Short answer: check weekly, apply security patches immediately, and never update anything without a backup you have actually tested.
The longer answer is that the schedule is the least interesting part of the question. Most sites that break during an update would have broken on any schedule. What separates a routine update from a lost afternoon is the ten minutes either side of clicking the button.
Why weekly, and not daily or monthly
Plugin authors ship patches constantly. WordPress core itself pushes minor security releases automatically, but plugins are on you.
Daily is too noisy. You will spend more time reading changelogs than the risk justifies, and you will start skimming — which is how a breaking change slips through.
Monthly is too slow. Once a vulnerability is disclosed publicly, automated scanners start probing for it within hours. A month of exposure on a known flaw is a long time to leave the door open.
Weekly sits in the useful middle. It is frequent enough that you are never far behind a disclosure, and infrequent enough that you actually read what changed.
The exception: security releases do not wait for your schedule. If a plugin you use publishes a patch for an actively exploited vulnerability, apply it that day.
The ten minutes that actually matter
Here is the sequence worth following every single time.
Before
- Take a backup and confirm it restored somewhere. An untested backup is a hope, not a plan. If you have never restored one, you do not have backups — you have files.
- Read the changelog. Not all of it. Look for the words breaking, removed, deprecated, requires, and any mention of a minimum PHP or WordPress version.
- Check what depends on what. Page builders, form plugins and anything touching WooCommerce are the usual suspects for a cascade.
After
- Load the homepage, one interior page, and one form. Most breakage is visible in under a minute if you know where to look.
- Submit the contact form. A silently broken form is the most expensive kind of breakage, because nothing looks wrong — the enquiries simply stop arriving. This is the check people skip.
- Open the browser console. A JavaScript error that only appears on one template is easy to miss visually and will quietly break your analytics or checkout.
Staging, and when it is worth the trouble
If your site takes payments, has more than a handful of plugins, or generates meaningful revenue, update on a staging copy first. Most decent hosts give you one-click staging.
If it is a five-page brochure site with four plugins, staging is often more process than the risk warrants. Back up, update, check the three things above, move on.
Be honest about which one you have. The failure mode is treating a revenue- critical store like a brochure site.
What we actually do
Every site we maintain gets:
- A backup taken before any update touches it, restorable to the minute
- Updates applied on staging first for anything with a checkout
- The post-update checks above, including the contact form submit
- A rollback if anything looks wrong, rather than debugging on a live site
That last point is the one worth stealing even if you never hire anyone. When something breaks after an update, roll back first and investigate second. The instinct to fix it live, with visitors watching, is what turns a ten-minute problem into an afternoon.
The one thing to take away
The schedule is a detail. The backup you have tested, and the form submit you check afterwards, are what actually keep a site up.