The Complete WordPress Website Management Guide for 2026

A WordPress site is not a project. It is a property. Properties need upkeep.

I have managed WordPress sites for twelve years, from a one-page contractor site to multi-location brands with thousands of pages. The sites that made money had one thing in common, and it was not the theme or the host. Somebody had a list, and they worked the list every week. This is that list, with the reasoning behind every item, so you can decide what applies to you.

Most WordPress problems are not technical. They are calendar problems. Nobody was assigned the Tuesday.

How to use this page. It is long on purpose. Read Part 1 once, start to finish. Then use the two indexes below to jump: by topic when something breaks, by cadence when you are planning your week. Every chapter ends with a link back up here.

Hosting, domain, renewals and email DNS

Three separate companies can take your site offline, and most owners can only name one of them. The host runs the server. The registrar owns the right to your web address. The DNS provider tells the internet where to send visitors. Often these are the same company. Often they are not, and nobody wrote down which is which, or who has the login.

The most common outage I get called about is not a hack. It is a domain that expired because the renewal email went to an inbox belonging to someone who left in 2022.

• Domain registered in the business’s name, not a former employee’s or an agency’s, with a billing contact that is a role address like admin@ rather than a person. Annual
• SSL certificate renewing automatically. Most hosts handle this now. Confirm by checking the expiry date in the browser padlock once a quarter. Quarterly
• PHP on a supported version. 8.3 or newer by the end of 2026, since 8.2 leaves security support on December 31. Most hosts let you switch in a click. Quarterly
• Hosting plan still fits the traffic. If the site got slower as it grew, the plan may be the bottleneck before any plugin is. Annual
• Uptime monitor running and emailing more than one person. A free monitor checking every five minutes is enough. Set up once

Email from your domain: the DNS records nobody set

Your website sends email: form notifications, order receipts, password resets. Whether those emails arrive depends on three DNS records that live next to your domain, not in WordPress. Mailbox providers have tightened the rules since 2024, and a domain without them lands in spam or gets rejected outright.

• SPF, DKIM and DMARC published for every service that sends email as your domain, meaning the site’s SMTP tool, the newsletter platform and the CRM. Annual, and when a tool is added
• DMARC reports going somewhere that a person or a free monitoring tool reads every so often. Quarterly
• Website mail sent through a transactional service, never the web server’s own mail function. Set up once

Site Health and the settings nobody revisits

WordPress ships a Site Health screen under Tools that checks the basics for you: PHP version, HTTPS, inactive plugins, scheduled events, and whether the server can reach the update service. Open it monthly. Then walk this list once a year, because each item is set once, forgotten, and rediscovered only after a migration or a hack.

• Site Health shows no critical issues and the recommendations list is read. Monthly
• “Discourage search engines” unchecked on live, checked on staging. The classic post-migration mistake. After every migration
• Permalinks set to post name, timezone and date format correct. Annual
• Admin email is a monitored role address, not a departed person. Annual
• User registration off unless the site needs accounts; default role Subscriber. Annual
• Comments closed or moderated, with old-post comments closed automatically. Annual
• XML-RPC disabled unless a mobile app or integration needs it. Set once
• Scheduled tasks on a real server cron, not WP-Cron, so backups and scheduled posts run on quiet sites. Set once
• Post revisions limited (ten is plenty) and trash emptied automatically. Set once
• Custom code in a child theme or a small plugin, never in the parent theme, so updates do not erase it. Set once
• Security headers and HSTS set at the host or CDN; no mixed-content warnings. Annual
• Staging site noindexed and password protected. A leaked staging copy is duplicate content and an open door. Quarterly

Security and hardening

WordPress core is well defended. Six vulnerabilities were reported in it in all of 2025, according to Patchstack. Plugins carried 91 percent of the 11,334 flaws found that year, and nearly half had no fix available when they were made public. Your security posture is your plugin list.

The practical rule: fewer plugins, from developers who ship updates, each one doing a job you can name. If you cannot say what a plugin does in one sentence, it is a candidate for removal. The first thing I do on any site I take over is read the plugin list out loud with the owner; we usually lose a third of it in that one conversation.

• Admin usernames are not “admin” and no shared logins exist. Annual
• Two-factor for every account that can log in, not only admins. Set up once
• Two-factor recovery codes stored in the password manager, and a second admin who can log in if the first phone is lost. Set up once
• Login attempts limited and the login page not linked anywhere public. Set up once
• File editing from the dashboard disabled (one line in wp-config). Set up once
• Users audited: every account belongs to a current person with the lowest role that does the job. Quarterly
• Abandoned plugins replaced. If the last update is older than a year, find an alternative. Quarterly
• Unused and default themes deleted. An inactive theme still runs if someone calls its files directly. Quarterly
• File integrity checked against the official copies, and the user list reviewed for accounts nobody created. Both find the hack the scanner missed. Weekly
• Malware scan reviewed, not just running. Read the result. Weekly
• Security plugin and firewall rules updating automatically. Weekly

When a vulnerability alert lands

Subscribe to one vulnerability feed for the plugins you run; the security plugins and the Patchstack and Wordfence databases all offer one. Then triage in sixty seconds rather than reading every alert as an emergency.

Backups and disaster recovery

Everyone has backups. Almost nobody has tested one. I ask about the last restore on every site I inherit, and the usual answer is a pause. A backup is a file. A recovery is a process with a time attached, and the time is what you are paying for. If restoring the site takes a day of someone figuring out how, you have a day of outage built into your plan.

Staging, change windows and who may touch what

A staging site is a private copy of the live site where changes are made and checked before anyone else sees them. Most managed hosts offer one in a click. It is the single tool that separates “we update and hope” from “we update and know,” and most plans include it.

Change freeze windows

Pick the weeks when nothing changes except a security patch: the days before and during a campaign launch, a trade show, a holiday sales period, or any week the owner is unreachable. Put them in the calendar in January. Most self-inflicted outages I see happened on the Friday before a long weekend.

