WordPress website maintenance: what it includes and what it costs

A WordPress site is never finished. The core, the theme and every plugin keep receiving updates, many of them security fixes, and the server underneath changes too. A site that nobody looks after keeps working for a while, then breaks at the worst moment: an expired certificate before a campaign, a plugin conflict after an automatic update, or an infection discovered by a customer. This article explains what WordPress maintenance actually involves, what you can do yourself, what a care plan should include, and what we charge for it.

For the general picture of life after launch, beyond WordPress, see website maintenance after launch.

#Updates: the core, the theme and the plugins

WordPress can update itself. Since version 5.5 you can switch on automatic updates plugin by plugin and theme by theme, and WordPress then checks twice a day and emails you after each attempt. It relies on WordPress's scheduled tasks (WP-Cron), so on a quiet site or a misconfigured server the updates may not run at all; Tools, Site Health shows whether they do.

Automatic updates are better than none, but they have a weakness: nobody checks the site afterwards. A plugin update that breaks the contact form or the checkout goes unnoticed until a customer complains. That is the main difference between "auto-updates on" and real care: someone updates on a schedule, looks at the site afterwards, and can roll back.

The server side matters too. PHP 8.2 stops receiving security fixes on 31 December 2026, so many sites need to move to a newer PHP version this year. Old themes and abandoned plugins are what usually makes that move hard; we discuss the choice in repair the old website or build a new one.

#Backups you can actually restore

A backup is worth only as much as the last successful restore. Three rules cover most of it:

• Daily, automatic. Files and database, every day, without anyone pressing a button.
• Off the server. A backup on the same server disappears with the server, or gets encrypted together with the site.
• Tested. Restore a backup to a copy of the site from time to time and check that it opens. The first restore should never be during an emergency.

#Monitoring: uptime and certificates

Uptime monitoring checks the site every few minutes and alerts someone when it stops answering. Certificate monitoring watches the expiry date of the HTTPS certificate.

Certificates matter more every year. Under the CA/Browser Forum's ballot SC-081, publicly trusted certificates issued from 15 March 2026 last at most 200 days, from 15 March 2027 at most 100 days, and from 15 March 2029 at most 47 days. Let's Encrypt certificates already last 90 days. Renewal has to be automatic, and someone has to notice when the automation fails.

#Security beyond updates

• Remove plugins and themes you do not use; an inactive plugin can still be attacked.
• Give each person their own admin account, with a strong password and two-factor login, and remove accounts of people who left.
• Limit login attempts and keep file editing in the admin switched off.
• Scan for known malware, and know who cleans up if something is found.

#Small changes

New prices, a holiday notice, a new team member, a changed address. Every business needs small changes, and a care plan with a few included hours a month is usually cheaper and faster than ordering each change separately. Ask how quickly changes are made and whether unused time rolls over.

#What you can do yourself

If your site is small and you are comfortable in the admin, you can cover a lot yourself: switch on automatic updates for well-maintained plugins, use your host's daily backups and copy one off the server every month, sign up for a free uptime monitor, and check the contact form after each update. What is hard to do yourself is the testing: updates on a copy first, restore tests, and the checkout on a shop.

#What our care costs

Our monthly care has two levels, with a minimum of 3 months:

• Care Start, €39 a month: core, theme and plugin updates every week, daily backups kept off the server for 30 days, uptime and SSL expiry monitoring, 30 minutes of changes a month, a reply within 2 working days and a monthly email report.
• Care Business, €79 a month: everything in Care Start, plus updates tested on a copy first for shops, a monthly restore test and a checkout check, 2 hours of changes a month, a reply the next working day, and a quarterly speed check.

Care is paid quarterly in advance, €117 or €237 a quarter, and unused time does not roll over. Work beyond the included time costs €35 an hour, agreed in writing before it starts. PN Scripts is not registered for VAT, so no VAT is added. If the site needs repair before care makes sense, start with the site rescue and speed fix, or with the free website check if you are not sure. All packages are on our services page.

#Frequently asked questions

Is turning on automatic updates enough?

It is much better than nothing, but nobody checks the site after the update, and WP-Cron does not always run them. For a site that brings customers, combine automatic updates with someone who looks at the site afterwards and can roll back.

How often should a WordPress site be backed up?

For most small-business sites, daily is enough; a busy shop may need more frequent database backups. Keep copies off the server and test a restore from time to time.

Does care include hosting?

Not with us. The hosting and the domain stay in your name and are paid to your provider; care covers the site that runs on them.

Can I stop care later?

Yes, after the 3-month minimum. The site, the backups and the accounts are yours, so nothing is held back when you leave.

#Sources

• WordPress: plugin and theme auto-updates
• CA/Browser Forum: ballot SC-081v3
• Let's Encrypt: FAQ
• PHP: supported versions