What WordPress maintenance actually includes

WordPress maintenance is the routine work that keeps a WordPress website secure, working and recoverable after launch. It covers software updates, backups, security checks, monitoring, performance and small repairs. This article explains what each part is and why it exists. For the step-by-step version, see the monthly WordPress maintenance checklist.

Why a WordPress site needs maintenance

A WordPress site is not one piece of software. It is WordPress itself, a theme, a set of plugins, the PHP language they all run on, a database and a server. Each part is written by different people and released on its own schedule.

That has two consequences. Security fixes arrive all the time and only help once they are installed. And any change to one part can affect another, so a site that worked last month can break after an update nobody tested.

WordPress.org is direct about the first point: only the latest version of WordPress is officially supported. Maintenance is how a site stays on supported software without breaking along the way.

The seven parts of WordPress maintenance

1. Software updates

Updates cover four layers:

• WordPress core. Minor and security releases install themselves in the background on most sites. Major releases need someone to start them.
• Plugins. These change most often. Automatic plugin updates exist but are off until an administrator switches them on for each plugin.
• The theme. This includes any parent theme or page builder the design depends on.
• PHP. This is set on the server, not in the WordPress dashboard, and each PHP version is supported for a limited time.

The work is not only clicking Update. It is taking a backup first, applying the update, and then checking the site still does what it should. How often to do this is covered in how often WordPress should be updated.

2. Backups

A backup is a copy of the site's files and database that can be restored if an update fails, a server dies or the site is hacked. Good backup practice has three properties:

• It runs on a schedule that matches how often the site changes.
• At least one copy is stored away from the web server.
• Someone has restored from it, so it is known to work.

The third point is the one most often skipped. A backup that has never been restored is a hope, not a plan.

3. Security

Security work reduces the chance of a break-in and shortens the time it takes to notice one. WordPress's own hardening guide recommends strong unique passwords, two-factor authentication, installing plugins and themes only from trusted sources, deleting the ones that are not used, and monitoring files for unexpected changes.

In practice this means reviewing who has an administrator account, scanning for malware and known vulnerabilities, and removing anything that no longer needs to be there.

4. Uptime and error monitoring

Monitoring means a tool checks the site at regular intervals and alerts a person when it stops responding or starts returning errors. Without it, the first person to notice an outage is usually a customer.

5. Performance

Sites slow down over time. Images get uploaded at full size, plugins are added, the database collects old revisions and expired data. Maintenance includes measuring load time now and then and dealing with the cause when it slips. The common causes are covered in why a WordPress site is slow.

6. Functional checks

A site can be online and still be broken. The contact form can stop sending email. A booking widget can fail quietly after an update. Maintenance includes testing the things that produce enquiries and sales: forms, booking or checkout steps, search, and the tracking that reports them.

7. Housekeeping and small fixes

This is the remainder: renewing the domain and SSL certificate on time, clearing spam, fixing broken links, removing old user accounts, and repairing small faults before they become large ones.

What maintenance does not include

Maintenance keeps the existing site healthy. It normally does not cover:

• New pages, features or design changes
• Writing or loading content
• SEO or advertising work
• Rebuilding a site that has reached the end of its useful life

These are separate pieces of work, even when the same person does them.

Hosting is not maintenance

Hosting is the server the site lives on. Some hosts add backups or automatic updates, and some do not. Nobody at a hosting company is checking whether your enquiry form still works after a plugin update. Read what a plan covers and assume nothing beyond it. The difference is set out in care plan vs hosting only.

Who does the work

There are three usual options:

1. Do it yourself. This is realistic for a simple site if someone has time each month and is comfortable restoring a backup.
2. Rely on the host. This suits sites where an outage of a day would not matter much.
3. Use a care plan. A named person is responsible for the whole list, including testing.

Stryx offers three care plans: Hosting, Premium and Pro. The Hosting plan does not include monitoring or malware scans, so it suits owners who will handle those themselves. All plans run month to month with 30 days' written notice. Details are on the WordPress maintenance page, or get in touch to talk through what your site needs.