What “website maintenance” actually includes, and why an untended site breaks

A website that nobody maintains does not stay the same; it degrades. WordPress, its plugins, its theme and the PHP it runs on all release updates continuously, most of them fixing security holes that have just been made public. A site that misses them is running software with known, documented ways in, and automated attacks scan for exactly those. “Maintenance” is the work of keeping the site current, backed up, monitored and small-change-ready so that it keeps doing its job. Here is what that actually involves, and how to tell a real care plan from a hosting add-on with the same name.

What changes underneath your site

WordPress core releases several updates a year. A typical business site has fifteen to thirty plugins, each updating on its own schedule — dozens of updates a month in total. The theme updates. PHP, the language underneath, retires old versions and hosts eventually force the move. Any of these can, occasionally, break something on your particular site, which is why “just turn on auto-updates” is not the whole answer either.

What a real care plan does

Updates, tested. Core, plugins and theme updated regularly — ideally on a staging copy first so that a broken update is caught before your customers see it.

Backups that are actually tested. Off-site, so a hacked or failed server does not take the backup with it; frequent enough that you would not lose a week of orders; and restored once in a while to prove they work. A backup nobody has ever restored is a hope, not a backup.

Monitoring. Uptime, so you know before your customers do. Malware scanning, so a compromise is caught in hours rather than found by Google months later. Ideally Search Console too, so a sudden fall in indexed pages is noticed.

Security hardening. Login protection, strong passwords enforced, two-factor authentication, unused accounts removed, file permissions right.

Small changes. The price update, the new team member, the seasonal banner. Included hours mean these happen the same day instead of joining a list.

A report. What was updated, what was backed up, what was blocked, what changed. Short, monthly, so you know someone was there.

How to spot a plan that is not one

If it does not mention backups being off-site or tested, ask. If updates are “automatic” with no staging and no human checking afterwards, that is not a care plan; it is a setting. If there is no report, you have no evidence anything is happening. And if the price is suspiciously low, the work is probably a script.

Do you need one?

Not from us, necessarily. If you have a developer in-house who does all of the above, you are covered. If you are a builder-platform site, the platform does most of it. But if you have a WordPress site and nobody has a named responsibility for it, then the work is not being done, and the site is quietly becoming the next cleanup.

What ours cost

Our care plans start at $99 a month for updates, weekly off-site backups, uptime monitoring, malware scanning and a monthly report. The Standard plan at $199 adds daily backups, two hours of content changes a month, performance tuning and next-business-day response. Priority at $399 adds five hours, same-day response, a staging site, SEO and Search Console monitoring and a monthly call. All are monthly, cancel with 30 days’ notice.