Who may touch what

Give each person the lowest role that does their job, and write down what each role may change without asking. The owner and marketing team can safely edit page copy, blog posts, images and menu labels. Plugins, theme settings, code, forms and anything under Settings belong to one named person.

Updates and QA after changes

Updates are the most important security control and the most common cause of breakage, which is why so many sites sit on either extreme: everything updates automatically with nobody watching, or nothing has updated since 2024 because someone got burned once. The answer is a routine, not a setting, and the routine has five steps.

The ten-minute check is the step teams skip, and it is the one that catches the broken form. I keep the list on a card next to the monitor. Nobody remembers the booking widget otherwise.

WordPress 7.0 and AI in core: what to decide before you turn it on

WordPress 7.0, released May 20, 2026, is the biggest core change in years, and most of it is management work rather than developer work. The dashboard was rebuilt with a new color scheme and a command palette, fonts got their own management page, revisions can be scrubbed visually and restored in a click, and Breadcrumbs and Icons blocks arrived in core.

And AI arrived in core through a Connectors screen that manages external connections, backed by the AI Client and Abilities API. The official 7.0 announcement has the full list; the decisions below are the ones that land on whoever manages the site.

• 7.0 applied on staging first, with page builder, WooCommerce and membership plugins updated before core, and the ten-minute check after. Styling problems and broken forms are the common failures, not fatal errors. Once, then each major release
• AI connector decision recorded: enabled or not, which provider, who owns the key, what it is allowed to generate. Annual
• Generated alt text and excerpts spot-checked for accuracy before they are trusted site-wide. Monthly
• Editors shown the new dashboard, the command palette and visual revisions before the update, so nobody discovers them on deadline. Once
• Plugins that duplicate core 7.0 features removed: separate breadcrumb, icon, lightbox and font-management plugins may now be dead weight. Quarterly audit
• PHP on 8.3 or newer before the end of 2026. PHP 8.2 leaves security support on December 31, 2026, per the PHP supported versions table. This year

Here is how I would roll it out: staging first, editors shown the new dashboard in a fifteen-minute call, the connector left off until someone can say in writing what it is for. That order has not failed me on any other integration, and I see no reason this one is different.

Performance and Core Web Vitals

Google measures three things about how a page feels to a real visitor, and they are the only speed numbers worth reporting to an owner. Everything else is a diagnostic for you.

Those thresholds come from Google’s own Web Vitals documentation and are judged at the 75th percentile of real visits, which means the field data in Search Console is the score that counts, not a single lab test you ran on the fast office wifi.

On WordPress, the same five causes account for most slow sites: oversized images, too many plugins loading scripts on every page, no page caching, a bloated theme or page builder, and cheap hosting. Fix them in that order. Image compression and caching alone usually get a site from red to amber in an afternoon.

Two failures are so common they deserve names, and I check for both before I open a single report. INP fails most often because of a page builder or a slider plugin running scripts on every interaction.

LCP fails most often because the hero image was lazy-loaded, so the biggest thing on the page waits for everything else. Turn lazy loading off for the first image and give it a fetch priority hint.

The four layers under the page

• Hosting-level cache and a CDN. Most managed hosts include both; on cheaper hosts, a free CDN in front of the site handles caching and serves images from a location near the visitor. Set up once
• Object caching (Redis or Memcached) on any store or logged-in site, where page caching cannot help because every page is different. Set up once
• Database cleaned of post revisions, expired transients, spam comments and orphaned plugin tables. A bloated database is why the admin feels slow. Monthly
• PHP version and memory limit current. PHP 8.3 and newer are measurably faster than the versions most sites still run. Quarterly
• Slow admin treated as a symptom. If editing pages drags, it is usually a plugin running on every admin load or a database that needs cleaning, and visitors feel the same cause. When noticed

Incident playbooks: hacked, down, white screen, ranking drop

You will not think clearly at 7 a.m. with the site down and the owner texting. Decide the first five moves now. These six playbooks cover almost every emergency I have been handed.

For playbook D, the 2026 dates to check against: Google ran a Discover update on February 5, core updates on March 27 and May 21, and spam updates on March 24, June 24, August 18 and September 24, per the Google Search Status Dashboard. If a drop starts within a few days of one of these and the change log is empty, the fix is content and quality, not a bug.

Conversion: the operating rule for the whole site

A website is managed well when it makes money on purpose. Not when it is fast, secure and ranking; those are the conditions. The result is a visitor who became a lead, a booking or an order, and the management job is to make that happen more often from the same traffic.

This chapter is the layer above the next nine. Every one of them, from design to analytics, is a way of serving the rule laid out here.

The rule has three parts. Every page has a job. Every job ends in a next step. Every next step is measured. If a page cannot say which of those it is doing, it is costing you visitors you already paid for.

The path: five stages, five leaks

Every conversion on every site follows the same path, whether it ends in a phone call or a checkout. Name the stages and you can find where yours leaks, because each stage has its own symptom and its own number.

Most audits stop at stage four. I have watched sites fix the homepage, double the form fills, and show no change in revenue because stage five was a shared inbox nobody owned. The site with six months of rising traffic and one call leaked at stage two. The roofing site ranked on page seven leaked at three and four. Different fixes, same path.

What else conversion touches: every discipline has a conversion job

Design, UX and mobile are the obvious three. They are not the only three. Here is what each part of the site owes the path, the one number that shows whether it is paying, and the way it usually fails.

The ask ladder: meet the visitor where they are

“Call now” is the right ask for the one visitor in twenty who is ready. The other nineteen need something smaller, or they leave and you never learn they were there. A site with one rung on the ladder converts the ready and loses the rest.

