WordPress Maintenance: What a Care Plan Should Actually Include (and What Happens Without One)
Your website launched. The agency sent a final invoice, everyone shared the link on LinkedIn, and then, quietly, the site became nobody's job.
That's the moment most WordPress problems start. Not on launch day, but eight months later, when a plugin update breaks the donation form and no one notices for three weeks. We've been building and maintaining WordPress sites since 1998, and the difference between a site that ages well and one that becomes a liability is almost never the original build. It's what happens afterward.
Why WordPress Needs Ongoing Maintenance at All
WordPress isn’t a finished product you install once. It’s a platform made up of three moving layers: WordPress core, your theme, and anywhere from ten to forty plugins, each maintained by a different developer on a different schedule. Add the PHP version on your server, and you have a stack where something changes nearly every week.
Most of the time those changes are harmless. But every so often an update introduces a conflict, a security patch closes a hole that was being actively exploited, or a plugin author simply abandons their project. A maintained site absorbs those events. An unmaintained site accumulates them until something visible breaks — or until something invisible does, which is worse.
What a Care Plan Should Actually Include
Here’s what we’d expect from any plan worth paying for, whether it’s ours or someone else’s.
-
#1 - Updates that are tested, not just applied
Anyone can click “Update All.” A maintenance plan should update core, theme, and plugins on a regular cadence — ideally on a staging copy first — then check that the site still works: load key pages, submit a form, and confirm that custom functionality (an event calendar, a member directory, a Salesforce sync) still behaves. Auto-updates alone are not maintenance; they’re a gamble with no one watching the table.
-
#2 - Offsite, restorable backups
“We have backups” is only meaningful if someone has tested restoring one. A good plan keeps daily backups stored somewhere other than your web server, retains them long enough to recover from a problem you didn’t notice right away, and has actually run a restore. Ask your provider when they last did one.
-
#3 - Security monitoring and hardening
A web application firewall, malware scanning, login protection, and someone paying attention to vulnerability disclosures for the plugins you actually use. When a critical vulnerability is announced, the response window is hours, not “at the next monthly update.” Our guide to protecting your WordPress site from bots and malicious traffic covers the specifics; a care plan is where that guidance gets implemented and kept current.
-
#4 - Uptime and performance monitoring
You should not be the one who discovers the site is down. Uptime monitoring alerts your provider within minutes. Performance monitoring catches the slow decline that happens as a site accumulates plugins, oversized images, and unoptimized database tables. If your Core Web Vitals slipped over the past year, a good plan would have noticed.
-
#5 - A real human you can email
The part most often missing from cheap plans. When something breaks, you need a person who already knows your site, not a ticket queue at a hosting company. A useful care plan includes a block of support time each month for small changes and questions, and a clear turnaround commitment.
-
#6 - Periodic review
Once or twice a year, someone should look at the site as a whole: Are there plugins that are no longer needed? Is the PHP version still supported? Are there accessibility regressions? Are forms still delivering to the right inbox? This is the maintenance equivalent of a physical, and it’s where most of the long-term value lives.
What a Care Plan Usually Isn’t
To be fair to everyone involved, a few things frequently get lumped under “maintenance” that are really separate projects: redesigns, new features, content writing, SEO campaigns, and rebuilding a site that has been neglected for years. A good provider will tell you clearly where the line is. A care plan keeps a healthy site healthy; it doesn’t turn an unhealthy one around on its own.
What Happens Without One
We inherit a lot of unmaintained sites. The pattern is consistent enough to describe.
-
Months 1–6
Nothing visible. Updates pile up. A few plugins fall two or three major versions behind.
-
Months 6–18
Something small breaks and gets worked around instead of fixed. Page speed drifts downward. Someone notices the contact form stopped sending — but not when it stopped.
-
Months 18–36
A known vulnerability in an old plugin gets exploited. The site is defaced, quietly used to host spam, or blocklisted by Google. Cleanup costs more than three years of a care plan would have, and search rankings take months to recover.
Not every unmaintained site follows this path. But enough do that we consider a plan the cheapest insurance an organization can buy for an asset it depends on.
How Much Should WordPress Maintenance Cost?
Rates vary widely because the word “maintenance” is doing a lot of different jobs. Hosting-company plans that only run automatic updates can be very inexpensive, and you get what you pay for. Agency plans that include testing, monitoring, security, and human support time typically run from a few hundred dollars a month for a straightforward brochure site to considerably more for sites with complex integrations, e-commerce, or high traffic. The right comparison isn’t plan-to-plan; it’s the plan cost against what an outage, a breach, or a broken donation form would cost you.
Questions to Ask Any Provider
If the answers are vague, the plan probably is too.
-
#1 - Testing
Do you test updates on staging before applying them to the live site?
-
#2 - Backups
Where are backups stored, how long are they kept, and when did you last restore one?
-
#3 - Security response
What is your response time for a critical security vulnerability?
-
#4 - A named contact
Who specifically will I be emailing when something breaks?
-
#5 - Scope
What’s included in the monthly support time, and what counts as a separate project?
-
#6 - Abandoned plugins
Will you tell me when a plugin I rely on has been abandoned?
