A WordPress website is never really finished. Once it is live, it needs regular updates, backups and monitoring to stay secure and working. Here is what that upkeep involves, who should do it, and what to ask before you pay someone to do it.
Why WordPress needs looking after
WordPress is made of several moving parts: the WordPress software itself, your theme, and usually a number of plugins, all running on a web server. Each one is updated by its authors from time to time, often to fix security problems. If nobody applies those updates, the site slowly falls behind.
The opposite problem exists too. Updating everything without checking can break a page, a form or a checkout. Good maintenance sits between the two: updates are applied regularly, and tested before customers see them.
What maintenance should cover
1. Updates
WordPress core, the theme and every plugin need updating. Security fixes matter most, but performance fixes and compatibility changes count too. A site that has gone a long time without updates becomes harder and riskier to bring up to date, because many changes arrive at once.
2. Backups you have actually tested
A backup is only useful if it can be restored. Ask where backups are kept, how often they are taken, and whether anyone has ever tried restoring one. Backups stored on the same server as the site are weak protection if that server is the thing that fails.
3. Security
This means more than a plugin with a green tick. It includes sensible hosting, limiting who has an administrator login, removing accounts and plugins that are no longer used, and keeping an eye out for anything unusual.
4. Monitoring
You want to hear about a problem before your customers do. At the very least, something should check that the site is up and that important pages, such as a contact form or checkout, still work.
5. Performance
Sites tend to get slower over time as content, images and plugins accumulate. Occasional housekeeping keeps pages loading quickly, which matters to visitors and to search engines.
6. Someone to call
Content changes, a new page, an odd error message: a site is easier to run when there is a named person or team who knows it and can help.
Plugin sprawl is the usual cause of trouble
Every plugin is someone else's code running on your site. The more you have, the more there is to update, and the more chances for two of them to clash. Over the years, sites often collect plugins that were installed for a one-off job and never removed.
A useful habit is to ask of each plugin: what does it do, does the business still need it, and could a small piece of custom code replace it? Fewer, better-chosen plugins make everything else in this article easier.
Who should do it?
- You, or someone on your team. This can work for a small, simple site, if someone is reliably responsible for it and knows how to roll back a bad update. The risk is that it slips down the list of priorities.
- The person who built the site. They know the site best, but check that the arrangement is written down and that you are not dependent on one individual being available.
- A maintenance or care provider. Usually the most dependable option for a site that matters to the business, because the work is routine and somebody else's job.
Questions to ask a maintenance provider
- What exactly is included, and what is charged separately?
- Are updates tested before they go live, and how?
- Where are backups stored, and have restores been tested?
- How will I find out if something goes wrong, and who responds?
- Who owns the hosting account, the domain and the code?
- Can you take over a site that someone else built?
That last question is worth asking. A good provider will review the site's code, plugins, hosting and security first, tell you what they find, and only then agree to look after it.
A hypothetical example
Imagine a small business whose website was built three years ago and has not been touched since. It has a contact form, a booking plugin and a handful of other plugins, several of which are out of date. Nobody is sure who holds the hosting login.
The sensible first step is not to update everything at once. It is to find out what is there, take a backup, remove what is no longer used, and then update in stages, checking the form and booking page after each step. From then on, regular small updates are far less risky than an occasional big one.
Is maintenance worth paying for?
If the website brings in enquiries or sales, yes. The cost of upkeep is usually small compared with the cost of a hacked site, a broken checkout or a lost week of enquiries. If the site is a small brochure that nobody would miss, doing the basics yourself may be enough. Either way, the important thing is that someone is clearly responsible.