Most WordPress sites are not neglected deliberately. They are neglected gradually — one update skipped, one backup that “probably ran,” one security scan that got moved to next week. By the time something breaks, the site has been drifting for months.
This guide covers what WordPress maintenance actually involves, the realistic frequency for each task, the tools that handle them reliably, and the specific things that go wrong when they are skipped.
What WordPress maintenance services actually include
A maintenance service covers seven distinct task categories. Most providers offer some combination; what matters is which ones and at what frequency.
Plugin, theme, and core updates. WordPress core releases security patches on a roughly monthly cadence. Plugins ship updates more frequently — sometimes several times a week. The risk is not in updating; it is in updating without reading changelogs and without a backup taken immediately before. A plugin update that introduces a PHP fatal error takes a site offline in seconds. See how to update WordPress plugins safely for the right sequence.
Automated backups with off-server storage. A backup stored on the same server as the site is not a backup — it disappears with the server. WPVivid and UpdraftPlus both support scheduled backups to remote storage (Google Drive, Amazon S3, Dropbox) and are the two tools I use for client sites. WPVivid’s staging-to-production workflow is cleaner; UpdraftPlus has broader storage integrations. Daily backups for the first month after launch, then weekly for stable sites that do not publish frequently.
Security scanning and malware removal. Wordfence Free runs signature-based malware scans and firewall rules. Sucuri handles the same job and also offers a CDN-level WAF on paid plans that blocks traffic before it reaches WordPress. Running both is not necessary — pick one and run weekly scans. What matters is that someone checks the scan results, not just that the scan runs.
Uptime monitoring. UptimeRobot’s free tier checks your site every five minutes and emails when it goes down. Pingdom’s paid plans give you more granular data and SMS alerts. Most managed care plans include uptime monitoring as a standard inclusion. A site that goes down at 2 AM and comes back up by 9 AM may not be noticed by the owner — the monitor catches it.
Database cleanup. WordPress accumulates post revisions, trashed posts, spam comments, transients, and session data over time. On a site that’s been running for two or more years without cleanup, the database can be three to five times larger than it needs to be. WP-Optimize or Advanced Database Cleaner handle this safely; neither deletes anything you cannot recreate. Monthly database cleanup is reasonable for active sites.
Performance checks. A site that scored 88 on PageSpeed Insights at launch can drop to 62 six months later as plugins add scripts, images get uploaded without compression, and hosting configurations drift. Monthly PageSpeed Insights checks flag when this is happening before users start bouncing. If the score drops, the WordPress performance guide covers what to investigate first.
Broken link monitoring. Internal and external links break over time — pages get deleted, slugs change, external sites move. Broken Link Checker (installed as a plugin or run via WP-CLI) flags these. For high-traffic sites, fixing broken internal links also preserves crawl equity.
Maintenance frequency: what runs when
The right frequency depends on how actively the site publishes and how much traffic it handles, but this is a reasonable baseline for a business site that is not publishing new content daily:
Daily: Automated backup (remote storage), uptime monitoring (every 5 minutes), Wordfence firewall (continuous).
Weekly: Plugin updates reviewed and applied, malware scan checked, backup verified.
Monthly: WordPress core update, PHP version check, PageSpeed Insights baseline, database cleanup, broken link audit, Google Search Console coverage review.
Quarterly: Full site audit — user accounts, inactive plugins, theme files, staging environment sync, SSL certificate expiry check, analytics review.
Updates: the right order matters
The most common cause of a site going down during maintenance is updating in the wrong order or without a backup. The sequence that avoids most problems:
First, take a manual WPVivid backup and confirm it completes. Then update plugins one at a time, checking the site after each one — not all at once. Then update themes. Update WordPress core last. If anything breaks, restore from the backup you just took rather than trying to debug a production site while it is broken.
The reason for doing core last is that plugin compatibility issues with a new WordPress version are more common than plugin-to-plugin conflicts, and going to a new core version on a site where all plugins are already current narrows down what caused a problem if one occurs.
PHP version is separate from WordPress updates. If your hosting control panel shows PHP 7.4 and your plugins have flagged PHP 8.x compatibility, that is a migration project, not a one-click update. PHP version changes on a live site without testing on staging first is how sites break in ways that a WordPress rollback cannot fix. If you need help moving from PHP 7.4 to 8.2 or 8.3, that is part of what a maintenance care plan covers.
