WooCommerce Maintenance Checklist for Agencies

The checklist a real WooCommerce care plan runs — organised by how often you actually do each thing, and led by the part that costs your client money if it slips: the path from add-to-cart to a paid, confirmed order.

Last updated: 21 Jul 2026 · ~9 min read

What a WooCommerce care plan actually covers

Most "WordPress maintenance" checklists were written for content sites: update plugins, take a backup, run a security scan, done. A WooCommerce store has a fourth thing those lists ignore, and it's the one clients care about — the money path. A blog with a broken contact form loses a lead. A store with a gateway silently flipped into test mode, or a webhook that stopped landing, takes real orders that never complete — and nobody notices until a customer emails, or the month's numbers come in low.

So this checklist leads with the money path and treats the classic WordPress hygiene items as the second layer. Everything here is doable by hand with WooCommerce's own admin screens — no tool required. Where a task is easy to skip because it fails silently, we say so.

Every day — or continuously — the money path

Daily · money path

• Confirm a customer can actually reach a paid order — the full add-to-cart → checkout → payment → order-received flow. This is the single check that matters most and the one no update log will flag. A test order (or a real one you can see completing) proves it end to end.
• Check for orders sitting on Pending payment or Failed when they shouldn't be. A cluster of stuck orders usually means the gateway stopped confirming payments back to WooCommerce — a broken webhook or IPN. See our guide on orders stuck on pending payment.
• Confirm order and payment emails are going out (customer receipt and the store's new-order notification). WordPress's built-in mail is unreliable on most hosts; a store can stop emailing receipts with nothing in the logs. See order emails not sending.
• Check the store is up, the front page loads, and the SSL certificate is valid (not expiring in days). An expired certificate blocks checkout outright and browsers show a scary warning to every visitor.
• Confirm the live payment gateway is in live mode, not test/sandbox. A gateway left in test mode after a change takes card details and completes checkout, but never charges anyone — the store looks fine and earns nothing.

Every week — catch the silent failures

Weekly · health & queues

• Open WooCommerce → Status and scan the System Status report for red rows. It flags a database table that's out of date, a template a theme is overriding, an outdated WooCommerce database, and PHP/WordPress version problems in one place.
• Check WooCommerce → Status → Scheduled Actions for a backlog of past-due or failed actions. Action Scheduler runs renewals, emails, syncs and cleanups. If it stalls (usually a WP-Cron problem), those jobs silently stop. See scheduled actions stuck pending.
• Review failed and on-hold orders, and any subscriptions that have gone on-hold. A failed subscription renewal doesn't retry forever — it's quiet recurring revenue leaving. See subscription renewals not charging.
• Check WooCommerce → Status → Logs for new fatal errors or repeated warnings.
• Confirm the latest off-site backup ran and is complete — not just that the plugin says "success".
• Note any plugin, theme or core updates now available, and read the changelogs before touching anything. Don't apply on production yet.
• Skim the security/firewall log for spikes in blocked login attempts or spam.

Every month — updates, cleanup, performance

Monthly · maintenance window

• Apply plugin, theme and WooCommerce/WordPress core updates on a staging copy first, then run a smoke test — add to cart, check out, place a test order — before pushing to production. The most expensive outages happen when an update ships straight to a live store and breaks checkout. Staging first is the whole game.
• After updating WooCommerce, re-check the System Status report and run any pending database update it prompts for.
• Clean up the database using WooCommerce → Status → Tools — clear expired transients and stale customer sessions; regenerate product lookup tables if reports look wrong. Use WooCommerce's own tools rather than a blunt "optimise" plugin, so you're not deleting order or session data the store still needs.
• Review WooCommerce Analytics against the payment gateway's own dashboard for the month — do order counts and revenue roughly match? A gap between what the store recorded and what the gateway settled is how you catch orders that completed payment but never became orders.
• Run a performance pass: confirm caching is working, check the largest pages and images, and look at Core Web Vitals for the shop and product templates.
• Review admin users and roles — remove accounts that shouldn't still have access.
• Check disk usage and log growth; large or fast-growing logs are often a symptom, not just clutter.

Every quarter — security, tested backups, compliance

Quarterly · deeper audit

• Restore a backup to a throwaway staging site. A backup you've never restored is a guess, not a backup — the quarterly restore test is the only thing that proves it works.
• Full security review: admin users, file integrity, firewall rules, and any plugin with a known unpatched vulnerability.
• Inventory premium plugin and theme licences — flag any expiring soon. An expired licence usually means updates stop, which quietly turns a maintained plugin into an unpatched security hole.
• Check the site's PHP version against the PHP support timeline and WooCommerce's requirements; plan an upgrade before the version goes end-of-life.
• Audit installed plugins — remove ones that are unused, abandoned, or duplicating functionality.
• Re-verify payment gateway configuration: webhook/IPN endpoints, API keys, and that Strong Customer Authentication (SCA/3DS) still works on a real test transaction.
• Review tax rates and any region-specific compliance settings — rates and rules change, and stale ones cause quiet under- or over-charging.

How often should you actually run these?

Cadence should follow risk, not a calendar for its own sake. A high-volume store, or one taking subscription renewals, earns tighter money-path checks — daily or continuous — because a silent break there costs money every hour. A low-traffic brochure-plus-shop can run a lighter weekly rhythm. The rule that holds across all of them: the money path is checked more often than everything else, because it's the part that fails silently and the part your client feels first.

Frequently asked