WordPress maintenance guide

What Is Included in a WordPress Maintenance Plan?

A WordPress maintenance plan should include the regular work that keeps your website updated, backed up, secure enough for everyday business use, monitored for obvious problems, and supported when something needs attention.

That sounds simple, but maintenance plans can vary a lot. One provider may include updates and backups only. Another may include uptime monitoring, security checks, small fixes, form testing, monthly reporting and advice. Some plans are perfectly suitable for a small brochure website, but too light for WooCommerce, bookings, memberships or a site that brings in most of your enquiries.

This guide explains what should normally be included, what may sit outside a standard plan, and how to judge whether a Basic or Complete level of care is a better fit for your website.

Compare our WordPress maintenance plans

Updates • backups • support

What a maintenance plan is for

A maintenance plan is there to reduce avoidable website problems and give your business a clear route for help. It is not only a list of technical jobs. It is a way of making sure someone is responsible for the website after it has gone live.

For small businesses, that responsibility matters. The person who built the website may no longer be checking it. The hosting company may keep the server running but not check your forms, plugins, checkout or backups. A member of staff may be able to log in, but not know whether it is safe to update everything at once.

WordPress websites need maintenance because they are made from several moving parts. There is WordPress itself, the theme, plugins, forms, media files, user accounts, integrations, tracking scripts, hosting settings and the database behind the site. Each part can change. Each part can affect another part.

A useful plan should answer a few plain questions: who checks the website, how often it is checked, what happens before updates, what gets tested afterwards, where backups live, how support requests are handled, and what happens if the website has a more serious fault.

Core inclusions: updates, backups, security checks and monitoring

Most WordPress maintenance plans should include four core areas: updates, backups, security checks and monitoring. If any of these are missing, the plan may still have value, but it should not be described as complete website care.

WordPress core, theme and plugin updates

Updates are one of the main reasons to have a maintenance plan. WordPress core, themes and plugins are updated to fix bugs, improve compatibility, add features and close security weaknesses. Leaving everything untouched for months can make the site harder to update later.

The important point is that updates should be handled with care. On a simple brochure site, the process may be quick. On a WooCommerce shop, booking site or membership site, updates need more thought because the website has more ways to break. A provider should understand which plugins are business-critical and which parts of the site need checking afterwards.

Regular backups

A maintenance plan should include a proper backup routine, not just a vague promise that backups exist somewhere. The backup should usually include the website files and the database, because WordPress content, settings, users, products, orders, bookings and plugin data often live in the database.

Ask how often backups run, where they are stored, how long they are kept and how restoration works. Hosting backups can be useful, but relying only on the same hosting account can be risky. For important websites, an off-site copy is a much better safety net.

Basic security checks

No honest provider should promise that a website can never be hacked. What a maintenance plan can do is reduce avoidable risk. That means keeping software current, checking for obvious warnings, encouraging sensible user access, removing unused plugins where appropriate, and responding quickly if something suspicious appears.

Security work should be practical rather than dramatic. Small business owners need clear action, not theatre. A useful provider will explain what they check, what they monitor, and what would happen if the site showed signs of compromise.

Uptime monitoring

Uptime monitoring checks whether the website is available. It does not replace deeper testing, but it helps catch obvious outages. If your website goes offline overnight or during a busy working day, it is better to know quickly than to hear about it from a customer.

This is especially important for businesses that receive enquiries, bookings or sales through their website. Even a short outage can matter if it happens during a campaign, event launch or busy sales period.

Helpful extras that can make a plan more useful

Once the basics are covered, the next question is what kind of support the business actually needs. Two maintenance plans can both include updates and backups, but feel very different in practice.

Some plans include a small amount of support time for minor fixes or advice. This can be useful when a form needs adjusting, a page has a small display issue, a plugin setting needs checking, or the business owner is unsure whether a warning in the dashboard matters.

Monthly reporting can also help, as long as it is not padded out with noise. A useful report might summarise updates completed, backup status, uptime notes, security observations, support requests and any recommended next actions. It should help the business understand what has been done and whether anything needs a decision.

Post-update testing is one of the most valuable extras. It is easy to update plugins and assume the job is finished. It is more useful to check the things that make money or create enquiries: contact forms, quote forms, checkout, booking forms, login pages, important landing pages and email notifications.

Some providers include small content edits. Others keep content changes separate. Either approach can work if it is clear. A plan might include small text changes, image swaps or opening-hours updates, while larger page builds, design changes and new functionality are quoted separately.

A hosting review can also be helpful. Maintenance is not the same as hosting, but poor hosting can make maintenance harder. Slow servers, limited backups, outdated PHP versions or awkward access can all affect the website. A provider does not need to sell hosting to give sensible advice on whether the current setup is holding the site back.

