What Does WordPress Maintenance Actually Involve?
Most business owners paying a monthly maintenance fee could not tell you what it buys. Here is the real task list, how often each job needs doing, what breaks when it is skipped, and how long it takes if you decide to handle it yourself.
WordPress maintenance is a recurring checklist, not a vague retainer: core, plugin and theme updates applied to a staging copy and tested before they go live, offsite backups with periodic restore tests, uptime monitoring, security scanning, PHP version upgrades, database cleanup, broken link and form testing, and SSL renewal checks. Done properly it runs $80 to $250 a month excluding GST, or about two hours a month if you do it yourself.
The reason most business owners cannot tell you what their maintenance plan does is that most maintenance plans never say. We have run these on Australian client sites since 2004, and the honest summary is that the bulk of the value sits in one place: somebody notices when an update breaks something, and fixes it before your customers find it.
What is actually on the maintenance checklist?
About a dozen tasks, on four different rhythms: weekly, monthly, quarterly and yearly. Updates are the visible part and the smallest part of the effort. Everything else is verification, which nobody markets well because it is dull to describe and invisible when it works.
Weekly is light. Confirm the site is up, confirm nothing failed to update, glance at the security log. Monthly is the real session: plugin and theme updates run on staging, a click through the pages that earn money (home, your top service pages, contact, checkout if you sell online), a test enquiry pushed through every form, a broken link scan, and a look at what the firewall has been blocking. Quarterly you clean the database, review whether every plugin still earns its place, and restore a backup to prove it works. Yearly, or whenever your host announces a deadline, you move to a newer PHP version and confirm the SSL certificate is renewing automatically instead of silently failing.
| Task | Frequency | What happens if you skip it |
|---|---|---|
| WordPress core updates | Within days of a security release | A publicly documented vulnerability stays open on your site. Bots scan for exactly these, at scale, within hours of disclosure. |
| Plugin and theme updates | Monthly, on staging first | Same exposure, and the debt compounds. Skip six months and the catch up jumps several versions at once, which is far more likely to break something. |
| Testing after updates | Every single time | A dead form, broken layout or busted checkout runs for weeks before a customer finally mentions it. |
| Offsite backups | Daily, kept 30 days | If the server fails or a compromise rewrites your files, the only copy you had dies with it. |
| Restore test | Quarterly | You discover on your worst day that the database dump was incomplete or the backups quietly stopped four months ago. |
| Uptime monitoring | Every 1 to 5 minutes | The site goes down on a Friday night and you hear about it from a customer on Monday. |
| Security and malware scanning | Weekly | Injected spam pages sit on your domain for months, Google flags the site, and the cleanup costs more than a year of maintenance. |
| PHP version upgrades | Roughly yearly | The site runs on unsupported PHP: slower, unpatched, and eventually broken when the host forces the upgrade without warning you. |
| Database cleanup | Quarterly | Post revisions, expired transients and orphaned rows bloat the database. Backups slow down, the admin gets sluggish, restores take longer. |
| Broken link check | Monthly | Visitors hit 404s on pages you forgot you deleted, and external links you added years ago now point at parked domains. |
| Form and enquiry testing | Monthly | Enquiries stop arriving and nothing looks wrong. This is the most expensive failure on the list and the easiest one to miss. |
| SSL renewal check | Monthly | The certificate lapses and browsers put a full screen security warning in front of your homepage. |
| Plugin inventory review | Quarterly | Abandoned plugins with no update in two years sit there as an open door. This is still one of the most common ways WordPress sites get in trouble. |
Why does updating a live site break it?
Because WordPress is not one piece of software. It is a core application, a theme, and usually somewhere between fifteen and forty plugins, written by different people on different release schedules, none of them tested against your exact combination. Most updates are uneventful. The failures cluster in predictable spots: page builders like Elementor, anything touching a WooCommerce checkout, form plugins, caching plugins, and anything the developer stopped maintaining.
The fix is procedural rather than clever. Copy the site to staging, update there, load the pages that matter, submit a test enquiry, then push it live and check again. That is fifteen extra minutes, and it is the entire difference between maintenance and clicking Update All with your eyes shut. If your current host gives you no staging environment and no easy rollback, sort out hosting that includes staging and daily offsite backups before you worry about the maintenance plan sitting on top of it.
