A WordPress maintenance service should include careful updates, off-site backups that can be restored, security monitoring, uptime checks, and help when something breaks. You should also get a plain-language report, a clear response time, and a named person who knows your site. If the offer stops at switching on auto-updates, keep looking.
That sounds like a lot to check before signing a monthly agreement. It isn’t. You’re buying someone to notice trouble, fix it, and tell you what happened - not a mysterious green tick in a dashboard.
What a WordPress maintenance service should include
Use this as your comparison sheet. A provider may package things differently, but you should be able to find a clear answer for each item:
- WordPress core, plugin, and theme updates, with a backup before and checks afterward.
- Off-site backups and a restore that has actually been tested.
- Uptime monitoring, plus malware and unexpected file-change monitoring.
- A clear answer on hacked-site cleanup: included, or priced upfront.
- A supported PHP version and regular reviews of unused or abandoned plugins.
- Checks of important pages, forms, and your checkout if you have one.
- Small content edits, with the scope of those edits explained.
- A monthly report in plain words, a named contact, and a stated response time.
That’s the shortlist. The useful details are in how a provider does the work, especially when an update causes trouble on a day you’re expecting orders.
Updates done by a person, not just auto-updates
Automatic updates can help. I wouldn’t pay someone each month just to flip that switch, though. A plugin can update successfully while a booking form quietly stops sending messages. The dashboard looks fine; your inbox doesn’t.
Ask what happens around an update. A sensible process takes a backup first, updates WordPress core, plugins, and themes, then checks the pages that matter to your business. For a shop, that includes adding an item to the basket and reaching checkout. For a service site, it might mean submitting an enquiry form and checking where the message lands.
They should also review plugins you no longer use and ones their developers have abandoned. And ask about PHP. It’s the software your site runs on at the server, and your provider should keep it on a supported version rather than leave it untouched for years.
Backups you can actually restore
A backup stored only on the same server as your website is a shaky safety net. If that server fails or gets compromised, your backup may go with it. Ask where copies are stored and whether the provider has tested restoring one.
That last bit matters more than a screenshot showing that backups ran. A restore test tells you whether the files and database can become a working site again. Also ask who handles the restore if an update breaks checkout. Do they fix it as part of maintenance, or hand you a backup file and wish you luck?
Security monitoring and hack cleanup
Security monitoring should look for malware and unexpected changes to site files. A provider should also know who has admin access. An old account belonging to a former contractor shouldn’t sit there indefinitely with the keys to your site.
Then ask the awkward question: what happens if the site is hacked anyway? Monitoring is useful, but it isn’t a promise that nothing will ever get through. Hacked site cleanup should either be included or have a clear price you can see before there’s a crisis. An expensive, undefined extra is a nasty surprise when your shop has stopped taking payments.
For more context on why these routine jobs matter, read our piece on why maintenance matters for business websites. The short version: the work is easier to judge by what gets checked than by how reassuring the plan name sounds.
Uptime, speed and checkout checks
Uptime monitoring tells someone when your site goes down. Ask who gets the alert and what they do next. An alert sent only to you at the moment you’re packing orders isn’t much of a maintenance service.
Speed deserves attention too, though I’d be wary of anyone promising a particular score without looking at the site. What you want is someone who notices if a new plugin makes key pages noticeably slower and investigates. If you sell online, a homepage that loads perfectly is no comfort when checkout fails. Ask whether they check the buying path after changes, not just the front page.
What a monthly report should show
You shouldn’t need to understand server logs to tell whether you’re getting what you pay for. A useful report says what was updated, whether backups ran and restores were tested, what monitoring found, and what the provider fixed or wants you to decide. In ordinary language. If a plugin needs replacing, the report should say which one and why.
It should also make it easy to ask a follow-up question. Who is your named contact? Do they know that your quote form goes to a shared mailbox, or will you have to explain your setup from scratch every time? We wrote a separate guide on how to tell whether your WordPress provider is actualy maintaining your site if your current reports leave you guessing.
Questions to ask before you sign
Send these in an email. Written answers are easier to compare than a friendly call you can barely remember later.
- What do you check after updates, and what happens if a form or checkout breaks?
- Where are backups kept, when was a restore last tested, and who performs a restore?
- Is hack cleanup included? If not, what will it cost?
- Who is my contact, what’s your response time, and how do I reach you when the site is down?
- Which small content edits are covered, who can access the admin area, and how do I leave the plan?
A provider doesn’t need a fancy answer to every question. They do need a specific one. “We’ll sort it out” isn’t a response-time policy.
Red flags
I’d walk away from a plan that amounts to “we turn on auto-updates” with no checks afterward. Same goes for backups kept only on your web server, no monthly report, or a provider who can’t tell you which people have admin access. Those aren’t minor paperwork gaps; they make it hard to know whether anyone can put things right.
Watch for vague hack-cleanup charges and long contract lock-ins, too. If a provider won’t explain what happens when you leave, ask yourself how comfortable you’ll feel handing over access now.
We’re a small WordPress security and maintenance agency in Estonia, working with small businesses and shops across the EU. Our plans start at 39€/month + VAT for a small site and 59€/month + VAT for a shop or medium site; every plan includes hacked-site cleanup. That’s one pricing example, not a benchmark for everyone.
If you want this done for you, you can compare the checklist with our WordPress maintenance service. Either way, ask a potential provider where your backups live and when they last tested a restore. Their answer will tell you plenty.