"WordPress maintenance" means different things with different providers — from "we hit Update once a month" to real care for security, speed and rankings. This checklist describes what good maintenance should include, so you can compare quotes on substance, not price.
Updates
- Updating the WordPress core, the theme and the plugins — regularly, not once every six months.
- A backup right before every update.
- Testing after — home page, forms, login, cart/checkout, key functions.
- Ideally: update on staging (a test copy) first, then live.
- Tracking abandoned plugins (no update in 6+ months) and a planned replacement.
Backups
- The 3-2-1 rule: 3 copies, on 2 media, at least 1 off the site's server.
- Daily backups of files and database; more frequent for active stores.
- Tested restore — a backup that has never been tried is not a backup.
- Enough history (e.g. 30 days) to catch a problem noticed late.
Security
- Login restrictions — attempt limits, hiding
/wp-admin, two-factor authentication for administrators. - Strong passwords and a user audit (removing old accounts).
- A WAF / firewall at the hosting or CDN level.
- Periodic scanning for malware and file changes.
- Correct file permissions, the file editor disabled in the admin panel.
- SSL certificate — monitoring for expiry and automatic renewal.
Performance
- Caching (pages and objects) and tuning after every major update.
- Image optimisation — compression and modern formats.
- A periodic review of Core Web Vitals and removal of slow or unnecessary scripts.
- Tracking database growth (revisions, transients, log tables).
Monitoring
- 24/7 uptime checks with an alert on an outage.
- Monitoring domain and SSL expiry.
- Checking for broken links and 404 errors.
- Alerts for critical PHP errors.
SEO hygiene
- A review of Google Search Console — indexing errors, manual actions, Core Web Vitals issues.
- A valid, submitted sitemap; checking which pages are indexed.
- Checking redirects after changes to the URL structure.
- Monitoring structured data for errors.
- On the active-SEO tiers — work on content and positions with a monthly report.
Change hours and reporting
- An agreed number of hours per month for content changes and small tasks.
- A clear rule for rolling over unused hours.
- A monthly report — what was done, the state of backups and security, positions and traffic (on an SEO tier).
- A response within a stated time; faster for an outage (the site is down).
What "cheap" maintenance skips
Packages at €10–20/month are usually just automatic plugin updates with no testing afterwards. Missing: a backup before an update, staging, a tested restore, real monitoring, a Search Console review, change hours and a person who responds. The difference shows up on the day an update breaks something — or the site gets hacked.
Summary
Good WordPress maintenance is not "hitting Update". It is updates with a backup and testing, backups by the 3-2-1 rule, security, performance, monitoring and SEO hygiene — plus change hours and a monthly report. See what our packages include in SEO and maintenance, and what it costs in the real cost of maintenance.
Get in touch for a free short audit of the current state.
