WordPress Maintenance Plans

Why WordPress sites need ongoing maintenance

A WordPress site isn't something you build once and forget. It runs on WordPress core, a theme, and usually a dozen or more plugins, and each one is updated by a different developer on a different schedule. When those updates pile up, outdated plugins become the easiest way for attackers to get in. Most hacked WordPress sites I've cleaned up weren't targeted. They were found by automated bots scanning for a known vulnerability that a simple update would have fixed.

Skipping updates isn't safe either. Running them blindly on a live site can break a layout, a contact form, or a checkout page, and you may not notice until a customer tells you. Over time sites also slow down as the database fills with revisions, spam, and leftover plugin data. Backups quietly stop running or get stored on the same server they're meant to protect.

Here's a recent example. A client's site went down because bots were hammering it until the database server ran out of memory and crashed. I traced the traffic, blocked the attack at the server and firewall level, tuned the database, and moved the site behind Cloudflare. It's been stable since. With monitoring in place, that kind of problem gets caught in minutes instead of when leads stop coming in. That's what maintenance is for: small, regular care so you never face a big, expensive emergency.

What's included

• Core, theme & plugin updates: Applied on a regular schedule (twice a month or weekly, depending on your plan). Major updates are tested on a staging copy first, and I check the live site visually after every update round.
• Backups: Automatic off-site backups of files and database, stored in separate cloud storage (never only on your server). I keep 30 days of backups and do a full backup right before any update.
• Uptime monitoring: Your site is checked every 5 minutes. If it goes down, I'm alerted right away and start working on it within your plan's response time.
• Security hardening & malware scanning: Firewall and login protection, daily malware scans, hardened configuration and file permissions, security headers, and blocking abusive traffic.
• Performance checks: Monthly Core Web Vitals review, caching setup and tuning, image optimization checks, and database cleanup (revisions, spam, transients, orphaned plugin data).
• Monthly report: A plain-English summary of what was updated, backup status, uptime, security scan results, and page speed, plus anything I think you should know about.
• Small content edits: Text changes, image swaps, adding a blog post or team member. Time included depends on your plan (see below).

Plans & pricing

Simple monthly plans for small businesses. No long contracts, no surprise invoices.

Need more hours or something custom? Extra work is billed at $75/hr.

How it works

1. Free site audit call. We talk through your site and your goals. I run a quick health check (plugins, security, speed, backups) and tell you what I find, whether or not you sign up.
2. Onboarding & setup. I get secure access, take a full backup, fix any urgent issues, and set up monitoring, backups, and security tools. This usually takes a few days.
3. Ongoing monthly care. Updates, backups, scans, and performance checks run on schedule, and you get a clear report each month.
4. Help when you need it. Something broken or need a quick change? Email me and it's handled within your plan's response time, by the same person every time.

Frequently asked questions