WordPress maintenance is the routine work that keeps a WordPress site secure, fast and working: updating core, themes and plugins, taking backups and testing that they restore, monitoring security and uptime, and checking that forms, links and checkout still work. A small site needs a few checks each week and a deeper review every month and every quarter.
Most WordPress sites we are asked to rescue did not break because of one big failure. They broke because nobody had logged in for a year. Plugins fell out of date, the backup plugin had silently stopped, and the contact form had been failing for months. Maintenance is what stops that. Here is what it really involves.
What WordPress maintenance covers
A WordPress site is made of 3 software layers you are responsible for: core, your theme and your plugins. Each layer receives updates for features, compatibility and security fixes. The server underneath changes too, especially the PHP version. Maintenance keeps all of it current and confirms the site still does its job after every change.
- Updates: core, plugins, themes and PHP.
- Backups: automatic, stored away from the server, and restore tested.
- Security: access control, malware scanning, firewall and login protection.
- Uptime: monitoring that alerts you when the site goes down.
- Performance: speed checks, database cleanup, caching and image weight.
- Content health: broken links, 404 errors and outdated pages.
- Function tests: forms, emails, checkout, search and logins.
Updates: the part everyone thinks is the whole job
Updates matter because outdated plugins and themes with publicly known vulnerabilities are a common way WordPress sites get compromised. But clicking "update all" on a live site without a plan is also how sites break.
A safer update routine
- Take a fresh backup right before updating.
- Read the changelog for major version updates, especially for WooCommerce, page builders and membership plugins.
- Update on a staging copy first for anything significant.
- Update plugins in small groups, not all at once, so you know which one caused a problem.
- Check the front end, the admin area and key forms after updating.
- Clear caches, then test again as a logged out visitor.
By default WordPress applies minor core releases automatically, and you can switch on automatic updates for individual plugins. Auto updates are sensible for small, well maintained plugins. For plugins that control checkout, bookings or site layout, we prefer controlled updates with testing.
Remove what you do not use
A deactivated plugin still sits on the server, and its code can still contain vulnerabilities. Delete plugins and themes you do not use, keeping one default theme as a fallback. Replace plugins whose developers have abandoned them.
PHP version
WordPress runs on PHP, and old PHP versions stop receiving security fixes. Check your version in the hosting panel or under Tools, then Site Health, in the WordPress admin. Test on staging before switching, because older plugins can break on newer PHP.
Backups: only a tested restore counts
A backup you have never restored is a hope, not a backup. We have seen backup plugins report success for months while writing empty or partial files.
- Back up both the files and the database.
- Store copies away from the server, in cloud storage separate from your hosting account. If the server or the account is compromised, backups kept there may be lost too.
- Match frequency to how often the site changes. A brochure site may be fine with daily backups. A busy store needs more frequent database backups because orders arrive all day.
- Keep several restore points, not just the latest, because a hack or a bad update is often discovered days later.
- Test a full restore on a staging site at least every quarter, and note how long it takes.
Security
- Use strong unique passwords and two factor authentication for every administrator.
- Give each person their own account with the lowest role they need. Remove accounts for former staff and old agencies.
- Limit login attempts or protect the login page with a firewall.
- Run a reputable security plugin or a server level firewall and malware scanner.
- Keep HTTPS working and the SSL certificate renewing automatically.
- Review the admin user list and installed plugins for anything you did not add.
If the site does get hacked, restore from a clean backup taken before the infection, then update everything, change every password and find out how the attacker got in. Cleaning files by hand without closing the entry point usually leads to reinfection.
Uptime monitoring
You should learn your site is down before your customers do. Set up an uptime monitor that checks the homepage and one key page every few minutes and alerts you by email or a messaging app. For stores, monitor the checkout page as well. Many monitoring services have free plans that are enough for a small business.
Performance
Sites get slower over time. Plugins pile up, images are uploaded at full camera size, and the database fills with post revisions, expired transients and spam comments.
- Test key pages with PageSpeed Insights every month and watch the Core Web Vitals report in Google Search Console.
- Resize and compress images before or during upload, and serve modern formats where your setup supports them.
- Clean old revisions, spam and trashed items from the database.
- Confirm caching still works after updates.
- Question every new plugin. Each one adds code that has to load.
Broken links, forms and functional tests
This is the part most maintenance plans skip, and it is often the most costly. A site can be fully updated and secure while its contact form sends every enquiry to an email address nobody reads.
- Submit every form and confirm the email arrives, including the customer's confirmation copy.
- Send site email through an SMTP or transactional email service so WordPress emails do not land in spam.
- Run a test order on a store, including payment and order emails.
- Check Search Console for 404 errors and crawl issues, and fix or redirect broken URLs.
- Scan for broken internal and outbound links.
- Test the site on a real phone, not only in a desktop browser.
A WordPress maintenance schedule
Weekly
- Confirm backups ran and are stored off site
- Apply plugin and theme updates, with a backup first
- Review uptime alerts and security scan results
- Submit the main contact form
- Run a test order if you have a store
Monthly
- Review Search Console for errors, 404s and Core Web Vitals
- Run PageSpeed Insights on the homepage and top pages
- Scan for broken links
- Clean the database and check caching
- Review user accounts and remove unused ones
- Delete unused plugins and themes
Quarterly
- Run a full restore test on staging
- Check the PHP version and hosting health
- Audit plugins for abandoned or duplicate ones
- Review key pages for outdated prices, staff, offers and dates
- Check renewals: domain, SSL, premium plugin licenses and hosting
Do it yourself or hire a care plan?
Doing it yourself is reasonable when the site is simple, uses few plugins, does not take payments, and you will actually follow the schedule. Once the routine is in place, expect a small amount of time each week, and more when something goes wrong.
A care plan makes sense when:
- The site generates leads or sales, so downtime costs real money.
- You run WooCommerce, memberships, bookings or a custom theme.
- Nobody on the team is comfortable with staging sites, restores or a blank white screen.
- You have already had a hack, a broken update or a lost backup.
When comparing plans, ask exactly what is included. Does it test restores? Does it update on staging first? Does it test forms and checkout? Does it cover fixing things that break after an update, or is that billed separately? Cheap plans often mean automatic updates and a backup plugin, nothing more. Our WordPress service covers the testing side as well as the updates.
Common questions
How often should WordPress be updated?
Check for updates at least weekly and apply security updates as soon as practical. Larger updates to core, WooCommerce or page builders are better tested on staging first. Leaving updates for months is riskier than updating regularly with a backup in place.
Can WordPress updates break my site?
Yes, occasionally, usually through a conflict between a plugin, the theme and a new version of core or PHP. That is why you back up first, update in small groups and test key pages afterwards. With a tested backup, a broken update becomes a short restore instead of a disaster.
Is my hosting company's backup enough?
Treat host backups as one layer, not the only one. Check how often they run, how long they are kept, and whether you can restore them yourself. Keep an independent copy outside the hosting account as well, and test that it restores.
What does a WordPress care plan usually include?
Most include updates, backups, uptime monitoring and security scanning. Better plans add staging tests, restore tests, form and checkout testing, performance checks and time for small fixes. Always ask for the exact list and what happens when an update breaks something.
How do I know if my WordPress site has been hacked?
Common signs are unknown admin users, redirects to spam sites, strange pages appearing in Google, security warnings in the browser or in Search Console, and a sudden slowdown or spike in server resource use. If you see any of these, get the site properly cleaned and the entry point closed, not just the visible files deleted.
If your WordPress site has not been looked after for a while, or you want someone to take the routine off your hands, get in touch. We will check where things stand and tell you what needs attention first.
