{"id":30108,"date":"2026-09-08T11:35:00","date_gmt":"2026-09-08T10:35:00","guid":{"rendered":"https:\/\/www.web-systems.pl\/wordpress-maintenance-what-it-should-cover\/"},"modified":"2026-10-13T14:55:58","modified_gmt":"2026-10-13T13:55:58","slug":"wordpress-maintenance-what-it-should-cover","status":"publish","type":"post","link":"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/","title":{"rendered":"WordPress website maintenance: what it should cover"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>WordPress maintenance<\/strong> is a fixed scope of work written into a contract: updates, backups, monitoring, security and a response to failures within a set time. I am writing this for a site owner who is comparing maintenance plan offers. Or wondering whether to handle it on their own. There is a checklist at the end. Hold it up against every proposal and you will see what is really included in the price and what only sounds good.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#What_does_WordPress_maintenance_cover_that_hosting_does_not\" >What does WordPress maintenance cover that hosting does not?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#WordPress_plugin_theme_and_core_updates_what_they_should_look_like\" >WordPress plugin, theme and core updates: what they should look like<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#WordPress_backups_what_to_look_for_in_an_offer\" >WordPress backups: what to look for in an offer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#Website_monitoring_what_should_be_watched_all_the_time\" >Website monitoring: what should be watched all the time<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#Security_as_part_of_maintenance_hardening_permissions_access\" >Security as part of maintenance: hardening, permissions, access<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#Website_maintenance_contract_a_checklist_before_you_sign\" >Website maintenance contract: a checklist before you sign<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#On_your_own_or_with_an_outside_team\" >On your own or with an outside team?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#How_often_should_you_update_WordPress_plugins\" >How often should you update WordPress plugins?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#Does_hosting_with_automatic_backups_replace_technical_maintenance\" >Does hosting with automatic backups replace technical maintenance?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-maintenance-what-it-should-cover\/#What_should_I_receive_when_the_contract_ends\" >What should I receive when the contract ends?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_does_WordPress_maintenance_cover_that_hosting_does_not\"><\/span>What does WordPress maintenance cover that hosting does not?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Hosting keeps the server running. Maintenance is about the application itself, meaning the WordPress core, plugins, theme, content and access credentials. The server provider looks after power, network and the operating system. But will they check that the contact form works after an update? They will not. A decent maintenance plan covers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>updates<\/strong> of the core, plugins and theme,<\/li>\n<li><strong>backups<\/strong> of files and the database,<\/li>\n<li><strong>monitoring<\/strong> of uptime, the certificate and file integrity,<\/li>\n<li><strong>security<\/strong>, meaning configuration hardening and tidy user accounts,<\/li>\n<li><strong>support and minor fixes<\/strong> within an agreed limit.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">New features, a template rebuild or content writing are usually a separate job. When comparing offers, it pays to separate maintenance from development. Because a cheap service is often cheap for exactly this reason: every fix is billed as an extra.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WordPress_plugin_theme_and_core_updates_what_they_should_look_like\"><\/span>WordPress plugin, theme and core updates: what they should look like<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An update is a process. Not a click in the dashboard. First you make a backup, then you check the changes on staging (a copy of the site that visitors do not see), and only at the end do you push them to production. After deployment someone clicks through the forms, the cart and the payments. By hand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a jump of several versions at once, the <a href=\"https:\/\/wordpress.org\/documentation\/article\/updating-wordpress\/\" rel=\"nofollow noopener\" target=\"_blank\">official WordPress update guide<\/a> points to an extended procedure. After a failed update, in turn, it tells you to delete the .maintenance file from the site directory, which blocks the site with a maintenance notice (a classic, anyone who has done updates has seen it). Get plugins and themes from the WordPress.org repository or from well-known vendors. Never from packages of unknown origin. And in the offer, look for the answer to one question: who is responsible when an update breaks something, and how quickly do they get the site working again?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WordPress_backups_what_to_look_for_in_an_offer\"><\/span>WordPress backups: what to look for in an offer<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A backup has to include the files and the database. Both. How often should it be made? That depends on how fast the content changes or the orders come in. A store with daily sales needs a tighter schedule than a brochure site touched once a quarter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Archives kept on the same server will disappear together with the site when the disk fails or someone breaks in. That is why they are kept somewhere else. And then there is the <a href=\"https:\/\/www.web-systems.pl\/en\/restoring-website-from-backup-test\/\">backup restore test<\/a>, done every so often. A backup that nobody has ever restored is really just an assumption that a backup exists. Also ask who has access to the backups and whether you will get a current version on request.