WordPress Maintenance Plans: What to Pay and What to Demand

A WordPress maintenance plan is recurring, scheduled upkeep of WordPress core, plugins, themes, backups and security. It is only worth paying for when updates are tested before they go live and you can see proof the work was done.

The schedule below shows what a complete plan covers and how often each task should happen.

Automated backups run every day, stored away from the site so a server failure does not take them too. Uptime monitoring checks the site around the clock and alerts someone when it stops responding. Malware scanning looks for injected code, suspicious files and known bad plugin versions, so a hack is caught early rather than reported by a visitor.

Plugin and theme updates should be tested on a staging environment before they reach the live site, and the plan should state how a bad update is rolled back. After updates, someone checks that contact forms still send and, on a WooCommerce store, that a test order gets through checkout.

WordPress core updates are the baseline every plan must cover, and they follow the same staging-first rule. Each month also brings a performance check against Core Web Vitals, a broken link scan, and a monthly report that lists what was updated, backed up, scanned and fixed.

A backup that has never been restored is unverified, so a quarterly restore drill should prove the backups actually work. The quarterly list also includes a PHP version review, since outdated PHP can hold back newer plugin versions, and a user and access audit that removes old accounts and checks admin roles.

Managed WordPress hosting looks after the server and the software it runs on. A care plan looks after what runs on that server: core, plugins, themes, testing and reporting. Some overlap, such as backups and PHP versions, is normal. Ask each provider which tasks they own so nothing falls between them.

Ask for plugin, theme and WordPress core updates to be tested on a staging environment, a private copy of your site, before they reach the live site. The contract should also say how a bad update is rolled back, who does it and how quickly, so a failed update never becomes your problem to untangle.

If a plugin or WordPress core update the provider applied breaks your site, who pays for the fix? Get the answer in writing. A good plan covers repairs caused by its own updates at no extra charge. A weak one bills the fix as extra development hours, which turns routine upkeep into a surprise invoice.

A service level agreement (SLA) should name response times in hours, not promise help soon. Ask for separate times for downtime and for hacked-site cleanup after a malware scan finds something. Check whether those hours run around the clock or only during business hours, and whether weekends and holidays count.

A backup that has never been restored is unverified. Ask how often the provider actually restores a backup, ideally to a staging copy, to prove it works from start to finish. Ask to see the result of the last drill. If the answer is never, treat the backups as a hope rather than a safety net.

Find out where backups are stored, and whether that is somewhere other than the server your site runs on. Get the retention period in writing, meaning how far back you can restore. Most important, confirm you can download backups yourself at any time, without waiting on the provider.

Cancellation terms should state the notice period and promise a handover of backups, admin logins and any accounts set up for your site. Confirm in writing that your site, content and data belong to you. Then pin down the reporting cadence and what each report must list, so you can check the work.

If your site has few plugins and you can spare a few hours monthly, run the schedule above yourself with a management tool. Your action this week: set up automated backups, then do your first plugin update round. Test each update on a staging copy before it reaches the live site, and note how you would roll it back.

Get quotes from several providers and score each against the written-terms checklist: staging-tested updates, break-fix liability, a response-time SLA, restore drills and cancellation terms. Hire a freelancer when you have one site and want a direct contact. Choose an agency when you need SLA-backed coverage. Your action: send the checklist with every quote request.

Build your tiers around the same checklist your clients will use. Price by human hours and risk: WooCommerce stores and tighter SLA terms take more work to cover. Make the monthly report the visible deliverable, with versions before and after, backup dates and incidents. Your action: draft a report template this week.

Agencies and freelancers who run the work themselves can manage plugin updates across many sites from one Zeebrar dashboard. Zeebrar blocks versions VirusTotal flagged as malicious, and if an update makes the site return an error, the connector restores the active plugin's old version. Bulk updates come with the Pro and Agency plans.