Each service page carries two rungs: the full ask, and the one below it. The homepage carries three. A blog post carries the learn rung and a link to the service page. That is the whole design. I have never seen a site add a well-made middle rung and get fewer leads.

The offer underneath the design

No layout rescues a weak offer, and a strong one survives a mediocre layout. Before any conversion work on the page, answer five questions in writing. If the answers are vague, the page will be vague.

1. What exactly do you do, and for whom? A roofer for homes under 3,000 square feet in three counties beats “roofing solutions.”
2. What is the proof a stranger would accept? Named results, recent reviews, real photos, a license number. In that order of strength.
3. What does it cost, or how is the price decided? A range, a starting point, or the three things that move it. “Call for a quote” sends the visitor to the competitor who published a number.
4. What removes the risk of choosing you? A guarantee, a free inspection, financing, a fixed timeline, a named person they will deal with.
5. What happens in the first hour after they ask? Say it on the page. “You will hear from Dana within one business hour” is a conversion element.

Which page first: the prioritization rule

Chapter 19 tells you to start with the leakiest page. Here is how to find it without guessing. For each page with meaningful traffic, multiply the visitors it gets by the gap between its lead rate and the lead rate of your best comparable page. The biggest product is the page to work on first. It is rarely the homepage and almost never the page the owner is embarrassed by.

Segments: one lead rate is hiding four

A site-wide lead rate is an average of groups that behave nothing alike, and the average hides the problem. Split it four ways before deciding anything: mobile against desktop, new against returning, by source (organic, maps, direct, paid, AI referral), and by landing page type.

The gap between the best and worst segment is usually the whole opportunity.

• Mobile converting at half the desktop rate means the ask is hard to reach with a thumb, not that mobile visitors are less serious. Check monthly
• Returning visitors converting far above new ones means the trust stage is too long for a single visit; add the learn and check rungs so first visits leave a trace. Check quarterly
• Maps traffic converting above organic is normal; maps visitors are already deciding. If organic beats maps, the profile needs work. Check monthly
• AI referral visits landing on articles and never on service pages means the articles have no next step. Check monthly
• Article landings converting at a tenth of service landings is expected; article landings with no path to any service page at all is the leak you fix first. Check quarterly

The five minutes after the form

Follow-up is a website management task because the website made a promise the moment the thank-you page appeared. The lead is comparing three companies and the first one to answer usually wins. Measure the minutes from submission to first human reply, by hour of day and day of week, and assign the inbox to a person with a backup.

Where nobody can answer in an hour, say so on the page and set an automatic reply that gives a time. An honest “we reply by 9 a.m. tomorrow” beats silence, and silence is what most sites send.

When to test, and when to compare

A proper A/B test needs enough conversions per version to tell signal from noise. As a working rule, if a page produces fewer than a hundred leads a month, you cannot run a clean split test on it, and most small-business pages do not produce that.

That is not a reason to skip the work. Change one thing, record the date, hold it for four weeks, and compare the result against the four weeks before it, adjusting for the season.

For the sites that do have the volume, testing and personalization by visitor segment is where the large gains live. I wrote up how that doubled a lender’s online applications, and the method scales down to one change at a time.

Conversion-built design

A homepage has about five seconds to answer three questions: what do you do, is it for me, and what do I do next. Most WordPress homepages answer none of them above the fold. They open with a slider, a welcome message, or the company name, which the visitor already knows because they typed it.

I once watched a site with rising rankings and 40 percent more traffic produce one phone call in six months. Nothing was wrong with the SEO. The homepage had no reason to call on it. The fix took a week and did not add a page.

• The first screen says what you do, for whom, and where, in words a customer would use. Check quarterly
• One primary action per page, visible without scrolling, repeated at the bottom. Call, book, quote, buy. Not all four. Check quarterly
• Phone number clickable in the header on mobile. Check monthly
• Proof near the ask: reviews, logos, numbers, photos of real work, next to the button, not on a separate page. Refresh quarterly
• The offer is clear enough to repeat: what you do, what it costs or how pricing works, how long it takes, what happens next. If a visitor cannot explain your offer to a spouse, they cannot buy it. Check quarterly
• Proof in order of strength: a named result, then a review, then a logo, then a number. Lead with the strongest you can show. Refresh quarterly
• Service pages that each sell one service and end with the same clear next step. Check quarterly
• No sliders, no auto-playing video with sound, no pop-up in the first ten seconds. Set once

User experience and navigation

Navigation is a set of promises. Each menu label promises the visitor a page that answers the question in their head. UX breaks when the label and the page disagree, or when the thing people came for is three clicks deep under a word only the company uses.

The best UX tool you have is the site search log and the behavior data you already collect. What people type into search is what they could not find in the menu. Where they rage-click is where the page promised something and did not deliver. I wrote about using behavior and journey data to fix navigation; the method fits any WordPress site.

Site search, set up so the log is worth reading

WordPress search out of the box matches words in titles and body text, in date order, and ignores products, documents and custom fields. On a site with more than a few dozen pages, replace it with a search plugin that ranks by relevance, searches everything, and logs the queries. The log is the cheapest user research you will ever get.

• Search box visible on every page, in the header on mobile. Set up once
• Relevance ranking, not date order. Set up once
• Queries logged and the no-results list reviewed. Monthly
• Top five searches answered in the menu or on the homepage. Quarterly

Mobile

For most local and service businesses, more than half of visitors arrive on a phone, and Google indexes the mobile version of the page. Yet almost every site is built, reviewed and approved on a 27-inch monitor. The mobile experience is whatever happened to the desktop design when it got squeezed.

I keep a mid-range Android on the desk for this and nothing else. It has caught more broken menus and hidden phone numbers than any paid testing tool.

