WordPress Website Care & Maintenance

Why a website needs maintenance

A WordPress site is not one piece of software but several: WordPress core, a theme, a set of plugins, the PHP version on the server, the database and the web server itself. Each of these is released on its own schedule. Security fixes in particular are published in the open, which means attackers learn about a hole at the same moment site owners do. WordPress itself says it plainly in its hardening guide: keeping core, themes and plugins up to date is the single most important thing you can do for security.

The trouble is that updating is not risk-free either. A plugin update can change a feature you rely on, a new PHP version can expose old code in a theme, and two plugins that worked together last month may not after an update. That is why maintenance is more than pressing "update all": it is updating, checking, and being able to roll back.

Without care, sites rarely fail all at once. They drift: a form stops sending email and nobody notices for weeks, an SSL certificate expires, the site gets slower with every plugin, or a known vulnerability in an old plugin is found by an automated scanner and the site starts serving spam.

What our care covers

For sites hosted on our managed server, care includes:

• Updates: WordPress core, theme and plugin updates, plus PHP version upgrades when the site is ready for them.
• Daily backups: the whole account (files, databases and email) is backed up every day, and we restore when something goes wrong.
• Security: firewall, web application firewall rules, malware scanning, login protection and hardening of the WordPress install (more below).
• SSL: free certificates that renew automatically, so the padlock never lapses.
• Monitoring: uptime checks and server health checks, so we usually know about a problem before you do.
• Performance: page and object caching, image optimisation and database clean-up when a site slows down.
• Email delivery: making sure contact forms and order emails actually arrive (correct SPF, DKIM and DMARC records, a working mail route).
• Small changes: text and image updates, a new page from an existing layout, a plugin setting changed.

Bigger pieces of work, such as a redesign, a new feature or a shop migration, are scoped and estimated separately; see our development services.

How we update without breaking things

Updates on a live site are where most self-inflicted outages happen. Our process for anything beyond a routine patch:

1. Copy the live site to staging. A private copy with the same code and a recent copy of the database.
2. Update on staging first. Core, plugins, theme or PHP, one change set at a time.
3. Check what matters. The pages that earn money or leads: forms, checkout, logins, search, plus the error log.
4. Back up, then deploy. A fresh backup of the live site is taken right before the change goes live.
5. Verify live and keep a way back. Each change is logged with how to undo it, so a rollback takes minutes, not a day.

Plugins that are abandoned (no updates for a long time, or removed from the WordPress.org directory) are flagged and replaced with maintained alternatives or a few lines of custom code.

Security layers

No single tool makes a website safe. We stack several layers so that one failing does not leave the site open:

• Network firewall that blocks hosts repeatedly failing logins or probing the server.
• Web application firewall (ModSecurity rules) that filters common attacks such as SQL injection and path traversal before they reach WordPress, plus site-specific rules for known weak spots.
• Malware scanning of files on the server, with infected files quarantined.
• WordPress hardening following the official guidance: no file editing from the dashboard, unique security keys, least-privilege user roles, and a regular review of who has admin access.
• Isolation so that one site's problem cannot spread to another, with PHP restricted to the site's own folder where that matters.

The OWASP Top 10 is a good plain-language overview of the kinds of attacks these layers are there to stop.

A monthly checklist you can use yourself

If you look after your own site, this is the short list we would run every month:

1. Update WordPress core, plugins and theme, after taking a backup.
2. Delete or deactivate plugins and themes you no longer use. Inactive code can still be attacked.
3. Check users: remove old accounts, make sure only people who need it have the Administrator role.
4. Submit every form on the site and confirm the email arrives.
5. Make a test purchase or booking if the site takes money or appointments.
6. Check that a backup exists and that you know how to restore it. A backup you have never restored is a hope, not a plan.
7. Look at the site on a phone, and check load time on a key page with a tool such as PageSpeed Insights.
8. Look at Google Search Console for crawl errors, security issues or manual actions.
9. Confirm your domain and SSL certificate are set to renew.

If that list looks like more than you want to think about each month, that is exactly what a care plan is for.

Taking over an existing site

Many of the sites we look after were built by someone else. Taking one over starts with an audit:

• Versions of WordPress, PHP, theme and every plugin, and which ones are outdated or abandoned
• Admin users, file permissions and any signs of past compromise
• Licences for premium plugins and themes (unlicensed "nulled" copies are a common source of malware and are replaced)
• Backups, email delivery and DNS
• Speed and Core Web Vitals on the most important pages

We fix anything urgent first, move the site to our managed server if you want us to host it, and then agree a plan for the rest.

Frequently asked questions

Can't I just turn on automatic updates?

For WordPress core minor releases, automatic updates are a good idea and are on by default. For plugins and themes, auto-updates are better than no updates, but they happen without anyone checking the result, so a breaking change can take down a form or a checkout until someone notices. Testing on staging first removes most of that risk.

How often should a WordPress site be updated?

Security releases should go out as soon as they are tested. Routine plugin and theme updates are fine on a regular cycle, such as weekly or every two weeks. What matters most is that nothing sits unpatched for months.

Do you only maintain sites you built?

No. We take over sites built by other agencies and freelancers after an audit, as described above.

Do I need to host with you?

Full care, including server-level security and backups, applies to sites on our managed server. For sites hosted elsewhere we can still handle WordPress updates, audits and fixes; what we can do at server level depends on the host.

Who owns the site and the backups?

You do. If you ever want to move, you get the files, the database and the domain settings.

Looking for new work rather than care? See our web, mobile app and IoT development services.