WordPress maintenance: what a monthly care plan should include

A website isn't a print brochure. WordPress, its plugins and the server underneath change constantly, and a site left alone for a year is a site waiting for a problem. A care plan is how you make sure someone is looking after it.

Not all care plans are equal, though. Here's what a good one covers, and what to ask before you sign up.

Updates, done safely

WordPress core, plugins and themes release updates for security fixes and new features. A care plan should:

• Apply updates regularly, at least every week or two for security releases
• Take a backup before updating, so any problem can be rolled back
• Test major updates on a staging copy first, especially on shops and complex sites
• Check the site after updating, not just click "update all" and hope

Backups you can rely on

• Automatic daily backups of files and the database
• Stored off the web server, so they survive a server failure or a hack
• Several weeks of history, because problems are often discovered late
• Tested restores: a backup nobody has ever restored is a hope, not a plan

Security monitoring

• Regular malware scans
• Alerts when core files change unexpectedly
• A firewall and login protection kept up to date
• Reviewing user accounts and removing ones that are no longer needed

If something does get through, the plan should spell out what happens next, and whether a cleanup is included or billed separately.

Uptime monitoring

A monitoring service checks the site every few minutes and sends an alert if it goes down. You want to hear about an outage from your developer, not from a customer.

Checks that are easy to forget

• Contact forms: forms can stop sending email without any visible error. A monthly test submission catches this before you miss real enquiries.
• Speed: a quick performance check to catch slowdowns as content and plugins are added.
• Broken links and missing pages.
• SSL certificate renewal and domain expiry dates.
• PHP version: hosts retire old versions, and running one past its support date is a security risk.

Light housekeeping

Over time, WordPress collects post revisions, expired temporary data and spam comments. Cleaning these up occasionally keeps the database lean.

A clear monthly report

You should get a short summary of what was updated, backup status, uptime, security scan results and anything that needs your attention. If you can't tell what you're paying for, ask.

Questions to ask before you sign up

1. Where are backups stored, and how long are they kept?
2. Do you test updates before applying them to the live site?
3. What happens if the site is hacked? Is cleanup included?
4. How quickly do you respond if the site goes down?
5. Are small content changes included, and how many?

Care plans are one of the services I offer, built around exactly this list. If your site hasn't had attention in a while, get in touch for a free audit.