• Phone number and primary button visible without scrolling. Monthly
• Tap targets big enough for a thumb, with space between them. Quarterly
• Forms short, with the right keyboard per field (number pad for phone). Quarterly
• Text readable without zooming, 16 pixels or larger. Quarterly
• No horizontal scroll, no element wider than the screen. After every change
• Pop-ups and cookie banners dismissable with one tap and not covering the content. Quarterly
• Images and tables adapt instead of shrinking to unreadable. Quarterly
• Speed checked on a mid-range Android, not the newest iPhone. Quarterly

SEO: on-page, off-page and technical

SEO in 2026 is less about tricks than it has ever been and more about being the clearest answer to a real question, on a page Google can read, from a business other people vouch for. I stopped reporting rankings to owners years ago; they are my diagnostic, not their result.

What to aim at: keyword strategy when the click is not the prize

The old keyword method was volume first: find the phrases with the most searches, build a page per phrase, count the clicks. Three things broke it.

AI answers now absorb most of the research queries, so the volume is still there and the click is not. The queries got longer and more conversational, which the keyword tools cannot see. And Google now says plainly that it understands synonyms and meaning, so a page per variation is wasted work at best and a policy problem at worst.

What replaces it is a list of questions sorted by what they are worth, not by how often they are typed. Every question a customer asks falls into one of three moments, and each moment gets a different budget.

Build the list from places the keyword tools do not look: the branded versus non-branded split in Search Console, the site search log, the questions people ask on the phone and in sales email, the Q&A on your Business Profile, and the questions your competitors’ pages leave unanswered. A tool can confirm demand. It cannot tell you which question ends in a purchase.

One question, one page, one owner: the map that prevents cannibalization

Keyword cannibalization is two or more of your own pages competing for the same question. Google picks one, usually not the one you wanted, and swaps between them as it changes its mind. The symptoms are rankings that flicker, click-through that drops while impressions hold, and a page that ranks for a question it does not answer. In 2026 the stakes rose, for a reason that is new.

AI Overviews and AI Mode cite a handful of sources, and in my experience rarely more than one page from the same site for the same question. If three of your pages half-answer it, none of them is the obvious one to quote, and the citation goes to a competitor with one page that answers it whole.

Cannibalization used to split your clicks. Now it can cost you the one slot that was on offer.

The defense is a living document, not a one-time audit. One row per question worth owning: the question, the one page that answers it, who owns that page, and the date it was last refreshed. Every new page proposal is checked against the map before it is written. If the question already has a page, the new content goes into that page.

Finding and fixing cannibalization, monthly

1. In Search Console, filter Performance to one important query and look at the Pages tab. Two or more URLs taking turns over the last three months is the signature. Do this for your top twenty decision questions.
2. Decide which page should win, using the map. It is usually the one with the clearer answer and the better internal links, and rarely the older or longer one.
3. Pick one of four fixes. Merge the weaker page into the winner and redirect it. Re-point the weaker page at a different question it answers better and retitle it. Canonical it to the winner if it has to stay. Or, for filter and tag pages, noindex them. Deleting without a redirect is never one of the four.
4. Fix the internal links so every mention of the question across the site points at the winner, with the question in the anchor text.
5. Check for date cannibalization. “Best X 2025” and “Best X 2026” as separate pages is the most common self-inflicted version. One page, one URL, updated each year, is what you want for a guide like this one.

One more reason to take this seriously in 2026. Google’s guidance on generative AI features says that creating separate pages for each query variation, mainly to influence rankings or AI responses, falls under its scaled content abuse policy. The page-per-phrase method is not just inefficient now. It is on the wrong side of a line.

Then the upkeep. Three layers, three cadences.

The monthly SEO hour

1. Search Console, Pages report. Any new “not indexed” reasons? Any page that was indexed and now is not?
2. Search Console, Performance. Which five queries gained or lost the most clicks? Which pages sit in positions 5 to 15 and deserve a refresh?
3. Refresh two pages. Update the facts, tighten the first paragraph, add the question people are asking, fix the internal links. Change the date only if the content changed.
4. Google Business Profile. Answer reviews, add a post or photo, confirm hours. Local results are won here as much as on the site. Chapter 14 has the routine.
5. Check for duplicates. Two pages chasing the same phrase split the credit. Merge or pick one.

What Search Console added in 2026

Two reports change the monthly hour. A branded versus non-branded query filter, available since March, separates people who already know you from people who are still choosing.

And a Search Generative AI performance report, announced June 3 and rolling out through August, shows which pages appeared in AI Overviews and AI Mode, by country, device and date. Google points to it as the way to measure AI visibility in its generative AI guide. It counts impressions, not clicks: read it as “are we in the answer,” not “did the answer send traffic.”

The technical checklist: crawl, index, address

• robots.txt reviewed: blocks only admin paths and search result pages, never CSS, images or the whole site. Quarterly
• XML sitemap submitted in Search Console and containing only the pages you want found: no tag pages, attachment pages or drafts. Monthly
• One address per page. www or not, trailing slash or not, http redirecting to https, canonical tag pointing at itself. Quarterly
• 404 report read and redirects added for any old URL still getting visits or links. Deleted products and renamed pages go to the closest live page, not the homepage. Monthly
• Redirect chains and loops removed. One hop only. Old redirects pointing at pages that have since moved are the usual cause. Quarterly
• Broken links found and fixed, internal and outbound, with a crawler or a link-check plugin that runs on a schedule. Monthly
• Internal links maintained: every new page linked from at least two existing pages, and every service page linked from the articles explaining it. Monthly
• Structured data validated after any theme or plugin change, in the Rich Results test. Quarterly
• Noindex set on purpose: thank-you pages, internal search results, staging. Checked after every migration. Quarterly
• Pagination, filters and parameter URLs controlled. On a store, filter and sort combinations create most of the junk pages; canonical them to the main category or block them. Quarterly
• Search Console Crawl Stats read for spikes in errors or response time, which show a server or plugin problem before rankings do. Monthly

The migration playbook: the one event that loses the most traffic

A redesign, a new domain, a new host or a new URL structure is where sites lose a third of their traffic overnight, and the loss is almost always self-inflicted. I have written up one of those. The order below is the whole defense.

