Monthly checklist for shared hosting site administrators

Fifteen minutes a month, five checks, zero surprises mid-way through the next month. This checklist is designed for those managing multiple WordPress or Joomla sites on shared hosting without centralised monitoring: a small agency, a freelancer, a reseller with a handful of clients. Run it on the last day of each month, or the first business day of the next.

1. Remaining disk space

Don't just look at the percentage in your control panel: understand the difference between soft quota and hard quota. As IONOS explains in their quota guide, the soft quota is a warning threshold: once exceeded, the system sends a notification and the account is flagged as "over quota", but space remains usable up to the hard quota, for a grace period set by the administrator. In practice: if the panel shows red but your site still works, you have days, not hours, to act — but not weeks. From the command line, on an account with SSH access, du -sh public_html/* quickly shows where space is being consumed (typically cache, logs, uploads).

2. SSL certificates expiring within the next 30 days

This October 2026 checklist has a new variable compared to a year ago. According to Serverplan, Let's Encrypt announced it will stop sending renewal reminder emails from 4 June 2025. Anyone relying on those emails now needs to check manually: in cPanel, go to SSL/TLS Status and verify the expiry date for each domain. If automatic renewal hasn't triggered, simply select each subdomain and click Run AutoSSL. From the command line: openssl s_client -connect domain.co.uk:443 -servername domain.co.uk 2>/dev/null | openssl x509 -noout -dates.

3. Plugins with pending updates

Don't update everything at once without checking: on WordPress, wp plugin list --update=available (via WP-CLI, if available on your hosting) lists what's pending. Prioritise plugins with changelogs mentioning security fixes, not just new features.

4. Last successful backup

Checking that the backup job is scheduled isn't enough: open the backup completion list and verify the date of the last successful backup, not the last attempt. A job failing silently for three months is the most common reason why an emergency restore fails.

5. Unread provider emails

Maintenance notices, threshold alerts, abuse reports: they only help if someone reads them. A monthly pass through your hosting account's administrative inbox closes the loop.

Five items, a spreadsheet or a task manager checklist: the goal isn't perfection, but not starting from scratch every time something goes wrong.