Website maintenance means daily off-site backups, uptime and security monitoring, plugin, theme and WordPress updates every week or two, monthly form and Search Console checks, and a yearly PHP upgrade and licence renewal. On a small brochure site that’s an hour or two of skilled work a month, and it’s worth paying for if a broken site would cost you enquiries.
A WordPress website is closer to a ute than a brochure. It runs on software that gets updated every few weeks, it sits on a server that gets updated underneath it, and it slowly falls apart if nobody looks under the bonnet.
We look after websites for more than 100 clients, and the difference between a maintained site and a forgotten one is rarely visible on the homepage. It shows up the day a form stops sending, a plugin conflict takes the site down, or Google flags it as unsafe.
Below is what each job involves, how often it needs doing, and how to work out whether paying someone is worth it for your business.
The jobs, by how often they need doing
Every day (automated)
- Backups. A full copy of the files and database, stored somewhere other than the server the site lives on. Daily is right for most small business sites. Online shops that take orders every day may need more frequent database backups.
- Uptime monitoring. A service checks the site every few minutes and alerts someone when it goes down. Without it, you find out when a customer tells you.
- Security scanning and firewall. Blocking bad login attempts and known attack patterns. This runs in the background but someone needs to read the alerts.
Every week or fortnight
- Plugin, theme and WordPress core updates. Most security problems we clean up come from an outdated plugin with a known hole. Updates should be done in a sensible order, with a backup taken first, and the site checked afterwards. Clicking “update all” on a Friday afternoon is how sites break over the weekend.
- Spam and form checks. Make sure the contact form still delivers to the right inbox and isn’t drowning in junk.
Every month
- A visual check of key pages on desktop and phone after updates, especially anything built with custom layouts.
- A test submission of every form. Email delivery breaks quietly. A test takes two minutes.
- A glance at Search Console for new errors, pages dropping out of the index, or security warnings.
- Small content changes. New staff photo, updated opening hours, a price change, a new service. These are the jobs owners put off, and stale content makes a site look abandoned.
Every year
- PHP version upgrade. PHP is the language WordPress runs on, and each version has an end date for security fixes. At the time of writing (late 2026), the official PHP supported versions page shows PHP 8.2 getting security fixes only until 31 December 2026, and WordPress recommends PHP 8.3 or newer. Upgrading needs testing, because older plugins sometimes break.
- Licence renewals for paid plugins such as Elementor Pro, backup tools and form add-ons. A lapsed licence often means no more updates, which means a growing security gap.
- Domain and SSL checks. Is the domain on auto-renew with a valid card? Is the security certificate renewing properly?
- Clean-up. Delete plugins nobody uses, old user accounts, and test pages from three years ago.
What happens to a site nobody touches for two years
We take over neglected sites regularly, and they tend to follow a pattern. It’s not dramatic at first.
Months 1 to 6. Nothing seems wrong. A handful of plugins have updates waiting. The owner doesn’t log in, so they never see the notices.
Months 6 to 12. One plugin has a published security vulnerability. The contact form plugin is two major versions behind. The host upgrades its servers and starts nagging about the PHP version. Spam submissions climb.
Months 12 to 24. This is where it goes sideways. Updating now means jumping several versions at once, which is far more likely to break the layout than small regular updates. Some plugins have been abandoned by their developers. The premium licence lapsed, so the page builder can’t be updated without paying again. If the host forces a PHP upgrade, the site may simply show a critical error.
And sometimes, somewhere in there, the site gets compromised. Spam links appear in the footer, visitors get redirected to dodgy pharmacies, or Google shows a warning in search results. Cleaning that up costs far more than the maintenance would have.
The worst part is that by month 24, a “quick update” often isn’t quick. We’ve had to tell owners that rebuilding would cost less than repairing, which is a hard conversation for everyone.
What maintenance doesn’t include
Be clear on this with whoever you hire, because it’s where expectations go wrong:
- New pages or features. Adding a booking system or a new service section is development work, not maintenance.
- SEO or marketing. Keeping the site healthy helps SEO, but it isn’t an SEO campaign.
- Fixing things you broke while editing. Usually fine for small mishaps, but repeated rebuilds of a page you’ve edited into a mess are a separate job.
- Email hosting problems. If your email is with Microsoft 365 or Google Workspace, that’s a separate system, even if the same person helps with it.
We go through line by line what belongs in a plan in what a WordPress maintenance plan should include.
Working out what it’s worth
Think about it in three ways.
Your time. Done properly, routine maintenance on a small brochure site takes an hour or two a month for someone who knows what they’re doing. For someone learning as they go, it takes longer and carries more risk. If your hourly rate as a business owner is higher than a developer’s, doing it yourself is a false saving.
The cost of the bad day. What does a week offline cost you in missed enquiries? What would a hack clean-up or emergency rebuild cost? For a tradie who gets most of their work through the website, a week with a broken quote form can wipe out a year of maintenance fees.
The cost of starting again. A site that’s maintained can run happily for five years or more. A neglected one often needs a rebuild in three. Our web design packages start from $3,000 + GST, so stretching the life of that investment by two years is real money.
Can you do it yourself?
Yes, if your site is simple and you’re methodical. You’ll need:
- Automated off-site backups, and a tested way to restore one.
- A habit of updating every week or two, never skipping months.
- A staging copy of the site, or at least a backup taken immediately before each update.
- Uptime monitoring that emails you.
- Admin access to everything, which is worth checking against our guide to who should own your domain, hosting and logins.
If any of those sound like a stretch, pay someone. If you’re paying someone and can’t name what they did last month, ask for a report.
The decision in front of you
Log in to your site today and look at the updates screen. If there are dozens waiting, or you can’t log in at all, you already know the answer. Our hosting and care plans cover the jobs above, with hosting at $25 a month and care plans from $79 a month (both + GST). If you’re not sure where your site stands, our website ownership page explains how to get a free review.