Local SEO, reviews and reputation

If customers come to you, or you go to them, most of your searches are local, and most local results come from Google Business Profile, not the website. The profile is a second website you did not design, with its own routine. Reviews are its content, and review velocity, how many and how recently, moves rankings more than almost anything you can do on the site.

• Review requests built into the process: a link in the invoice, a text after the job, a card at the counter. Aim for steady, not bursts. Weekly
• Every review answered, the critical ones calmly and with a next step. Prospects read your replies more than the reviews. Weekly
• Name, address, phone identical on the site, the profile and the major directories. Quarterly
• Service area pages with specifics only you could write: local projects, local landmarks, local regulations. No swapped city names in a template. Quarterly
• Profile posts and photos added monthly; Q&A section seeded with the questions people ask by phone. Monthly
• Duplicate or outdated listings claimed and corrected. Annual
• Reviews on the site, pulled from the profile and placed near every call to action. Quarterly refresh

Here is what I would do first, before touching the website: finish the profile, pick the one moment in the job where a customer is happiest, and put the review request there. Everything else in this chapter builds on that habit.

AI search: AEO, GEO and LLMs

A growing share of searches now end in an answer written by a machine, in Google’s AI Overviews and AI Mode, in ChatGPT, Claude, Perplexity and the rest. The question is no longer only “do we rank” but “do we get cited when the answer is assembled,” and beyond that, “do we get recommended when someone asks who to call.”

Three acronyms describe this work: AEO, GEO and plain LLM visibility. Google’s own position, in its guide to generative AI features, is that all three are still SEO, with no special markup, no llms.txt and no AEO hacks required. I agree, with one addition: the strategy has to come before the tactics, and most sites skip straight past it.

I run the same test on every site I work on: ask the assistants the five questions a customer would ask, and see who gets named. It takes ten minutes and it has reshaped more content plans than any keyword tool.

The strategy: pick the five answers worth owning

You cannot be the source for everything, and you do not need to be. For most businesses there are about five questions where being the cited answer changes revenue: cost, which option to choose, how long it takes or what to expect, who is best nearby, and the one objection every customer raises before buying.

Write those five down. They are the AI search strategy. The rest is upkeep.

Then be honest about which of the five you can win. The assistants prefer the source with a specific answer, first-hand experience and a name behind it. If the best you can offer on “cost” is “it depends, call us,” a competitor who publishes a real range will be the one quoted, and you will be the one the visitor never sees.

What gets a page cited, and what does not

• A quotable fact. A number, a range, a date, a condition. Models need something to lift. “One to three days, depending on pitch and layers” gets cited; “timelines vary” does not. Every key page
• Something the summaries cannot say. Google calls it non-commodity content: your own data, your own job photos, what went wrong on a real project. A page that restates what ten other pages say is the one left out. Every key page
• A named person with a reason to be believed, on the page and on an about page the model can find. Annual
• The sub-questions answered on the same page. AI Mode breaks a question into several related searches and gathers sources for each. A page that handles the “and then what” questions in its sections shows up more than once in that process. Quarterly refresh
• Mentions that exist for their own reasons: directories, reviews, local press, supplier pages, forum threads where you helped someone. The assistants weigh corroboration from outside your site, and Google says inauthentic mentions are not considered helpful. Ongoing
• Nothing clever. No chunked micro-pages, no “ideal length,” no variant pages for each phrasing, no special schema beyond what earns rich results. Google has said each of those does not help. Stop doing

Three different readers: Overviews, AI Mode and the assistants

Treating them as one thing is the most common strategy mistake. They pull from different places and reward slightly different pages.

One more reader is arriving: the agent that browses on a person’s behalf, reading the page’s structure and accessibility tree rather than its pixels. Google’s guide mentions these directly. Every accessibility fix in chapter 20 is also an agent-readiness fix, which is the best argument for that work I know.

What a citable answer block looks like

Put it directly under the heading, before any story or sales copy. Two to four sentences, written so they still make sense when lifted out of the page.

Robots policy for AI crawlers

Decide, on purpose, which AI crawlers may read your site. Blocking them all protects your content and removes you from the answers. Allowing them all trades content for visibility. Most businesses that want customers should allow the search-oriented crawlers and can choose on the training-only ones. Review the list twice a year, because the names change.

• robots.txt reviewed for AI user agents such as GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot and Google-Extended, with a written decision for each. Twice a year
• llms.txt treated as optional. It is a proposed plain-text summary of your site for AI tools. Google says it does not use it; no other major engine has committed to it. It costs an hour and does no harm, and it is not a strategy. Annual
• Business facts consistent everywhere: name, address, phone, hours, services, in the same words. Quarterly
• Author and organization information present on content pages, with a real person and a real about page. Annual

Measuring it now that you can

• Search Console’s Generative AI report read monthly: which pages appear in AI Overviews and AI Mode, and which stopped. Monthly
• GA4’s AI Assistant channel (added May 2026) watched for visits arriving from ChatGPT, Gemini, Claude and the rest, and which pages they land on. Monthly
• The five-question test still run by hand, because a citation and a recommendation are different things. Monthly

If the site sits behind Cloudflare

Cloudflare now sorts AI bots into three categories, Search, Agent and Training, and changed its defaults on September 15, 2026. New domains block Training and Agent bots on pages that show ads, and a multi-purpose crawler is judged by its most restricted job.

Cloudflare’s own announcement names Googlebot, Applebot and Bingbot as crawlers that both search and train, so a Training block can cost search visibility.

Open the AI Crawl Control settings, set each category on purpose, and write the decision into the runbook. One more thing to know: no major engine has committed to reading llms.txt or Cloudflare’s Content Signals line in robots.txt. Neither hurts; neither is a strategy.

