WordPress maintenance: what it includes and why it is not a wasted cost

A WordPress site is bought once, but it is never finished being maintained. It works a bit like a car: it can run fine for a year without you doing anything, then one day it will not start, and you find that the cost of the maintenance you skipped is much higher than what you would have spent.

In this guide I explain what WordPress maintenance really means, what a well-done service should include and how to tell whether you need it.

What happens to a site left to itself

WordPress is not a "closed" program: it is made of three parts that change constantly, namely the core system, the theme and the plugins. Each one receives updates, and many concern security.

If the site is not updated, something like this almost always happens over time:

• security problems: known flaws stay open, and whoever hunts for vulnerable sites exploits them automatically;
• incompatibilities: an old plugin version stops working with a new version of PHP or WordPress;
• slowdowns: dated code and a database full of useless data;
• features that stop working: contact forms that do not send, payments that fail, and nobody notices for days;
• "all at once" updates: after two years of postponing, updating everything in one go is far riskier than doing it a bit at a time.

What well-done maintenance includes

There is no single list, but serious maintenance includes at least these activities.

Updates tested first

Core, theme and plugins are updated on a copy of the site and checked. Only if everything works is it published live. This is the main difference between "pressing the update button" and doing maintenance.

Backup before every intervention

Before touching the site a complete copy is saved, with files and database, kept somewhere other than the site's server. A backup that sits on the same server that breaks is not a real backup.

Security checks

Users and permissions are verified, unused plugins and themes are removed, suspicious files are checked for and suitable protection is set up for dashboard access. Total security does not exist, but the risk surface shrinks a lot.

Monitoring

An automatic check verifies that the site is reachable and that important features, such as the contact form or the cart, respond. If something is wrong, you get a warning before a customer notices.

Attention to speed and tidiness

Over time the database fills with useless data and the site slows down. Routine maintenance includes a periodic check on performance and cleaning. If you are interested in the topic, also read Slow WordPress site: the 7 most common causes.

A periodic report

You should know what was done: a short report with the updates carried out, the problems found and the ones solved. If maintenance leaves no trace, it is hard to tell whether it is working.

What maintenance is not

To avoid misunderstandings, it helps to be clear about what is usually not included:

• content changes: writing or updating text, uploading photos, creating new pages;
• restyling or new features: changing graphics, adding sections, developing plugins;
• unlimited support: extra requests are agreed separately;
• a guarantee of zero problems: it reduces risks, but does not eliminate them.

A good proposal states clearly what it covers and what it does not.

Do it yourself or hire a professional: three questions

You can look after maintenance yourself if the site is simple, if you have the time and if you are comfortable with the dashboard. To decide, answer these three questions.

1. How much would an hour of downtime cost? If it is your sales or contact channel, a breakdown costs right away.
2. Do you know what to do if an update breaks the site? If you have no recent backup and no way to roll back, the risk is high.
3. Do you have an online shop, customer data or custom features? The more complex the site, the more damage a wrong update does.

If your answers are "a lot", "no" or "yes", it is worth handing it to a professional.

How often it is needed

It depends on the site. In general:

• checks and updates at a regular rhythm, for example monthly, with immediate action for serious security issues;
• backups more often for sites that change a lot, such as an online shop;
• monitoring continuous, because it is needed precisely when nobody is looking.

How to evaluate a maintenance offer

Before signing, ask:

• Are updates tested first on a copy?
• Where are backups kept, and for how long?
• What happens when there is a problem? Response and intervention times.
• What report do I receive, and how often?
• What is included and what is not? Hours, interventions, changes.
• Do I keep the access? Domain, hosting and dashboard must be in your name.

Be wary of anyone promising "absolute security" or "no problems guaranteed".

When something breaks

Even with good maintenance it can happen. What counts is the reaction:

1. you work out what changed (an update, a login, a plugin);
2. you restore the last working backup, if needed, to bring the site back online;
3. you investigate the cause on a copy, without hurry;
4. you fix and note it down, so it does not happen again.

A recent backup is what turns an emergency into an annoyance.

Why entrust it to me

I have been programming since 1999 and have delivered more than 300 projects, with about 30 agencies as an external developer. I maintain WordPress sites, including ones not built by me: updates tested first on a copy, backup before every intervention, security checks, monitoring and a periodic report. For agencies, I also work on the sites delivered to their clients. I work from Rome and remotely.

We start with an analysis of the site's condition, then you receive a written, free proposal. If you want to understand what condition your site is in, write to me: a chat of about 20 minutes, no strings attached. You will find the details in WordPress maintenance.