How the risk level is worked out
Each answer adds risk points, weighted by how much damage the gap can cause:
- Critical (×3): no tested backups, plugins or core months out of date, an unsupported PHP version, no security measures on login.
- Important (×2): abandoned or nulled plugins, too many plugins, no uptime monitoring, admin accounts nobody uses, no staging site.
- Housekeeping (×1): no one responsible, SSL renewals, form testing.
The total is shown as a percentage of the maximum: under 25% is low risk, 25–50% medium, over 50% high. Any single critical gap at its worst level makes the overall rating at least medium. These weights reflect what we most often find when taking over neglected WordPress sites.
A sensible monthly routine
- Check a recent backup exists, stored off the server, and test a restore occasionally.
- Update plugins, theme and WordPress core (on a staging copy first for major updates).
- Remove plugins and users you no longer need.
- Test forms, checkout and key pages after updates.
- Review uptime, security alerts and Core Web Vitals.
Read what WordPress maintenance involves and what happens without it. If speed is the concern, check your scores with the Core Web Vitals Checker.