Blog and content program

The blog is the part of the site owners feel guilty about. Either it has not been touched since the launch post, or it fills with short items nobody reads because “Google likes fresh content.” Neither helps. One useful article a month, kept current, beats four forgettable ones a week.

The articles on this site come from questions I kept getting asked; that is the whole editorial calendar.

An AI content policy for the blog, in four lines

With AI drafting available inside WordPress 7.0 and in every writing tool, the question is no longer whether it will be used but what the rules are. Write them down before the first draft, not after the first complaint.

1. A named person reviews and signs every post. The byline is a real human who stands behind the facts.
2. Every claim, number and quote is checked against a source the reviewer opened. AI drafts invent both.
3. The experience in the post is yours. Use AI for structure, summaries and first drafts; the examples, opinions and lessons come from work you did.
4. Disclose when it matters. If a page is substantially machine-written and readers would care, say so. Google’s own position is that quality matters more than method, which cuts both ways.

Images and media, managed instead of accumulated

• Files named before upload in plain words: blue-metal-roof-tampa.jpg, not IMG_4821.jpg. Every upload
• Alt text written for every meaningful image, describing what is shown, not stuffing keywords. Every upload
• Resized and compressed before upload, WebP or AVIF, no wider than the largest space it will fill. Every upload
• Licenses saved for stock images and fonts, with the invoice. Every purchase
• Unused media deleted and the library searchable by name. Annual
• Attachment pages set to redirect to the parent, so Google does not index a page that is only an image. Set up once

Forms, calls and lead plumbing

This is the chapter that pays for the rest. A form that submits but never arrives looks identical to a form that works, from the outside. I have found contact forms silently failing for months on sites with healthy traffic, because the notification email was going to spam, or an SMTP password changed, or a plugin update reset the recipient.

• Submit every form yourself and confirm the email arrives in the right inbox and the entry appears in the dashboard. Weekly
• Email sent through an SMTP or transactional service, not the server’s default mail, so it does not land in spam. Set up once
• Form entries stored in WordPress or a CRM as a backup to email. Set up once
• Spam protection that does not punish humans: a honeypot or invisible check before a CAPTCHA. Quarterly review
• Calls counted like forms. For most local businesses calls are most of the leads, so use a call tracking number that swaps in for website visitors, records the source, and logs missed calls. Click-to-call events are the minimum, not the goal. Set up once, reviewed monthly
• Thank-you page or confirmation state that fires the conversion event in analytics. Quarterly
• Response time measured. A lead answered in five minutes is worth several answered tomorrow. Monthly

Analytics and reporting

Most WordPress sites have analytics installed and no measurement. GA4 is collecting sessions while nobody has defined what a lead is, so the report is forty charts and no answer. The owner wants one question answered each month: did the website bring in business, and what should we fix next.

I keep reports to four numbers: visitors who could buy, leads, lead rate, and leads by source. Everything else is a diagnostic I look at so the owner does not have to. The strategy behind that fits a one-person business and a national brand equally.

• Key events firing, tested after every update. Monthly
• Internal and agency traffic filtered out. Set up once
• “Visitors who could buy” defined as a saved segment: sessions from the countries or regions you serve, excluding known bots, internal traffic and your own staging domains, and for a local business excluding visits from outside the service area. Use the same segment every month. Set up once
• Server-side tagging considered once ad blockers and consent start hiding a meaningful share of visits; it keeps the key events countable. Annual
• Search Console linked to analytics. Set up once
• Consent mode configured if you serve the EU or UK. Annual
• Data retention set to the longest option. Set up once
• One report, one page, one sentence on top. Monthly

Three GA4 settings that quietly ruin a report

• Data retention left at the two-month default. Change it to 14 months or year-over-year comparisons in explorations stop working. Set up once
• Thresholding hiding small numbers. With Google signals on, GA4 withholds rows it considers too small, which on a local site is most of them. Switch the reporting identity to device-based if your reports show gaps. Set up once
• Conversions that are not conversions. Since the 2024 rename, a key event only counts as a conversion for ads if you mark it. Check that the form, call and purchase events are the only ones marked, and that a page view is not. Quarterly

What GA4 added in 2026, and how to use it

• AI Assistant channel (May): visits from chatbots now get their own medium, “ai-assistant.” Add it as a row on the monthly report next to organic and maps. Monthly
• Source Groups (June): consolidated source names, including built-in grouping for ChatGPT and Perplexity, so the sources table stops splitting one channel into ten rows. Set up once
• Google Business Profile metrics (June): seven local-business numbers now appear inside GA4 when the profile is linked. Link it, and the map calls stop living in a separate tab. Set up once
• Hostname allowlist filters (September): only your own domains may send events, which ends the ghost traffic from staging copies and spam referrers. Set up once
• Dashboards (September): one drag-and-drop page of KPIs. Build the four-number report there and share the link instead of a PDF. Set up once
• Consent mode configured through the tag manager if you serve the EU or UK, so analytics and ads tags respect the cookie banner and modeled data fills the gap. Annual

Dates and details are from the Google Analytics release notes.

The monthly report, on one page

This is the format I send owners, with sample numbers. It fits on a phone screen and takes twenty minutes to produce once the key events exist.

Conversion improvement program

Conversion rate optimization sounds like a project. It is a habit. Every quarter: audit the path from landing page to lead, write down the three biggest leaks, form a hypothesis for each, change one thing, measure for a month, keep what worked.

Chapter 9 sets the strategy and the prioritization rule; this is the routine that runs it. Small sites cannot run statistically clean A/B tests. They can run before-and-after with a clear baseline, which is most of the value.

