Someone’s offering to look after your WordPress site, and you want to know what you’d actually be paying for. WordPress maintenance tasks come down to four jobs done on a schedule: updates, backups, security monitoring and a report. Each one prevents a specific way a WordPress site breaks. Here’s what each job is, what it protects you from, and what to ask anyone who offers to do it for you.
What does “tested updates” mean?
WordPress itself, your theme and every plugin release updates. Many fix security holes, some add features, a few change how things work. Ignoring updates leaves known holes open. Applying them blindly is how sites break: a plugin update changes something another plugin relied on, and a page turns white.
A careful update runs on a copy of the site first. If the copy still works, the same updates go to the live site. If something breaks, it gets fixed on the copy, and your visitors never see it.
What this prevents: hacks through outdated plugins, and the broken page after an untested update.
Where should my backups be kept?
Away from your server. A backup stored on the same server as the site disappears with the server. Good backups run every day, are kept somewhere else, and get tested now and then by actually restoring one.
What this prevents: losing the site, or weeks of orders and posts, after a bad update, a hack or a hosting failure. With a recent off-site backup, any of those costs a few hours instead.
How will I know my site is down before my customers do?
Monitoring. It watches for the site going offline, for files that change when nobody changed them, and for repeated failed logins. When one of those happens, someone is told within minutes rather than you finding out from a customer.
What this prevents: a site that has been down or hacked for days before anyone notices.
What should a monthly report tell me?
Every month you should get a short report in plain language: what was updated, what was found, what was fixed, and anything that needs a decision from you. If you can’t tell from the report what happened to your site, the report isn’t doing its job.
What won’t maintenance fix?
Your hosting is a separate job from maintenance: see WordPress hosting and maintenance for what each covers.
Maintenance keeps a healthy site healthy. It doesn’t repair a site that’s already slow or unstable. On TubeOnAI, files left behind by old cache plugins kept clashing with the host’s own speed plugin, and the site kept going down. That needed a one-off fix at the cause first: the TubeOnAI case study shows what that involved. Regular checks after that are what stop it coming back.
Are small changes and content updates included?
They’re the most useful part of a good plan. It’s often not the updates, it’s having someone who already knows your site make small changes quickly: a new staff page, an updated price list, a banner for a holiday closing, a form field. Plans differ a lot here. Some include none, some say “unlimited small tasks”, and some give a clear number of hours. A stated number of hours is the honest version. “Unlimited” usually has limits you discover later.
Does maintenance include speed checks?
It should. Sites get slower slowly: a new plugin here, a large image there, a chat widget someone added. A monthly mobile speed check on the home page and the main landing pages catches this drift before it shows up in rankings or sales. It also gives you a record: if a change made the site slower, you know when it happened.
What is plugin housekeeping?
Over a year most sites collect plugins nobody remembers installing. Part of maintenance is reviewing the list: removing plugins that are no longer used, replacing abandoned ones that no longer get security updates, and making sure premium licences are still active. Fewer plugins means fewer updates, fewer conflicts and fewer ways in for attackers.
What does a monthly maintenance report look like?
It doesn’t need to be long. It should answer what was done, what was found and what needs a decision. For example:
- Updated WordPress core and 9 plugins on staging, tested the contact form and checkout, then updated the live site
- Backups ran daily and were stored off-site; a test restore was successful
- Uptime: no outages recorded this month
- Security: one plugin had a reported vulnerability; it was updated the same day
- Speed: home page on mobile unchanged since last month
- Recommendation: the slider plugin hasn’t been updated by its developer in over a year; replace it next month
That last line is the point: a report that flags decisions before they become emergencies. For a do-it-yourself version of this list, use the WordPress maintenance checklist. For pricing, see WordPress maintenance cost.
What can no maintenance plan do?
A maintenance plan keeps a site healthy. It doesn’t turn a poorly built site into a good one. If the theme is heavy, the hosting is underpowered, or the site was built with dozens of plugins doing the work of a few, maintenance will keep it running but won’t make it fast or easy to change. In that case the better spend is usually a one-off clean-up or a rebuild of the worst templates, followed by a plan to keep it that way.
Maintenance also can’t fix content. If the site doesn’t explain what you do, who it’s for and how to get in touch, updates and backups won’t bring more enquiries.
How long do these tasks take each month?
For a typical small business site, the routine work of checking, backing up, testing and applying updates, and writing a short report takes one to three hours a month. Stores and sites with many plugins take longer because every update needs more testing. Changes and fixes come on top. That’s why plans with a stated number of hours are easier to compare than plans that promise everything.
What should I ask anyone who offers to maintain my site?
Ask these before you hand over a login, because the answers tell you what you’re really buying:
- Are updates tested on a copy of the site before they go live?
- Where are backups stored, how often, and when was one last restored?
- How quickly do you reply when the site is down?
- Do I keep every login, and do I own everything if we stop working together?
- What’s included in the monthly fee, and what’s charged on top?
If the answers are vague, the work probably is too. My own answers are on the WordPress maintenance page.
Common questions
What does WordPress maintenance include?
Tested updates to WordPress core, the theme and plugins; daily backups stored away from the server; uptime and security monitoring; a monthly report; and in good plans, a set number of hours for small changes and a regular speed check.
How often should WordPress be updated?
Check for updates at least weekly and apply security updates as soon as they are released. Other updates can be tested and applied in a regular monthly or fortnightly cycle.
Does WordPress maintenance include hacked site cleanup?
It depends on the plan. Many plans monitor for malware but charge separately to remove it. Ask before you sign up, and check whether recovery from a backup is included.
Does maintenance include content changes?
Some plans do and some do not. Look for a stated number of hours for small changes each month rather than promises of unlimited tasks.
What is the difference between hosting and maintenance?
Hosting keeps the server running. Maintenance looks after the WordPress site on it: updates, backups you control, monitoring, testing and fixes. Some hosts include basic automatic updates, but rarely testing or a person who knows your site.
Written by Sakib Islam, a WordPress developer who builds and looks after sites for businesses and agencies. About my work