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Website_monitoring_what_should_be_watched_all_the_time\"><\/span>Website monitoring: what should be watched all the time<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Monitoring is there to catch a problem before a customer reports it. The basics are uptime checks with a downtime alert. Alongside that, keeping an eye on the <a href=\"https:\/\/www.web-systems.pl\/en\/ssl-certificates-valid-200-days-march-2026\/\">SSL certificate expiry date<\/a> and the domain expiry date, because when they lapse they can take the site down overnight. Without warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The next layer is scanning for malicious code and unauthorized changes to files. And what if an infection happens anyway? Then you need <a href=\"https:\/\/www.web-systems.pl\/en\/removing-viruses-from-a-website\/\">malicious code removal<\/a> and closing the hole the attacker came in through. A good service also tracks performance and PHP errors after updates, and then reports on it regularly. In plain language, so that someone outside the industry can understand it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Security_as_part_of_maintenance_hardening_permissions_access\"><\/span>Security as part of maintenance: hardening, permissions, access<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security in a maintenance plan means specific settings, not a plugin with a shield in its logo. The <a href=\"https:\/\/developer.wordpress.org\/advanced-administration\/security\/hardening\/\" rel=\"nofollow noopener\" target=\"_blank\">WordPress hardening guide<\/a> recommends that files be writable only by the owner account, that file editing from the dashboard be disabled, and that wp-config.php can be moved one directory up, outside the public folder.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On top of that, strong passwords, tidy administrator accounts and a web application firewall (WAF, a traffic filter that runs in front of WordPress). I laid out the whole procedure in the article on how to carry out <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-security-hardening-protect-your-site-from-attacks\/\">WordPress hardening step by step<\/a>. Hiding versions or paths? Fine as an extra. But it will not replace the main protection strategy.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Website_maintenance_contract_a_checklist_before_you_sign\"><\/span>Website maintenance contract: a checklist before you sign<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A good contract lists the work and the deadlines in a way that lets you hold the provider to them later. Before you sign, check whether it includes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>the exact scope of work, with no generalities,<\/li>\n<li>the response time for a failure and the reporting channel,<\/li>\n<li>the hour limit for fixes and the rules for billing anything above it,<\/li>\n<li>the form and frequency of reports,<\/li>\n<li>a clause stating that access credentials and backups belong to the site owner,<\/li>\n<li>the terms for ending the cooperation and handing over the site.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Red flags? The phrase &#8220;full service&#8221; with no list of tasks. And no clause about restoring the site after a failure. If a company wants to hand over not just the website but its whole infrastructure, it can consider an <a href=\"https:\/\/www.web-systems.pl\/en\/it-outsourcing\/\">outsourced IT department<\/a>, which also covers the network, email and workstations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"On_your_own_or_with_an_outside_team\"><\/span>On your own or with an outside team?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Doing it yourself works for a simple brochure site with a few plugins. Provided that someone in the company has the time and the discipline to do it regularly (and that varies). That person will benefit from <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-woocommerce-training\/\">WordPress training courses<\/a>, where they learn safe updates and restoring backups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Outsourcing makes more sense with a store, integrations with accounting or warehouse systems, forms that collect leads. Or when nobody in the company feels responsible for the site. In my view it is better to look at this more broadly, as part of a plan for <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-for-business-2026-costs-security\/\">WordPress in your company for years<\/a>. Whatever you choose, WordPress maintenance only makes sense when its scope can be checked point by point.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1790303300652-0\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"How_often_should_you_update_WordPress_plugins\"><\/span>How often should you update WordPress plugins?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Regularly, on a fixed schedule. Security patches as soon as possible after release. Before every update, a backup and a test on staging. Putting changes off until later usually ends in a painful jump of several versions.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790303300652-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Does_hosting_with_automatic_backups_replace_technical_maintenance\"><\/span>Does hosting with automatic backups replace technical maintenance?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. A backup is only one piece of the service. Updates, monitoring, hardening and failure response are missing. Oh, and a backup kept with the same provider may not survive a more serious incident.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790303300652-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"What_should_I_receive_when_the_contract_ends\"><\/span>What should I receive when the contract ends?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A full set of access credentials to the dashboard, server and domain, a current copy of the files and database, and a list of plugins with a description of the changes made. Write these obligations into the contract right at the start. Negotiating them when you part ways is asking for trouble.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>WordPress maintenance is a fixed scope of work written into a contract: updates, backups, monitoring, security and a response to failures within a set time. I am writing this for a site owner who is comparing maintenance plan offers. Or wondering whether to handle it on their own. There is a checklist at the end. [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":30089,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[838],"tags":[998,1081,901,1667,2165,1192],"class_list":["post-30108","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress-en","tag-data-backups","tag-how-to","tag-security","tag-updates","tag-website-maintenance-x","tag-wordpress-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/comments?post=30108"}],"version-history":[{"count":3,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30108\/revisions"}],"predecessor-version":[{"id":30157,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30108\/revisions\/30157"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media\/30089"}],"wp:attachment":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media?parent=30108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/categories?post=30108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/tags?post=30108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}