1. Pick the page with the most traffic and the fewest leads. That ratio is where the money is hiding.
2. Watch five session recordings of visitors on that page. Look for rage clicks (tapping something that does not respond), dead clicks on text that looks like a link, scrolling past the call to action, and the one form field where people give up and leave.
3. Write one hypothesis. “If the phone number is in the header on mobile, click-to-call will rise.”
4. Change one thing. Record the date in the change log, then leave it alone for a full four weeks.
5. Compare against the baseline. Keep it, revert it, or try the next idea. Write the result down either way.

I keep the results in the same change log as the updates, one line per experiment, kept or reverted. Reading a year of those lines tells you more about a site than any dashboard.

Legal, privacy and accessibility

Start with the customer, not the statute. An inaccessible site turns away the visitor who uses a screen reader, the one who cannot use a mouse, and the one reading on a phone in bright sun, and none of them tell you. The law is the backstop.

Three sets of rules touch almost every WordPress site: privacy law, consumer law and accessibility, and all three change by jurisdiction. I am not a lawyer; this is the checklist that gets you ready for the conversation with one.

• Privacy policy present, current, and true. It names the analytics, forms, email and advertising tools you really use. Annual
• Cookie consent where you serve visitors in the EU, UK or states that require it, with analytics blocked until consent. Annual
• Terms of service and refund policy if you sell or book anything. Annual
• Accessibility against WCAG 2.2 AA: alt text on meaningful images, visible focus states, keyboard navigation, color contrast, form labels, captions on video. Quarterly scan, annual review
• PDFs accessible or replaced with pages. Menus, price lists and application forms as scanned PDFs are the most common complaint against small businesses. Quarterly
• Accessibility statement page saying what standard you aim for and how to report a problem. Annual
• Image and font licenses on file. Stock images and web fonts are a common source of demand letters. Annual
• Copyright year in the footer updated automatically, not by hand. Set once

Where the law stands in late 2026

On April 20, 2026, the Department of Justice pushed the ADA Title II web deadlines back a year in an interim final rule: governments serving 50,000 or more people now have until April 26, 2027, smaller ones and special districts until April 26, 2028. Private businesses still have no federal web rule, and the demand letters and lawsuits have not waited for one.

In Europe, the Accessibility Act has applied since June 2025 to many businesses that sell covered products and services into the EU, with thresholds and exemptions that depend on size and sector. The US rules reference WCAG 2.1 AA; building to 2.2 AA satisfies both.

The thirty-minute accessibility check

1. Run an automated scan on the homepage, a service page and the contact page. It catches about a third of real problems, mostly contrast, missing labels and missing alt text.
2. Put the mouse away and tab through the contact page. Can you see where you are? Can you reach and submit the form? Can you open the menu and close it again without a mouse?
3. Turn on the screen reader built into your phone and listen to the homepage. Do the images say something useful? Do the buttons say what they do, or do they just say “click here”?
4. Zoom the browser to 200 percent. Nothing should overlap, disappear or require sideways scrolling.
5. Log what you found with the page and the fix, and give it a date. Then fix the contact form first.

Brand and content governance

Sites drift. Three people add pages over two years, each with their own idea of the button color, and one day the site has four shades of blue, two logos and a staff page listing someone who left. I find the departed employee on the team page on roughly every other site I audit. Governance is a one-page document and a quarterly walk-through.

If the site runs in more than one language or region, every rule in this chapter applies per language, and three more join it: each language gets its own URL structure, hreflang tags tell Google which version is for whom, and translations get the same owner and review date as the original. Machine-translated pages left unreviewed are the most common stale content I find.

• Every page has an owner and a review date. Annual
• Team page, prices and hours current. Quarterly
• One logo, one color set, one button style. Quarterly
• Draft and orphan pages deleted or marked noindex. Quarterly
• Media library pruned of unused uploads. Annual
• Publishing roles set so only editors publish. Set once

WooCommerce, and other sites where people log in or pay

A store doubles the stakes of every chapter above. Downtime is lost orders, not lost impressions. A broken checkout after a plugin update can run for days unnoticed if nobody buys something themselves. I am building a store on WooCommerce now, and the extra routine below is the one I run on it.

• Place a real test order through the live checkout, then refund it. Confirm the emails, the inventory change and the payment record. Weekly, and after every update
• Payment gateway, shipping and tax plugins updated together on staging first. They break each other. After any WooCommerce major release, place a test order and confirm the tax rate and the gateway record before trusting it. Weekly
• High-performance order storage (HPOS) enabled and every extension confirmed compatible with it; older extensions that still write to the posts table are the ones that break on update. Annual
• Abandoned cart recovery running and sending. Monthly
• Product pages with real photos, sizes, shipping times and a reviews block, and Product structured data validated. Quarterly
• Database cleaned of old sessions, transients and completed cart data so the admin stays fast. Monthly
• Backups hourly or on every order, not daily. Yesterday’s backup is missing today’s orders. Set up once
• Product feed to Google Merchant Center kept current, with prices and stock matching the site, so free product listings and Shopping ads do not get disapproved. Monthly
• PCI responsibilities understood: hosted payment fields keep card data off your server. Annual
• Holiday readiness in October: stock, shipping cut-offs, server capacity, promotional pages. Annual

Membership, courses, booking and directory sites

Any site where people log in, pay on a schedule or depend on a widget to transact inherits the store rules above, plus a few of its own.

• Membership and subscription sites: test the sign-up, the renewal charge and the cancellation path monthly; failed renewals are silent churn. Confirm expired members lose access and active ones keep it after every update. Monthly
• Course and LMS sites: test enrollment, lesson progress saving and certificate delivery after updates; back up more often during course launches. Monthly, and after updates
• Booking sites: make a real booking on a phone, confirm the calendar sync, the confirmation email and the reminder. A booking widget that loads slowly is a form that nobody fills in. Weekly
• Directories and listing sites: expire or verify listings on a schedule, keep the submission form spam-proof, and noindex empty category pages. Monthly

Integrations and third-party tools

The modern WordPress site is a hub. Forms push to a CRM, the newsletter tool pulls subscribers, a booking widget embeds from somewhere else, payments go through a gateway, and analytics tags fire from a tag manager. Each connection has a key, a key has an owner, and keys expire. When one dies, the site keeps smiling while the data stops flowing.

