WordPress maintenance is not hosting and it is not a fee for merely existing - it is specific, repeatable work someone performs on your site every month. The minimum sensible scope is: core, theme and plugin updates done with a backup first and a check afterwards, backups stored off the site’s own server, uptime and security monitoring, plus a pool of time for small fixes and for reacting when something breaks. Anything below that is an invoice for peace of mind, not for work.
Below I break down what fits into each of those points, and which signals tell you nobody is really standing behind your monthly fee.
What maintenance covers - the full scope
Maintenance splits into four layers. The first two are mandatory in every case; the other two depend on how much your site earns and how much downtime costs you.
| Layer | What happens | How often |
|---|---|---|
| Technical upkeep | WordPress, theme and plugin updates, database cleanup, PHP version, a check of the site after every change | Weekly or every two weeks |
| Data safety | Backup of files and database stored off the site’s server, restore test, SSL certificate, review of user accounts | Backup daily, restore test once a quarter |
| Monitoring | Checking that the site responds, alert on failure, malware scan, load time control | Check every few minutes, review once a month |
| Development and fixes | A pool of hours for content changes, small features, bug fixes, consultations | Monthly, within an agreed limit |
On top of that comes something no table shows: somebody knows your site. They know you have a contact form that likes to break after every update - and they check it every time, before you even notice.
Updates - this is not clicking “Update”
An update swaps out code on a living organism, so a good procedure always looks the same: backup first, update, then check the key paths. The key paths are the homepage and the contact form, and in a store also the cart and a test order.
The difference between real maintenance and the appearance of it shows up exactly here:
- Bad practice - automatic updates switched on and silence afterwards. You find out something broke from a customer, or from a critical error screen on your own site
- The minimum - manual updates with a backup first and a quick look at the homepage
- Good practice - updates run on a staging copy, key paths checked, only then production; in a store this is standard, because a broken checkout costs real money
You match the rhythm to the risk: a simple company site survives a two-week cycle, a store with traffic needs a weekly one. Security patches go in immediately, whatever the cycle says. I set the whole procedure out step by step in the safe update checklist.
Backups - the one condition that has to be met
A backup only counts if it sits off the site’s own server and has been restored at least once. A backup kept on the same hosting dies together with that hosting - during a break-in, a disk failure or an account suspension.
A sensible standard: files and database copied daily, at least two weeks of history, a copy in a second location (cloud, another server) and a restore test once a quarter. That last point is what separates real maintenance from a declaration - only a restore proves the backup works at all. How to put that together on your own, I described in the piece on WordPress backups that actually restore.
Security - what can be done, and what nobody can guarantee
Site security is about reducing risk, not zeroing it, and that is how it should be talked about. In practice maintenance covers: plugins and theme always on current versions (outdated ones are how the vast majority of break-ins happen), a review of admin accounts with dead ones removed, two-factor login, a lockout after repeated login attempts, a valid SSL certificate and regular file scans.
When something gets through anyway, what counts is reaction time and whether there is anything to restore from. After signs of infection - strange redirects, odd posts, a warning from your host - you work through a proper malware detection and removal procedure, rather than just installing yet another “protection” plugin.
Compliance is a separate layer. Since June 2025 the European Accessibility Act applies to digital services, and companies issuing invoices in Poland now operate inside KSeF, Poland’s mandatory e-invoicing system - it covered the largest businesses from February 2026 and everyone else from April 2026. These are not things you handle “while doing the updates”, but whoever maintains your site should warn you about them before they turn into a problem.
Monitoring and reporting - how you know somebody is there
A maintenance report should contain sentences nobody could write without actually opening the site. A good monthly report says: what was updated and from which version to which, whether anything broke afterwards and how it was fixed, how many backups were made and when they were last restored, whether there was downtime and how long, what was done within the pool of hours, and what is worth planning for next month.
Warning signs that there is no work behind the monthly fee:
- The report looks identical every month, only the date changes
- The WordPress dashboard has been showing a pending-updates counter for months
- Nobody can tell you where the last backup sits and when it was last restored
- Tickets disappear and a reply arrives days later, with no agreed response time
- The contract talks about “maintenance” with no list of activities and no hour limit
If you recognise even two of these, it is worth starting with a proper audit of the site - it shows in black and white what has actually been done over the past months and what was merely invoiced.
What it costs and what you are paying for
The price of maintenance depends on three things: the size of the site, whether it is a store, and the agreed response time when something breaks. On my side it looks like this:
| Plan | Who it is for | Price net / month |
|---|---|---|
| Basic | Company site, brochure site, simple content site | from 1,000 PLN |
| Pro | Larger site, smaller store, integrations | from 2,000 PLN |
| Premium | Store with traffic, B2B systems, short response time | from 3,500 PLN |
Every plan includes technical upkeep, backups, monitoring and a pool of time for fixes - what differs is the scale of the site, how often the work happens and how fast I respond to a ticket. On top of that come costs outside my control: hosting, domain and premium plugin licences. Their price lists change every year, so I always check current rates when setting a budget instead of quoting figures from memory. I put the full list of those items together in the piece on website maintenance costs.
A simple profitability test: work out what one day of a dead site costs you (lost enquiries, lost orders, time spent firefighting). If that number is higher than the monthly fee, maintenance pays for itself with the first outage that never happened.
Site maintenance and store maintenance are not the same thing
A store needs a wider scope, because it has more moving parts: payment gateways, courier and warehouse integrations, transactional emails, checkout. Each of them can fail independently and each has to be checked separately after an update.
On a company site an outage means no enquiries; in a store it means lost sales countable to the last zloty. That is why a store also gets: a test order after every update, a check that confirmation emails are going out, and load time monitoring at peak traffic. I covered that in a separate piece on technical maintenance for a WooCommerce store.
How I work
I start with a free diagnosis: I look at the site, the versions, the backups, the state of the plugins and the load time, and then I say plainly whether you need ongoing maintenance at all or whether a one-off cleanup is enough. Sometimes I recommend the second option - better one client fewer than a monthly fee with no justification behind it.
If we do go into ongoing support, you get a list of activities with frequencies up front, an agreed response time and a report every month. For larger tasks beyond the pool of hours I always give a fixed bid in writing before we start - no work begins until you accept it.
Frequently asked questions
What exactly does WordPress maintenance include? Core, theme and plugin updates done with a backup first and a check afterwards, daily backups stored off the site’s server, uptime and security monitoring, and a pool of time for small fixes and incident response. An honest contract always lists those activities with frequencies - if it only says “maintenance”, there is nothing to hold anyone to.
Is site maintenance the same as hosting? No. Hosting is space on a server - the electricity and the premises. Maintenance is work performed on your site: updates, backups, monitoring, fixes. Hosting will not update your plugins, will not check your contact form and will not restore your site after a break-in - a person always does that.
Can I look after the site myself? Yes, on a simple company site that is realistic - you need an update rhythm, backups off the server and the habit of checking the site after every change. The problem starts with an outage: then experience and speed matter, not good intentions. Plenty of my clients run their site themselves and keep me around for when something breaks.
How much does website maintenance cost per month? On my side: from 1,000 PLN net for a company site, from 2,000 PLN for a larger site or a smaller store, from 3,500 PLN for a store with traffic and for B2B systems (Polish market rates). On top of that come hosting, domain and plugin licences - independent costs whose rates change every year, so I check them as I go when setting a budget.
Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.