Web maintenance is the ongoing work of keeping a live website secure, up to date, backed up and fast after it launches. For a WordPress site, that means updating WordPress itself along with its plugins and theme, taking regular backups, watching for security problems, and checking that pages still load quickly and forms still send.
This guide is for business owners who have a WordPress website and are not sure what looking after it involves. It covers the tasks, how often each one should happen, what goes wrong when they are skipped, and a monthly routine you can follow yourself. I run WordPress care plans and clean up hacked sites, so the examples come from that work.
Is site maintenance the same thing?
Yes. People ask “what is site maintenance” and “what is website maintenance” as well as “what is web maintenance”, and all three mean the same work. The name changes. The tasks do not.
What web maintenance includes
The table below shows the main tasks and a sensible schedule for a typical small business site. The weekly updates, daily backups, security monitoring and monthly performance check match what my care plans include. The other frequencies are suggestions.
| Task | How often | Why it matters |
|---|---|---|
| Plugin and theme updates | Weekly | Updates fix security holes that attackers already know about. |
| WordPress core updates | When released, checked weekly | Core security releases are the first line of defence. |
| Full backup stored off the server | Daily | If the server fails or the site is hacked, a backup is the quickest way back. |
| Security monitoring and malware scan | Continuous monitoring, regular scans | Catches new admin users, changed files and injected spam early. |
| Speed check | Monthly | Sites slow down as images and plugins pile up. |
| Contact form test | Monthly | Forms can stop sending without any visible error. |
| Broken link check | Monthly | Dead links frustrate visitors and waste their time. |
| Remove unused plugins and users | Every few months | Anything installed but unused is still a way in. |
| PHP version check | Yearly, or when your host warns you | Old PHP versions stop getting security fixes. |
Why WordPress sites need regular maintenance
WordPress is safe when it is kept up to date. The official WordPress hardening guide says you should always keep up to date with the latest version of WordPress (Hardening WordPress). Most sites also run a dozen or more plugins, written by different developers and updated on different schedules. Each one that falls behind is a possible way in.
A site that nobody maintains does not break on day one. It breaks slowly. A plugin stops working with a newer version of PHP. A form quietly stops sending. Then one day the site gets hacked through a plugin that had a fix available for months.
What happens when maintenance is skipped
I have cleaned dozens of hacked WordPress sites. The same problems come up again and again:
- Injected spam pages, often casino or pharmacy links, showing up in Google under the business name.
- Admin accounts the owner never created.
- Backdoor files that let the attacker back in after a basic cleanup.
- Redirects that send mobile visitors to scam sites while the owner’s desktop looks normal.
- A red warning screen in the browser, or a “This site may be hacked” label in search results.
Google Search Console has a Security issues report that shows when Google has detected hacked content or malware on your site. If you only check one thing each month, check that.
A monthly maintenance routine you can do yourself
If you want to handle maintenance in-house, this routine takes around an hour a month for a small site. Do the steps in order.
- Take a full backup and download a copy to your own computer. The WordPress documentation explains the options (WordPress Backups).
- Update plugins one at a time, loading the homepage after each one so you know which update caused a problem if something breaks.
- Update the theme, then WordPress core.
- Open the site on your phone and click through the main pages.
- Fill in and send your own contact form.
- Check the Security issues report in Search Console.
- Go to Users in the WordPress dashboard and remove any account you do not recognise.
- Delete plugins you are not using. Deactivating them is not enough.
- Run your homepage through PageSpeed Insights and compare the score with last month.
What web maintenance costs
- Doing it yourself costs your time: around an hour a month, plus the time to fix anything an update breaks.
- My WordPress care plan is $59 a month per site, or $49 a month each for three or more sites. It covers weekly updates, daily backups, security monitoring, malware scanning, a monthly performance check and a monthly report. There is no contract.
- If a site is already hacked, my hacked site cleanup is $149 flat and includes a free month of the care plan.
Lee Starshine at NaturalEyeCare.com hired me for WordPress maintenance, plugin updates and backups. His review:
“He did a great job on the WordPress updates. A++++”
Lee Starshine, NaturalEyeCare.com, USA
Frequently asked questions
How often should a WordPress site be updated?
Check for updates at least once a week. Security releases for WordPress core should go on as soon as they come out. Plugin and theme updates can be grouped into one weekly session, after a backup.
Can updates break my site?
Occasionally. A plugin update can clash with your theme or another plugin. That is why the backup comes first and plugins get updated one at a time. With a fresh backup, a bad update takes minutes to undo.
Does a site that rarely changes still need maintenance?
Yes. Maintenance is mostly about the software underneath the content, not the content itself. A site that has not been edited in two years is usually the most out of date, and the most likely to be hacked.
Want someone else to handle it?
If you would rather not spend an hour a month on updates, I can look after your site for $59 a month, and the first month includes a free site audit. I work EST hours and reply within 24 hours. Call +1 (239) 799-3971 or send me a message.