The worst one I have found was a CRM sync that had been dead for a full quarter. The form said thank you the whole time, and nobody on the sales side knew a lead had ever existed.

• Integration inventory with owner, key location and renewal date. Annual
• Each connection tested end to end. Monthly
• Tag manager container reviewed for dead or duplicate tags. Quarterly
• Embedded widgets checked for speed and mobile fit. Quarterly
• API keys stored outside the page content and out of the theme. Set once
• Subscriptions cancelled for tools nobody uses. Annual

Competitor analysis cadence

Competitor research goes wrong in two directions: never done, or done obsessively until the site becomes a copy of whoever ranks first. I have watched a site chase a competitor’s layout for a year and end up with the same homepage and none of the reviews. Once a quarter is enough, and the goal is to notice changes, not to match them.

• Offer and proof: what do they promise, and what evidence sits right next to the promise? Quarterly
• Speed and mobile: are they faster than you on a phone? Quarterly
• Reviews: count, recency and how they respond. Quarterly
• Content: which questions have they answered that you have not? Quarterly
• AI citations: who do the assistants name when asked for a recommendation in your category and town? Quarterly

People, documentation and endings

Every chapter so far assumes someone owns it. Chapter 25 is about naming that someone, giving them the keys, and writing down enough that anyone else could take over. A site managed by “whoever has time” is managed by nobody, and the symptoms show up in every other chapter about six months later.

When time is short, cut features before you cut the routine. A site with fewer plugins and a weekly check will outperform a feature-rich site nobody maintains. I have seen it enough times to stop being surprised. The overruns that sink website projects almost always trace back to a decision nobody owned.

Ten questions to ask whoever manages your site

If you are the owner, you do not need to know how to do any of this. You need to know whether it is being done. Ask these, in order, and listen for a date or a number in the answer.

1. When did we last restore a backup, and how long did it take?
2. What was updated last week, and what did you check afterwards?
3. How many plugins do we have, and which three would you remove?
4. Who has admin access right now, and when was the list last reviewed?
5. What is our Core Web Vitals status in Search Console, on mobile?
6. When did you last submit our contact form yourself?
7. How many leads did the website produce last month, and from which pages?
8. Which AI assistants mention us, and which competitor do they mention instead?
9. Where is the runbook, and could someone else take over from it tomorrow?
10. What would you fix first if you had a free day, and why has it not been done already?

A good manager answers nine of these without looking anything up. A good owner asks them twice a year.

Offboarding an agency or developer

Relationships end, and the week they end is when access goes missing. Run this list before the final invoice is paid, whichever side of it you are on. If you are the one receiving a site, the same questions apply as when a client hands over a site they built with AI: what is in it, who owns it, and what breaks on the first update.

• Domain, DNS and hosting in the business’s own accounts, with the business as the billing contact. Before final payment
• Admin access transferred to the owner, and the departing party’s accounts removed from WordPress, the host, analytics, Search Console, the tag manager and every integration. Day of handover
• Plugin and theme licenses in the business’s name, or a written list of which are the agency’s and will stop renewing. Before final payment
• A full backup and a copy of the runbook handed over and tested by the receiving side. Day of handover
• All passwords rotated after the handover, including API keys the departing party could have seen. Week after
• Custom code documented: what was changed in the theme, where, and why. Before final payment

When a theme, plugin or the whole site reaches end of life

Software ages out. A theme whose developer stopped updating it, a page builder that changed its model, a plugin with no replacement for a feature you rely on. The signs are the same: updates stop, errors rise after each WordPress release, and fixes get more expensive each time.

Plan the replacement while the site still works, in a quiet quarter, rather than during the outage that forces it.

Questions people ask about managing a WordPress website

How often should a WordPress website be updated?

Weekly for plugins and themes, after a backup, with security patches applied the day they are released. WordPress core minor releases can update automatically. Major versions of core, the theme, a page builder or WooCommerce should go to a staging copy first and be held about a week unless they fix a security issue.

What does WordPress website maintenance include?

Security and backups with a tested restore, a staging site and a weekly update routine with a check afterwards, speed, uptime monitoring, form and integration testing, SEO, local and AI search upkeep, content refreshes, analytics reporting, legal and accessibility compliance, and documentation of access and changes. Each is a chapter here, with a cadence.

How much time does managing a WordPress site take?

For a brochure or lead-generation site under a hundred pages: about five minutes a day, thirty minutes a week, two hours a month, half a day a quarter and one day a year. A store, membership site or multi-location brand roughly doubles the weekly and monthly time.

Should I update to WordPress 7.0?

Yes, on staging first, after updating the theme and plugins and confirming PHP is on a supported version. The AI features are opt-in and do nothing until an admin adds a provider key, so the update itself does not turn on AI. Decide who may enable it and who owns the key before anyone does.

Should I block AI crawlers on my WordPress site?

Decide on purpose rather than by default. Blocking every AI crawler protects content but removes the site from AI answers. Most businesses that want customers allow the search-oriented crawlers and choose individually on training-only agents. Review robots.txt twice a year because the agent names change.

What is the single most important WordPress maintenance task?

A tested backup. Every other failure in this guide, from a hack to a bad update to a hosting outage, is recoverable in an hour if a recent backup exists off the server and someone has restored one before. Without one, every failure becomes a rebuild.

Do I need a maintenance plan or can I manage the site myself?

An owner can run the daily and weekly lists with an hour of training. The monthly and quarterly work benefits from someone who reads Search Console, analytics and error logs regularly. Whichever you choose, one named person should own the site, and the runbook should let anyone else take over.