What a WordPress Maintenance Plan Should Include

Most WordPress maintenance offers fit on one line: "updates, backups, security." It sounds complete. Then something breaks and you find out what it really meant. Updates were clicked, but nobody checked the checkout afterwards. Backups existed, but nobody had ever tried to restore one. Security meant a plugin was installed in 2023. I run maintenance for WordPress sites every day, and this is what I think a plan should actually include. Use it to check your current provider, or as a list if you do the work yourself. <h2>What should run around the clock</h2> Some things can't wait for a weekly slot, because problems don't keep office hours. Uptime monitoring that checks more than the homepage. A 200 response from the homepage only proves the server is awake. Good monitoring also checks a keyword on key pages (for example "Add to cart" on a product page), the checkout or booking page itself, and response time, from more than one location so a single network blip doesn't wake anyone up. SSL and domain expiry warnings. Certificates usually renew automatically, until a DNS change or an expired card stops the renewal. You want a warning weeks before the date, not an angry email on the day. Form and email delivery checks. A contact form that silently stops sending email is one of the most expensive failures on a lead-generation site, because nothing looks broken. A person on the other end of the alert. An alert that goes to an unread inbox on a Saturday is not monitoring. The plan should say who gets alerted, how, and how fast they respond. <h2>Every week</h2> Updates, done carefully. Core, plugins and themes, tested on a staging copy first when the site has a shop, bookings or anything custom. One change at a time on important sites, so if something breaks you know which update did it. A quick check after updates. Load the pages that make money: product pages, cart, checkout, lead forms. Place a test order on a shop. Look at the PHP error log for new warnings. This takes minutes and catches most problems before customers do. Backup status. Confirm that the scheduled backups actually ran, are stored off the server, and include both the files and the database. <h2>Every month</h2> A restore test. This is the step most plans skip. Restore a recent backup to a staging site and make sure it works. A backup you have never restored is a guess, not a safety net. Plugin and theme review. Look for plugins that are inactive, abandoned (no update in a long time), or duplicated. Every plugin is code someone has to keep updated. Removing the ones you don't need is free security. A short report. What was updated, what broke and was fixed, uptime for the month, anything that needs a decision. If you pay for maintenance and never see a report, you have no idea what you are paying for. <h2>Every quarter</h2> User and access audit. List every user with the Administrator role. Remove the old agency account, the freelancer from last year's redesign, the "temp" marketing login. Downgrade people who don't need full admin. Check application passwords and API keys too, since they keep working after someone leaves. Make sure every admin uses two-factor authentication. A security review. Login protection, file permissions, PHP version (an unsupported PHP version is a real risk on its own), and whether the hosting account and DNS logins are still owned by the business rather than by someone who left. A speed baseline. Run the key pages through PageSpeed Insights and write the numbers down. Sites get slower one plugin and one image at a time, and you can only notice it if you have something to compare against. <h2>About auto-updates</h2> WordPress can update minor core releases, plugins and themes automatically, and on many simple sites that is a sensible choice. Security fixes land faster. But automatic is not the same as checked. If updates run overnight, someone should know what changed, look at the important pages the next morning, and be able to roll back quickly. Auto-updates without that check just move the surprise to whoever opens the site first. <h2>Questions to ask before you pay for maintenance</h2> Whether you are comparing providers or reviewing the one you have, these questions separate a real plan from a line on an invoice: When did you last restore one of my backups, and where are they stored? The right answer has a date and a place that is not the same server. What exactly does your monitoring check? "Uptime" alone usually means a homepage ping. Do updates go to staging first, and what do you test afterwards? Listen for specific pages and a test order, not "we check the site." Who gets the alert at 2am on a Sunday, and what happens next? What do I get each month? You should see what was done, not just that you were billed. <h2>The short version</h2> A WordPress maintenance plan is not a list of tasks. It is a promise that someone is watching the site, changing it carefully, and able to bring it back quickly when something goes wrong. If any of those three is missing, the plan has a gap. That is what we do at SupportWP: 24/7 monitoring of the pages that matter, careful updates, restore-tested backups and a monthly report you can actually read. If you are not sure what your current setup covers, our <a href="https://supportwp.me/free-website-audit">free website audit</a> is a good place to start.

What a WordPress maintenance plan should actually include

"Updates and backups" isn't a maintenance plan. Here's what we actually do every week, month and quarter on a WordPress site, what should run around the clock, and the questions to ask before you pay anyone for maintenance.