What may not be included

A good plan should also be clear about what is not included. This is not a bad thing. Clear boundaries prevent awkward conversations later and help the business understand when something becomes a separate project.

Most standard maintenance plans do not include large redesign work, new page builds, custom development, major speed optimisation, malware cleanup for an already hacked site, copywriting, SEO campaigns, paid plugin licences, hosting fees or emergency recovery work outside the agreed scope. Some providers may offer those services separately.

Plugin licences are worth asking about. Some websites use paid plugins for forms, page builders, ecommerce features, security, backups or bookings. A maintenance plan may keep those plugins updated, but it may not include the annual licence fees. If a licence expires, updates and support for that plugin may stop.

Hacked website recovery is another area where expectations need to be plain. Routine maintenance can reduce risk, but cleaning a hacked site is more involved than monthly care. It may require investigation, file cleanup, password resets, plugin replacement, hosting work, blacklist checks and follow-up monitoring.

Content edits vary from provider to provider. Updating a phone number is not the same as writing a new service page. Swapping one image is not the same as redesigning a section. If your business expects frequent content changes, ask whether the plan includes them or whether you need a separate content support arrangement.

Which plan fits your website type?

The right maintenance plan depends less on the size of the business and more on the role of the website. A small shop with WooCommerce may need more care than a larger consultancy with a simple brochure site. A local service website may look simple, but if all quote requests come through one form, that form deserves attention.

Start with the cost of disruption. If the website broke for a day, would it be a mild annoyance, a reputational problem, or a direct loss of sales? If a form stopped working, would anyone know? If the backup was a week old, what would be missing? These questions are more useful than counting pages.

For many small brochure websites, a Basic maintenance plan is enough. The site still needs updates, backups and checks, but it may not need the same level of post-update testing as a shop or booking system.

For ecommerce, bookings, memberships, online courses, directories or sites with customer accounts, a Complete plan is usually more suitable. These websites have more dependencies and more customer actions happening inside WordPress. If something breaks, the business may need more than a quick plugin update.

For more buying guidance, read our article on WordPress care plans for small businesses. If price is the main question, our guide to website maintenance cost in the UK explains what affects monthly pricing.

Questions to ask before choosing a provider

You do not need to become technical to choose a maintenance provider. You do need enough detail to know what you are paying for. If the answer to every question is “do not worry, it is all included”, ask for it in writing.

• How often are WordPress, theme and plugin updates checked?
• Is a backup taken before updates?
• Do backups include the files and database?
• Where are backups stored and how long are they kept?
• Has the provider ever tested restoring a backup?
• Which pages, forms or customer journeys are checked after updates?
• Is uptime monitoring included?
• What basic security checks are carried out?
• Are paid plugin licences included or separate?
• Is support time included, and how much?
• What response time should you expect?
• What happens if the website is already broken or has been neglected for months?
• Are ecommerce, booking or membership websites handled differently?
• Will you receive a monthly report or summary?

The answers should feel practical. A provider does not need to make maintenance sound mysterious. In fact, the clearer the routine is, the easier it is for you to judge whether the plan fits your website.

If your site has not been looked after for a while, it may need an initial review before monthly maintenance starts. That review can identify old plugins, missing backups, expired licences, PHP version issues, broken forms or risky update gaps. It is better to find those calmly than during a live problem.

FAQs

Are content updates included in website maintenance?

Sometimes, but not always. Some maintenance plans include a small amount of support time for minor text or image changes. Others focus only on technical maintenance and quote content edits separately. Ask what counts as a small edit, how much time is included, and what happens if you need a new page or larger layout change.

Are plugin licences included?

Plugin licences are often separate from maintenance. A provider may update and support the plugins already installed on your website, but annual licence fees for premium plugins may still be paid by the business. This should be made clear before you choose a plan.

Does maintenance include fixing hacked websites?

Routine maintenance usually helps reduce risk, but it does not always include full hacked-site cleanup. If a website is already infected or blacklisted, that work may need a separate investigation and recovery quote. After cleanup, an ongoing maintenance plan can help reduce the chance of the same issue returning.

Do ecommerce websites need a different plan?

Usually, yes. Ecommerce websites have more moving parts than simple brochure sites. Checkout, payment gateways, order emails, customer accounts, stock, coupons and product data all need attention. A more complete plan is normally a better fit because updates and checks carry more business risk.

Is hosting the same as website maintenance?

No. Hosting is where your website lives. Maintenance is the ongoing work that keeps the WordPress website updated, backed up, checked and supported. Good hosting helps, but it does not automatically mean someone is checking your plugins, forms, backups and customer journeys.

How often should a maintenance plan run checks?

Most small business sites benefit from monthly checks at minimum. Higher-risk sites, such as ecommerce, booking or membership websites, may need closer monitoring and more careful update handling. Backup frequency may also need to be daily or more often if the site receives orders, bookings or registrations.