WordPress maintenance is a fixed scope of work written into a contract: updates, backups, monitoring, security and a response to failures within a set time. I am writing this for a site owner who is comparing maintenance plan offers. Or wondering whether to handle it on their own. There is a checklist at the end. Hold it up against every proposal and you will see what is really included in the price and what only sounds good.
Table of contents
What does WordPress maintenance cover that hosting does not?
Hosting keeps the server running. Maintenance is about the application itself, meaning the WordPress core, plugins, theme, content and access credentials. The server provider looks after power, network and the operating system. But will they check that the contact form works after an update? They will not. A decent maintenance plan covers:
- updates of the core, plugins and theme,
- backups of files and the database,
- monitoring of uptime, the certificate and file integrity,
- security, meaning configuration hardening and tidy user accounts,
- support and minor fixes within an agreed limit.
New features, a template rebuild or content writing are usually a separate job. When comparing offers, it pays to separate maintenance from development. Because a cheap service is often cheap for exactly this reason: every fix is billed as an extra.
WordPress plugin, theme and core updates: what they should look like
An update is a process. Not a click in the dashboard. First you make a backup, then you check the changes on staging (a copy of the site that visitors do not see), and only at the end do you push them to production. After deployment someone clicks through the forms, the cart and the payments. By hand.
For a jump of several versions at once, the official WordPress update guide points to an extended procedure. After a failed update, in turn, it tells you to delete the .maintenance file from the site directory, which blocks the site with a maintenance notice (a classic, anyone who has done updates has seen it). Get plugins and themes from the WordPress.org repository or from well-known vendors. Never from packages of unknown origin. And in the offer, look for the answer to one question: who is responsible when an update breaks something, and how quickly do they get the site working again?
WordPress backups: what to look for in an offer
A backup has to include the files and the database. Both. How often should it be made? That depends on how fast the content changes or the orders come in. A store with daily sales needs a tighter schedule than a brochure site touched once a quarter.
Archives kept on the same server will disappear together with the site when the disk fails or someone breaks in. That is why they are kept somewhere else. And then there is the backup restore test, done every so often. A backup that nobody has ever restored is really just an assumption that a backup exists. Also ask who has access to the backups and whether you will get a current version on request.
Website monitoring: what should be watched all the time
Monitoring is there to catch a problem before a customer reports it. The basics are uptime checks with a downtime alert. Alongside that, keeping an eye on the SSL certificate expiry date and the domain expiry date, because when they lapse they can take the site down overnight. Without warning.
The next layer is scanning for malicious code and unauthorized changes to files. And what if an infection happens anyway? Then you need malicious code removal and closing the hole the attacker came in through. A good service also tracks performance and PHP errors after updates, and then reports on it regularly. In plain language, so that someone outside the industry can understand it.
Security as part of maintenance: hardening, permissions, access
Security in a maintenance plan means specific settings, not a plugin with a shield in its logo. The WordPress hardening guide recommends that files be writable only by the owner account, that file editing from the dashboard be disabled, and that wp-config.php can be moved one directory up, outside the public folder.
On top of that, strong passwords, tidy administrator accounts and a web application firewall (WAF, a traffic filter that runs in front of WordPress). I laid out the whole procedure in the article on how to carry out WordPress hardening step by step. Hiding versions or paths? Fine as an extra. But it will not replace the main protection strategy.
Website maintenance contract: a checklist before you sign
A good contract lists the work and the deadlines in a way that lets you hold the provider to them later. Before you sign, check whether it includes:
- the exact scope of work, with no generalities,
- the response time for a failure and the reporting channel,
- the hour limit for fixes and the rules for billing anything above it,
- the form and frequency of reports,
- a clause stating that access credentials and backups belong to the site owner,
- the terms for ending the cooperation and handing over the site.
Red flags? The phrase “full service” with no list of tasks. And no clause about restoring the site after a failure. If a company wants to hand over not just the website but its whole infrastructure, it can consider an outsourced IT department, which also covers the network, email and workstations.
On your own or with an outside team?
Doing it yourself works for a simple brochure site with a few plugins. Provided that someone in the company has the time and the discipline to do it regularly (and that varies). That person will benefit from WordPress training courses, where they learn safe updates and restoring backups.
Outsourcing makes more sense with a store, integrations with accounting or warehouse systems, forms that collect leads. Or when nobody in the company feels responsible for the site. In my view it is better to look at this more broadly, as part of a plan for WordPress in your company for years. Whatever you choose, WordPress maintenance only makes sense when its scope can be checked point by point.
Frequently asked questions
How often should you update WordPress plugins?
Regularly, on a fixed schedule. Security patches as soon as possible after release. Before every update, a backup and a test on staging. Putting changes off until later usually ends in a painful jump of several versions.
Does hosting with automatic backups replace technical maintenance?
No. A backup is only one piece of the service. Updates, monitoring, hardening and failure response are missing. Oh, and a backup kept with the same provider may not survive a more serious incident.
What should I receive when the contract ends?
A full set of access credentials to the dashboard, server and domain, a current copy of the files and database, and a list of plugins with a description of the changes made. Write these obligations into the contract right at the start. Negotiating them when you part ways is asking for trouble.
