WordPress maintenance is not hosting and it is not a fee for merely existing - it is specific, repeatable work someone performs on your site every month. The minimum sensible scope is: core, theme and plugin updates done with a backup first and a check afterwards, backups stored off the site’s own server, uptime and security monitoring, plus a pool of time for small fixes and for reacting when something breaks. Anything below that is an invoice for peace of mind, not for work.
Below I break down what fits into each of those points, and which signals tell you nobody is really standing behind your monthly fee.
What maintenance covers - the full scope
Maintenance splits into four layers. The first two are mandatory in every case; the other two depend on how much your site earns and how much downtime costs you.
| Layer | What happens | How often |
|---|---|---|
| Technical upkeep | WordPress, theme and plugin updates, database cleanup, PHP version, a check of the site after every change | Weekly or every two weeks |
| Data safety | Backup of files and database stored off the site’s server, restore test, SSL certificate, review of user accounts | Backup daily, restore test once a quarter |
| Monitoring | Checking that the site responds, alert on failure, malware scan, load time control | Check every few minutes, review once a month |
| Development and fixes | A pool of hours for content changes, small features, bug fixes, consultations | Monthly, within an agreed limit |
On top of that comes something no table shows: somebody knows your site. They know you have a contact form that likes to break after every update - and they check it every time, before you even notice.
Updates - this is not clicking “Update”
An update swaps out code on a living organism, so a good procedure always looks the same: backup first, update, then check the key paths. The key paths are the homepage and the contact form, and in a store also the cart and a test order.
The difference between real maintenance and the appearance of it shows up exactly here:
- Bad practice - automatic updates switched on and silence afterwards. You find out something broke from a customer, or from a critical error screen on your own site
- The minimum - manual updates with a backup first and a quick look at the homepage
- Good practice - updates run on a staging copy, key paths checked, only then production; in a store this is standard, because a broken checkout costs real money
You match the rhythm to the risk: a simple company site survives a two-week cycle, a store with traffic needs a weekly one. Security patches go in immediately, whatever the cycle says. I set the whole procedure out step by step in the safe update checklist.
Backups - the one condition that has to be met
A backup only counts if it sits off the site’s own server and has been restored at least once. A backup kept on the same hosting dies together with that hosting - during a break-in, a disk failure or an account suspension.
A sensible standard: files and database copied daily, at least two weeks of history, a copy in a second location (cloud, another server) and a restore test once a quarter. That last point is what separates real maintenance from a declaration - only a restore proves the backup works at all. How to put that together on your own, I described in the piece on WordPress backups that actually restore.
Security - what can be done, and what nobody can guarantee
Site security is about reducing risk, not zeroing it, and that is how it should be talked about. In practice maintenance covers: plugins and theme always on current versions (outdated ones are how the vast majority of break-ins happen), a review of admin accounts with dead ones removed, two-factor login, a lockout after repeated login attempts, a valid SSL certificate and regular file scans.
When something gets through anyway, what counts is reaction time and whether there is anything to restore from. After signs of infection - strange redirects, odd posts, a warning from your host - you work through a proper malware detection and removal procedure, rather than just installing yet another “protection” plugin.
Compliance is a separate layer. Since June 2025 the European Accessibility Act applies to digital services, and companies issuing invoices in Poland now operate inside KSeF, Poland’s mandatory e-invoicing system - it covered the largest businesses from February 2026 and everyone else from April 2026. These are not things you handle “while doing the updates”, but whoever maintains your site should warn you about them before they turn into a problem.
Monitoring and reporting - how you know somebody is there
A maintenance report should contain sentences nobody could write without actually opening the site. A good monthly report says: what was updated and from which version to which, whether anything broke afterwards and how it was fixed, how many backups were made and when they were last restored, whether there was downtime and how long, what was done within the pool of hours, and what is worth planning for next month.
Warning signs that there is no work behind the monthly fee:
- The report looks identical every month, only the date changes
- The WordPress dashboard has been showing a pending-updates counter for months
- Nobody can tell you where the last backup sits and when it was last restored
- Tickets disappear and a reply arrives days later, with no agreed response time
- The contract talks about “maintenance” with no list of activities and no hour limit
If you recognise even two of these, it is worth starting with a proper audit of the site - it shows in black and white what has actually been done over the past months and what was merely invoiced.
