Lesson and file load |
| Weekly | Load checkout to the payment step | 5 min | Payment form renders |
| Weekly | Confirm the latest backup exists and is off-host | 5 min | Backup dated in the last 24 hours |
| Monthly | Update LMS, membership and payment plugins on staging, test, then live | 30 to 45 min | Staging checks pass, live updated |
| Monthly | Check Site Health and WP-Cron for errors | 10 min | No cron or critical errors |
| Monthly | Send a test receipt and password reset | 5 min | Both arrive in an outside inbox |
| Quarterly | Restore a backup to staging and log in | 30 min | Restored site works |
| Quarterly | Review administrator and editor accounts; remove ex-contractors | 15 min | Only current people have access |
| Quarterly | Check certificate expiry and auto-renewal | 5 min | Renewal configured and expiry beyond 30 days |
| Yearly | Check PHP version against php.net support dates | 15 min | Upgrade scheduled before security support ends |
| Yearly | Renew or cancel premium licenses, hosting and domain | 30 min | Each renewal is a deliberate decision |
PHP version dates to plan around
PHP versions have published support windows. When security support ends, a version stops receiving security fixes, and hosts typically start pushing upgrades. Check your version under Tools, Site Health, Info, Server, and plan the upgrade a few months before the end date so you can test on staging.
WordPress's requirements page recommends PHP 8.3 or greater and MariaDB 10.11 or MySQL 8.0 or greater, plus HTTPS.
| PHP branch | Active support until | Security support until | Action for a course site |
|---|---|---|---|
| 8.2 | 31 Dec 2024 | 31 Dec 2026 | Upgrade now; test LMS and checkout on staging first |
| 8.3 | 31 Dec 2025 | 31 Dec 2027 | Meets the WordPress recommendation; plan next upgrade during 2027 |
| 8.4 | 31 Dec 2026 | 31 Dec 2028 | Good target if your LMS and plugins support it |
| 8.5 | 31 Dec 2027 | 31 Dec 2029 | Check plugin compatibility before adopting |
Backups you have actually restored
The WordPress upgrade guide advises backing up before updating and verifying that the backups are there and usable. A backup you have never restored is a hope, not a plan. Once a quarter, restore the latest backup into a staging site and log in as a student. If the restore fails, you have found the problem on a quiet day instead of during an outage.
Keep at least one copy off the hosting account. If the account is suspended, unpaid or compromised, host-only backups go with it.
Certificates, licenses and access
- Let's Encrypt's default certificates last 90 days and it recommends renewing them every 60 days; if your host renews automatically, confirm once a quarter that it is still doing so.
- Keep one list of every premium plugin license with its renewal date and the account it is under.
- Turn off auto-renew only for licenses you have decided to drop, and record why.
- Review WordPress users with Administrator or Editor roles each quarter and remove anyone who no longer needs them.
- Remove contractor access at the host, registrar and payment processor when a project ends, not at the next audit.
Who should hire this out
If you cannot reliably find an hour a month, or the site earns enough that a failed update during a launch would cost more than a maintenance retainer, pay someone to run this calendar. Give them the same checklist and ask for a monthly note of what was updated, what was tested and when the last restore test happened. The schedule is the deliverable; the person doing it can change.
Questions before you decide
Should I turn on plugin auto-updates on a course site?
For low-risk plugins, yes; WordPress runs them twice a day and emails you on success or failure. For the LMS, membership, payment and checkout plugins, update manually through staging so you can test enrollment and checkout first.
Which PHP version should my course site run?
WordPress recommends PHP 8.3 or greater. php.net lists security support for PHP 8.2 ending on 31 December 2026 and for 8.3 on 31 December 2027, so a site on 8.2 should test and schedule an upgrade now.
How often should I test restoring a backup?
Once a quarter is a reasonable rhythm for a solo owner, and always before a major change such as a host move or PHP upgrade. Restore to staging, log in as a student and open a lesson to confirm it works.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- PHP: supported versions Accessed 30 Oct 2026
- WordPress.org: requirements Accessed 30 Oct 2026
- WordPress developer docs: upgrading WordPress Accessed 30 Oct 2026
- WordPress.org documentation: plugin and themes auto-updates Accessed 30 Oct 2026
- Let's Encrypt: FAQ Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.