WordPress Maintenance: What A Good Care Plan Covers

WordPress is free to install, but it is not free to look after. Core, themes and plugins all receive updates, PHP versions reach end of life, databases grow and security threats keep changing. Left alone, even a well-built site slowly becomes slower, less secure and harder to update.

That is why so many agencies and hosts offer WordPress care plans. The trouble is that two plans with similar names can cover very different things. Here is what good WordPress maintenance should include, and the questions to ask before trusting someone with your site.

Updates Done With Care

Updates are the heart of any care plan, and also the part most likely to go wrong. Clicking “update all” is easy. Making sure nothing breaks afterwards is the real work.

A good approach includes:

• Backups before updates, so any change can be rolled back.
• Reading changelogs for major plugin versions, especially WooCommerce, page builders and membership plugins, which can change how the site behaves.
• Staging for risky updates, where large changes are tried on a copy first.
• Checking the site afterwards, including forms, checkout and logged-in areas, not just the home page.
• Dealing with abandoned plugins, meaning those no longer maintained by their authors, by finding replacements before they become a security problem.

Ask a provider how they handle an update that breaks something. The answer tells you a lot about how carefully they work, and it is one of the first things we explain when people ask about our WordPress support.

Backups You Can Actually Restore

Almost every plan mentions backups, but the details matter. A backup stored on the same server as the site disappears if the server fails or is compromised. A backup that has never been restored might not work when you need it.

Things to check:

1. Are backups stored off the server, in a separate location?
2. Do they include both files and the database?
3. How long are they kept? A short retention period may not reach back far enough if a hack went unnoticed for a while.
4. Has anyone ever tested a restore? It is wise to test one at least every few months.
5. Who carries out the restore, and is it included in the plan?

Server-level backup tools such as JetBackup or Restic, or plugins such as UpdraftPlus, can all work well. What matters is that someone is responsible for checking they run and can be restored.

Security Beyond A Plugin

Installing a security plugin is a start, not a strategy. A good care plan looks at security from several angles:

• Strong passwords and two-factor authentication for all admin users.
• Removing unused plugins, themes and old admin accounts.
• Malware scanning, either through a plugin or at the server level.
• Firewall rules that block common attacks, at the server, CDN or plugin level.
• Correct file permissions, typically 644 for files and 755 for directories, with wp-config.php tighter where the server allows it.
• Disabling the built-in file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php, so a stolen admin login cannot be used to edit PHP files from the dashboard.

Also ask what happens if the site is hacked. Some plans include clean-up, while others charge it separately. It is far better to know in advance.

Performance And Housekeeping

Sites slow down gradually as content, plugins and database clutter build up. Maintenance should keep an eye on:

• Database tidying: removing old post revisions, expired transients and spam comments. On WooCommerce sites, old sessions and action scheduler logs can grow very large.
• Caching: making sure page caching works and is not serving stale content to logged-in users.
• Image sizes: large uploaded images are one of the most common causes of slow pages.
• PHP version: moving the site to a supported PHP version before the old one reaches end of life, after testing compatibility.
• Scheduled tasks: WordPress relies on WP-Cron, which only runs when someone visits. On busy or very quiet sites, switching to a real server cron job is more reliable.

Monitoring And Reporting

Uptime monitoring checks the site from outside and raises an alert if it stops responding. Better setups also watch for SSL certificate expiry, domain renewal dates and unexpected content changes. Reporting is useful when it tells you what was done and anything that needs a decision from you, such as a plugin that should be replaced. A long report of green ticks is less valuable than one clear note about something that needs attention.

Questions To Ask Before You Choose

When comparing care plans, these questions help cut through the marketing:

• Who carries out the work, and do they have server access or only the WordPress dashboard?
• Is support for small changes or fixes included, and what counts as out of scope?
• What happens if an update breaks the site?
• Where are backups stored, and how are restores handled?
• Is hack clean-up included?
• Can you leave easily, with your site, backups and logins handed over?

Server access matters more than people expect. Many WordPress problems, such as memory limits, PHP errors, slow database queries and email delivery, can only be fixed at the server level. A provider who can work on both the site and the server can solve a wider range of problems. If your site runs on your own server, our server monitoring page explains how that side can be looked after too.

How Server Defenders Can Help

We look after WordPress sites at both the application and server level, covering updates, security, performance and fixes when things go wrong. See what our WordPress support includes, or contact us to talk about your sites.