Backups: what actually works
Three things make a backup reliable rather than theoretical:
Off-server storage. Backups stored in wp-content/backups on the same server are gone if the server is compromised or the hosting account is suspended. Google Drive, Dropbox, or Amazon S3 are standard choices. WPVivid and UpdraftPlus both support all three on their free tiers.
Verified restores. A backup you have never tested is not a backup. Every quarter, restore to a staging environment to confirm the restore process actually works. This is the step most DIY backup setups skip — and the one that matters most when something goes wrong.
Pre-update snapshots. The automated daily backup schedule is not a substitute for a manual backup immediately before a major plugin update or PHP version change. The automated backup might be 23 hours old by the time you update. Take a fresh one right before any significant change.
Security: beyond the initial setup
The security hardening most guides describe — install Wordfence, enable HTTPS, change the admin username — is the setup phase, not maintenance. Ongoing security maintenance is different.
Weekly scan results need to be read, not just confirmed as “completed.” Wordfence will flag modified core files, suspicious new users, and known-vulnerable plugin versions — but only if someone is reviewing the report rather than dismissing the notification email.
Login attempts should be monitored monthly. A site receiving 500 failed login attempts per day is being targeted; the answer is to move the login URL (WPS Hide Login), implement two-factor authentication, or both. Wordfence’s brute-force protection handles rate limiting, but it does not alert you to the pattern unless you look at the blocked IP log.
User accounts accumulate. Former employees, contractors from a previous project, and test accounts all remain as active WordPress users until someone deletes them. A quarterly user audit — deleting any account that has not logged in for six months and has no assigned content — is a routine security hygiene step most sites skip.
For a deeper look at the specific attack vectors hitting WordPress sites today, securing WordPress from modern threats covers credential stuffing, plugin supply-chain attacks, and XML-RPC exploitation in more depth. If you are already dealing with a compromised site, emergency rescue is available with same-day response.
Performance maintenance: it degrades by default
A site’s performance does not stay constant. It degrades as plugins add scripts, the database grows, images accumulate without compression, and hosting configurations change. The PageSpeed score you had at launch is not the score you have 18 months later without active maintenance.
Caching is the single highest-impact performance task. WP Rocket, LiteSpeed Cache, and W3 Total Cache all need periodic configuration review — hosting changes, new plugins, and theme updates can invalidate cache rules or add excluded URLs that accumulate over time. See the WP Rocket vs LiteSpeed Cache comparison for how they handle these cases differently.
Image management is the second. Every image uploaded to the media library should be converted to WebP and compressed before serving. Smush, ShortPixel, and Imagify automate this for new uploads — but the existing media library on a site that launched before the plugin was installed may contain years of uncompressed originals. A media library audit is a one-time task that can significantly reduce page weight.
Database size affects query performance directly. On a site with 500 published posts and two years of revision history, the wp_posts table may contain 15,000+ rows for 500 actual posts. Limiting revisions (define(‘WP_POST_REVISIONS’, 5) in wp-config.php) and running monthly cleanup prevents this from compounding. For sites already in this state, speed optimisation includes a database audit and cleanup as part of the engagement.
What WordPress maintenance does not include
Being clear on scope prevents mismatches between what a maintenance service provides and what a site owner expects.
Maintenance covers keeping existing functionality working correctly. It does not include building new features, redesigning pages, creating new content, or migrating to a different hosting provider. Those are project-based engagements, quoted separately.
Maintenance also does not cover recovering from neglect that predates the service start. A site that has not been updated in two years and is running PHP 7.4, WordPress 5.9, and plugins with 40 pending updates requires a remediation project first — getting the site current before ongoing maintenance can begin.
DIY maintenance vs. a managed care plan
DIY maintenance is viable if you are willing to do the following consistently: review plugin changelogs before updating, verify backup jobs complete each week, check scan results rather than dismiss them, run monthly database cleanup, and look at Search Console coverage at least once a month.
Where DIY breaks down is consistency. A week of travel, a busy quarter, or a team change means updates get skipped and backups go unchecked. The sites I inherit with the most serious problems are not the ones where the owner tried to manage maintenance and did it wrong — they are the ones where the maintenance routine simply stopped.
A WordPress maintenance care plan removes the consistency problem. Updates run on a schedule, backups are verified rather than assumed, scan results are reviewed, and the monthly GSC check happens regardless of how busy the rest of the month was. For most business sites, the cost of a care plan is less than one hour of emergency rescue work — and the emergencies become rare rather than periodic.
If you are setting up a new site and want to start maintenance on the right foot from day one, the post-launch checklist covers the first 48 hours and the first 30 days.
