A proper WordPress maintenance plan includes tested updates, daily offsite backups that someone has restored, login protection and malware scanning, uptime and form monitoring, current PHP, a clear support allowance and a short plain report. Two plans can both say “updates, backups and security” on the sales page and be completely different products. One has a person testing your site after every update round and a backup stored somewhere other than your server. The other is an auto-update switch and a monthly invoice.
You can’t tell them apart from the headline. You can tell them apart by asking specific questions, and that’s what this checklist is for. Take it to any provider, including us.
The checklist
Each item has the question to ask. Vague answers are an answer too.
Updates
- WordPress core, plugins and theme are updated on a set schedule. Ask: how often, and who does it?
- Updates are tested, not just applied. Ask: after updating, does someone check the homepage, the key pages, the forms and the checkout? Or is it fully automatic?
- Risky updates are handled differently. Major version jumps (a big Elementor or WooCommerce release, a PHP upgrade) should be done on a staging copy first. Ask: do you use staging for major updates?
- Security patches go on quickly. When a plugin has a known vulnerability, waiting for the monthly round isn’t good enough. Ask: what happens when an urgent security fix comes out mid-month?
WordPress has built-in automatic updates for plugins and themes, and they’re useful for small, low-risk plugins. But auto-updates with nobody checking afterwards is how sites end up broken for a fortnight before the owner notices.
Backups
- Daily backups at minimum, more often for shops or sites that take bookings.
- Stored off the server. A backup on the same server as the site disappears with the site. Ask: where are backups kept?
- Kept long enough. Ask: how far back can you restore? Some problems (a hack, a deleted page) aren’t noticed for weeks. Thirty days is a sensible minimum.
- Restores are tested. A backup nobody has ever restored is a hope, not a backup. Ask: when did you last test a restore?
- Restoring is included. Ask: if I need a restore, is that part of the plan or billed separately?
Security
- A firewall and malware scanning, either at server level or through a security plugin.
- Login protection: limited login attempts, two-factor authentication for admin users.
- Unused plugins, themes and old admin accounts removed. Ask: do you clean up what isn’t being used?
- Hack clean-up included, or clearly priced. Ask: if the site is hacked while on your plan, who fixes it and what does it cost?
Monitoring
- Uptime monitoring that alerts a person, not just a dashboard nobody opens.
- Form testing. Contact forms fail quietly after updates or email changes. Someone should send a test submission regularly.
- SSL certificate and domain renewal tracking. Expired certificates and lapsed domains take sites offline more often than hackers do, in our experience.
- Basic speed checks, so a slow plugin or full disk is caught early.
Hosting and email
- Clear about who hosts the site. Ask: is hosting included, and on what kind of server?
- PHP version kept current. Old PHP versions stop getting security fixes. Ask: what PHP version is my site on?
- Site emails actually send. Form notifications and order emails should go through a proper SMTP or transactional email service.
Support and reporting
- Small content changes included, or a clear rate for them. Ask: how many minutes of changes a month, and do unused minutes roll over?
- A response time you can rely on. Ask: if the site goes down at 4pm on a Friday, what happens?
- A monthly or quarterly report showing what was updated, backups, uptime and anything that needed attention. Not a 20-page PDF of graphs. One page that tells you the site is healthy, or what isn’t.
Ownership
- You own your domain, hosting account and website files, and you’d get full admin access if you left. Ask: if I cancel, what do I get and how long does handover take?
Red flags in cheap plans
Not every inexpensive plan is bad. A small brochure site with a handful of plugins doesn’t need much. But these are the patterns that suggest you’re paying for very little:
“Unlimited” everything for a tiny monthly fee. Unlimited edits, unlimited support, unlimited restores. Nobody can deliver that profitably, so something isn’t happening.
No mention of testing. If the plan says “we update your plugins” and nothing about checking the site afterwards, assume nobody is checking.
Backups only on the same server. Or “your host does backups” with no detail about how long they’re kept or how you’d restore one.
Hack clean-up excluded. The one time you most need help, it’s a separate invoice. Read the fine print on this before anything else.
No access to your own site. Some providers lock you out of the WordPress admin “for security”. Sometimes that’s genuine. Often it’s about making it harder to leave.
Locked-in contracts with exit fees. A maintenance plan should earn its keep month to month.
Reports that are all automated graphs. A wall of green ticks generated by software doesn’t tell you a person looked at anything.
The provider can’t tell you which plugins your site uses. If they don’t know what’s installed, they aren’t really maintaining it.
What it’s reasonable to expect
A maintenance plan isn’t magic. It won’t make your site rank higher, it won’t write content for you, and it won’t fix a site that was badly built in the first place. What it should do is keep a working site working, catch problems before customers do, and make sure that when something does go wrong, it can be put back quickly.
If terms like staging, PHP or SMTP above lost you, our WordPress glossary explains them in plain English. And if you’re weighing up whether maintenance is worth paying for at all, our piece on what website maintenance involves and what it’s worth covers the cost side.
Run your current plan through the checklist this week. Count how many of the “Ask” questions your provider can answer clearly. If it’s fewer than half, it’s time for a different conversation.
We host and look after websites for more than 100 clients. Hosting is $25 a month + GST and care plans start from $79 a month + GST, and our hosting and care plans page sets out what each includes. Our website ownership page explains how you keep control of your site, or ask us for a free review of your current setup.