Guide · Maintenance · 4 min read
WordPress maintenance: what a good contract should include
In short: a good maintenance contract states in black and white what is done, how often and how fast. At the very least: updates tested before being applied, backups stored away from the server, security and uptime monitoring, a response time in case of failure, and accounts that stay in your name.
Why a WordPress site needs maintenance
WordPress, its plugins, its theme and PHP, the language that runs it, regularly publish updates, many of which fix security holes. A website nobody looks after falls behind: little by little, it can slow down, drop in Google, or even get hacked.
Maintenance prevents this. But not all offers are equal, and the difference shows in the contract.
What the contract should include
| Item | What the contract should state | The question to ask |
|---|---|---|
| Updates | WordPress, plugins, theme and PHP version, tested on a copy before being applied | “What happens if an update breaks the site?” |
| Backups | How often, how long they are kept, stored away from the server | “When did you last test a restore?” |
| Security | Monitoring, fixing vulnerabilities, and cleaning up after a hack: included or not | “Is cleaning up after a hack included?” |
| Uptime | Monitoring the site and alerts in case of an outage | “Who is warned, and how quickly?” |
| Response times | Time to reply and to restore service, days and hours covered | “What about weekends?” |
| Small changes | Time included each month, or their separate price | “Is changing a text or an image included?” |
| Report | What was done, what needs planning | “How often?” |
| Access and end of contract | All accounts stay in your name, and everything is handed back at the end | “What do I get back if the contract ends?” |
Warning signs before signing
A contract without details
“Monthly maintenance”, with no list of what is done: impossible to know what you are paying for, or to claim anything.
Backups on the same server
If the server fails or is hacked, the backups go down with it.
Updates applied directly to the live site
Without testing on a copy, an update that breaks the site is discovered by your visitors.
Accounts in the provider’s name
Domain name, hosting, licences: everything must stay in your name, so you can change provider without losing everything.
No exit clause
A good contract states how it ends, and what is handed back to you at that point.
No report
Without regular reporting, you never know whether the work is really done.
Maintenance and hosting: two different things
The host runs the server your website lives on. Maintenance looks after the website itself: its updates, backups and security. Some offers bundle both, others do not. Either way, check who does what, so that no task falls between the two.
The monthly report: what it should contain
A clear report is the best proof that maintenance is really being done. It fits on one page and contains:
- the updates applied, with the versions installed;
- the month’s backups, and the date of the last restore test;
- the security alerts received, and what was done about them;
- the site’s availability, with any outages and their duration;
- the speed measured on mobile;
- recommendations for the following month.
If your provider cannot give you this document, be wary.
Looking for someone to look after your website?
I review your website, bring it up to date, then look after it. You have a single point of contact for your whole site, and all your accounts stay in your name.
Let’s talk about your website See takeover and maintenance
Reply within one business day
Frequently asked questions
Aren’t WordPress’s automatic updates enough?
WordPress installs some security updates on its own, but not necessarily those of plugins and themes, and nobody checks afterwards that the site still works. Maintenance adds that check.
How often should updates be done?
Security fixes should be applied quickly. For the rest, a regular rhythm, weekly or monthly, avoids falling behind.
My host makes backups: is that enough?
It is a good start. Check how long they are kept, and whether they are stored somewhere other than the same server: an independent copy is safer.
Can I end the contract whenever I want?
It depends on the contract: check the commitment period, the notice period, and above all what is handed back to you at the end.
Does a small website really need maintenance?
Yes: a small site also needs updates and backups. The contract can simply be lighter.
How much does maintenance cost?
It depends on the size of the site, the number of plugins and what you want to include. I never quote without looking first. Describe your website: I will send you a clear, itemised quote. Reply within one business day.
Sources
Keep reading
My WordPress site has been hacked: what to do, and in what order?
What to do when your WordPress site has been hacked: the warning signs, the first 30 minutes, the 6 steps to recover, and the mistakes that bring the hack back.
Moving off WPBakery, Divi or Elementor: how to change your page builder
A slow site, pages that break without the plugin, a new version to adopt? The three options for moving off WPBakery, Divi or Elementor, and how to do it safely.
My WordPress developer has disappeared: how to take back control
What to do when your WordPress developer stops answering: check who owns what, secure the domain and hosting, and take back control of your site, step by step.