WordPress maintenance in the contract - what has to be written down before you sign
The most common problem site owners bring to me is not a lack of maintenance but a contract that says “WordPress maintenance” and nothing else. No list of activities, no frequencies, no response time. When the site goes down on a Saturday it turns out nobody promised anything, so there is nothing to hold anyone to.
A contract for maintaining a WordPress website should answer five questions, ideally in a single table:
- What and how often - core, theme and plugin updates with a stated frequency, always with a backup first and a check afterwards
- Where the backups live - a location off the site’s server, how many days of history, the date of the last restore test
- Response time - hours from a ticket to the first reply and to the start of a fix, separately for outages and for small changes
- Report - monthly, with versions, backups and downtime, not a single line saying “everything works”
- What sits outside the pool - the hour limit for fixes and the rule that larger jobs get a written quote before they start
Of those five points only two, response time and the hour limit, genuinely differ between plans. The rest is an obligation in every plan regardless of price - if a provider negotiates off-server backups as a “premium option”, that is a sign that WordPress maintenance is a product for them, not work.
A simple test of your current provider: ask for the date of the last backup restore and for the list of updates from last month. If the answer takes several days, you have your answer. For a site that is first of all an archive of posts the scope looks a little different - I set it out in the piece on maintaining a company blog. Within my ongoing support you get that table up front, before the first invoice arrives.
What it costs and what you are paying for
The price of maintenance depends on three things: the size of the site, whether it is a store, and the agreed response time when something breaks. On my side it looks like this:
| Plan | Who it is for | Price net / month |
|---|---|---|
| Start | Company site, brochure site, simple content site | on the support page |
| Store | Larger site, smaller store, integrations | on the support page |
| Plus | Store with traffic, B2B systems, short response time | on the support page |
Every plan includes technical upkeep, backups, monitoring and a pool of time for fixes - what differs is the scale of the site, how often the work happens and how fast I respond to a ticket. On top of that come costs outside my control: hosting, domain and premium plugin licences. Their price lists change every year, so I always check current rates when setting a budget instead of quoting figures from memory. I put the full list of those items together in the piece on website maintenance costs.
A simple profitability test: work out what one day of a dead site costs you (lost enquiries, lost orders, time spent firefighting). If that number is higher than the monthly fee, maintenance pays for itself with the first outage that never happened.
Site maintenance and store maintenance are not the same thing
A store needs a wider scope, because it has more moving parts: payment gateways, courier and warehouse integrations, transactional emails, checkout. Each of them can fail independently and each has to be checked separately after an update.
On a company site an outage means no enquiries; in a store it means lost sales countable to the last zloty. That is why a store also gets: a test order after every update, a check that confirmation emails are going out, and load time monitoring at peak traffic. I covered that in a separate piece on technical maintenance for a WooCommerce store.
How I work
I start with a diagnosis: I look at the site, the versions, the backups, the state of the plugins and the load time, and then I say plainly whether you need ongoing maintenance at all or whether a one-off cleanup is enough. Sometimes I recommend the second option - better one client fewer than a monthly fee with no justification behind it.
If we do go into ongoing support, you get a list of activities with frequencies up front, an agreed response time and a report every month. For larger tasks beyond the pool of hours I always give a fixed bid in writing before we start - no work begins until you accept it.
Frequently asked questions
What exactly does WordPress maintenance include? Core, theme and plugin updates done with a backup first and a check afterwards, daily backups stored off the site’s server, uptime and security monitoring, and a pool of time for small fixes and incident response. An honest contract always lists those activities with frequencies - if it only says “maintenance”, there is nothing to hold anyone to.
Is site maintenance the same as hosting? No. Hosting is space on a server - the electricity and the premises. Maintenance is work performed on your site: updates, backups, monitoring, fixes. Hosting will not update your plugins, will not check your contact form and will not restore your site after a break-in - a person always does that.
Can I look after the site myself? Yes, on a simple company site that is realistic - you need an update rhythm, backups off the server and the habit of checking the site after every change. The problem starts with an outage: then experience and speed matter, not good intentions. Plenty of my clients run their site themselves and keep me around for when something breaks.
How much does website maintenance cost per month? Plan prices are on the support page - a company site has a different scope from a larger site or a smaller store, and different again from a store with traffic and B2B systems. On top of that come hosting, domain and plugin licences - independent costs whose rates change every year, so I check them as I go when setting a budget.
Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.