Plenty of WordPress maintenance plans boil down to clicking “update all” once a month. That’s better than nothing, but it’s not what keeps a site healthy. A site is a mix of WordPress core, a theme, a dozen or more plugins, a hosting environment, tracking scripts, forms and content that changes every week. Any of those can break something else.
Here’s what we think a real care plan should include, and what to look for when you compare providers.
Updates, tested first
Updates should go to a staging copy of your site, get checked, and only then go live. Clicking update on production is how sites break on a Tuesday morning.
What “checked” means in practice:
- Load the homepage, a few key templates and anything custom (a scheduling widget, a member area, a product page).
- Submit each important form and confirm the notification email arrives.
- If it’s a WooCommerce store, run a test order through checkout.
- Look at the browser console and the PHP error log for new warnings.
- Confirm tracking still fires (more on that below).
A few judgment calls separate a careful plan from a mechanical one. Security releases should go out quickly, usually within a day or two. Major version jumps of big plugins (WooCommerce, page builders, form plugins, membership tools) deserve a read of the changelog and an extra day on staging. And PHP version upgrades at the host level need their own testing, because older plugins and custom code are where they bite.
Most managed WordPress hosts include one-click staging. If yours doesn’t, that alone is a reason to rethink the host.
Backups you’ve actually restored
Daily backups, stored somewhere other than your server. If the server is compromised or the hosting account is closed, backups that live on the same server go with it. We keep host-level snapshots plus a separate offsite copy in cloud storage.
Things to confirm:
- Both files and database. Some setups back up only the database, which won’t bring back uploads or custom code.
- Retention. At least 30 days. Malware and spam injections often sit unnoticed for weeks, so you need a copy from before the problem started.
- Before every update batch. A fresh backup right before changes makes rollback quick.
- Busy stores. If orders come in all day, a nightly backup can lose a day of orders on restore. Ask how that’s handled.
And at least occasionally, do an actual test restore to a staging site, because a backup nobody has tried to restore is just a hope. We’ve seen backup plugins report “success” for months while producing archives too large to restore, or archives missing the uploads folder entirely.
Monitoring
Monitoring is the part that turns a care plan from “we update things” into “we notice things.”
- Uptime, checked every few minutes from outside your server, with alerts going to a person who can act on them.
- SSL and domain expiry. Certificates usually renew automatically, until they don’t. Domain renewals tied to an old employee’s email are a classic outage.
- Security, with malware scanning, file-change alerts and a firewall. Also watch for new admin users you didn’t create.
- Search Console, for security warnings, manual actions and sudden spikes in indexed pages, which can be the first sign of injected spam.
- Accessibility, scanned on a schedule, since content edits create new issues even when no code changes.
- Tracking, so you know if GA4, Google Tag Manager or an ad pixel stops firing after an update. A quick check in GTM Preview mode or GA4 DebugView after each update round catches most of it.
- Forms, tested regularly, because a broken contact form is invisible until someone mentions it. Email deliverability is the usual culprit, so make sure the site sends mail through an authenticated service (SMTP or an email API) rather than the server’s default mail function.
A common failure: a host migration quietly breaks outgoing mail while the form still shows its thank-you message. A weekly test submission catches it.
Performance and housekeeping
Sites slow down gradually, and nobody notices until a page takes six seconds on a phone. A care plan should include some regular cleanup:
- Remove plugins that are deactivated or no longer needed. Inactive plugins can still be a security risk.
- Watch for plugins that have been abandoned by their developers or pulled from the WordPress.org directory, and plan a replacement before it becomes urgent.
- Clean up the database: old revisions, expired transients, spam comments and leftover tables from removed plugins.
- Check Core Web Vitals in Search Console and run PageSpeed Insights on key templates after big changes.
- Keep an eye on image sizes, since one oversized hero image uploaded by an editor can undo a lot of tuning.
None of this is glamorous, but it’s the difference between a site that ages well and one that needs a rebuild every three years.
Changes and reporting
Changes on request
The most valuable part of a care plan is a developer who knows your site. New pages, small features, layout fixes and plugin questions should be a quick message, not a new project with a proposal and a kickoff call.
Look for a plan that includes a set number of hours per month for this kind of work, with a clear rate for anything beyond. Ask whether unused hours roll over. And ask what counts as “small”: a new landing page built from existing blocks is a quick job, while a new scheduling integration is a project, and a good provider will tell you which is which before starting.
A short monthly report
What was updated, anything that went wrong and how it was fixed, and anything that needs your decision. One page is enough. The useful items are the decisions: a plugin license that’s about to expire, a PHP upgrade the host is forcing, a form that’s attracting spam, a page with accessibility errors after a content change.
If the report is ten pages of automated charts and nothing you need to act on, it’s there to look busy.
What to ask a provider
- Do you test updates on staging before they go live?
- When did you last restore a backup, and how long did it take?
- Where are backups stored, and for how long?
- What do you monitor beyond uptime?
- Who do I contact when something breaks, and how fast do they respond?
- How many hours of changes are included each month?
- Will you work on a site you didn’t build?
If the answers are vague, the plan probably is too. Very cheap plans usually mean automated updates and nothing else.
When it makes sense to bring us in
If your current setup is “someone clicks update when they remember,” or you’ve inherited a site and aren’t sure what’s on it, that’s a good time to talk. We’ll start with an audit of plugins, hosting, backups and tracking, tell you what we’d change, and then look after it month to month. We regularly take on sites we didn’t build. See our maintenance and support page, or get in touch.