What WordPress Maintenance Should Cover

WordPress maintenance is sold in a very wide range. At one end, somebody logs in monthly and presses update. At the other, nobody looks at all until the site goes down. Both get called maintenance and both get invoiced.

If the last few pieces here have been about what goes wrong, this is the calmer one about staying out of trouble. It is also the list I would want if I were the one buying.

Updates, done with some judgement

Core, plugins and themes all need updating, and the two instincts people have about this are both wrong.

"Update everything the moment it appears" breaks sites, because plugin authors ship regressions like everyone else. "Never update, it's working" leaves you carrying every flaw disclosed since the day you stopped.

What works is a staging copy, which is a private duplicate of your site that visitors never see. Updates go there first, someone clicks round the pages that matter, then the same updates go to the live site. For core security releases, faster than that, because those are the ones being actively exploited within hours.

Automatic core updates should be on. If they are off because an update broke something once, the answer is a staging site, not a permanently open window.

Have you ever restored one?

Taking backups is the easy half. The half that matters is proving one restores.

What to ask for: how often they run, where they are stored (somewhere that is not the same server), how far back they go, and when one was last successfully restored. If no one can answer the last one, you do not have backups, you have files.

Knowing what you are running

An inventory. What is installed, what each thing is for, who maintains it, and when it was last updated. It is dull and it is the single most useful document about your website.

It turns "are we affected by this?" from an afternoon of poking about into a two-minute answer, which is exactly the position the sites we inherit are never in. Most sites do not have one.

The quiet essentials

Uptime monitoring, so you find out your site is down before a customer tells you. Renewal of the certificate that puts the padlock in the address bar, which is automatic right up until the once it is not. PHP version kept in support. Database and image housekeeping, which affects speed more than safety.

What you can skip

Some things get sold heavily and earn less than they cost.

Monthly reports full of numbers nobody acts on. If your maintenance report has never once caused a decision, it is a receipt, not a service.

Security plugins stacked three deep. More is not better here, and each one is itself code running with high privilege on your site. There is a whole article in that, and it is coming.

Speed optimisation as a recurring line item. Performance work is mostly a project, not a subscription. Once it is done, it stays done unless somebody adds something heavy.

Aggressive malware scanning on a site with no way in. It is not useless, but it is treatment where prevention was cheaper.

Doing it yourself

Perfectly reasonable for a small site.

If you can keep an inventory, apply updates on a staging copy, test a restore twice a year, and act on a security advisory the day it appears rather than the following month, you do not need us for this.

The reason people buy it in is not the tasks. It is having someone whose job it is to notice, on a week when yours is busy.

If you would like a straight answer on whether your current plan covers this list, forward it over. Get in touch and we will tell you what is missing, even if the answer is nothing.