And yes, we have broken a client site with an update. It happens to anyone who touches WordPress often enough. What matters is that it was caught within the hour and rolled back, rather than sitting there until the client rang.
The restore test is the task nobody does. A backup that has never been restored is a hypothesis, not a safety net. Once a quarter, restore your most recent backup onto a staging site and load five pages. Ten minutes. We have found missing uploads folders, truncated database dumps and backup jobs that had silently failed months earlier, all on sites where the dashboard cheerfully reported everything was fine.
What is the difference between maintenance and support?
Maintenance is scheduled work on the software that happens whether or not you call. Support is unscheduled work you ask for. They get bundled into the same invoice constantly, and that is where most billing arguments start.
Maintenance is the checklist above. Support is “change the price on the services page”, “the contact form is going to the wrong inbox”, “add a bio for our new paralegal”. Most plans include a fixed allowance of support time, commonly 30 minutes to an hour a month, then bill hourly beyond that at roughly $120 to $180 an hour excluding GST. Ask which model you are on before you need it, not while the site is down.
Is maintenance the same as marketing?
No, and this is the more expensive misunderstanding of the two. Maintenance keeps the site working. It does not bring a single person to it.
We have had clients three years into a maintenance plan wondering why enquiries never grew. Nothing was broken. The site was patched, backed up, monitored and quick. It also had the same eight pages it launched with, no new content, a Google Business Profile nobody had touched, and no ads running. Maintenance is hygiene and insurance. Growth is a separate line item, and it costs separately. If somebody sold you a maintenance retainer as a growth service, you were sold badly.
What does a $29 a month maintenance plan actually get you?
Automated updates, an uptime ping and a backup, with no human looking at the result. That is not dishonest at that price, it is arithmetic. Twenty nine dollars buys you a few minutes of Australian labour a month, and the plan is priced to be run entirely by software.
Underneath, the cheap plans are usually a management dashboard such as ManageWP or MainWP, set to auto update everything on a schedule, with backups often landing on the same server the site lives on. When it works, you saved money and good luck to you. When an update takes the checkout down at 2am, the dashboard still records “updates applied successfully”, because from its point of view they were. Nobody loads a page. Nobody submits a test form. Nobody rings you.
What the $100 to $200 a month buys is a person who checks the result and answers the phone when it goes wrong. Whether that is worth it comes down to what a day of downtime costs you. A sole trader plumber whose work comes off a Google Business Profile can wear a day. A legal or finance firm where the enquiry form is the entire pipeline cannot, and one bad day usually costs more than the whole year of maintenance. For how hosting, security and site speed connect, the rest of our WordPress and hosting guides cover each piece properly.
Can I do WordPress maintenance myself, and how long does it take?
Yes, if you are comfortable in the WordPress dashboard and you will genuinely do it on a schedule. Budget 90 minutes to two hours a month for a standard business site, plus the occasional half day when something needs fixing. The monthly routine looks like this:
- Take a full backup of files and database to somewhere other than the server, then open the destination and confirm the file is actually there and not zero bytes.
- Update plugins in small batches rather than all at once, so when something breaks you know which one did it.
- Load the homepage, your top service pages and the contact page in a private browsing window, on a phone as well as a desktop.
- Send a real test enquiry through every form and confirm it lands in the inbox it is meant to.
- Check for update failures and any plugin flagged as untested with your WordPress version.
- Skim the security log for repeated failed logins from the same address.
Quarterly, add the database cleanup (WP Optimize handles it), a plugin cull, and the restore test. Once a year, move to the current supported PHP version. The realistic failure point for DIY maintenance is not skill, it is consistency. Everyone does it diligently for four months, then a busy quarter arrives and it quietly stops, and eleven months later the site is thirty updates behind. If that sounds like you, either book it as a recurring calendar appointment with the checklist attached, or pay someone.
What should I ask before signing a maintenance plan?
Four questions separate a real plan from a dashboard subscription. Where are backups stored, and when did you last restore one? Do you test the site after updating, and which pages specifically do you load? What is included versus billed hourly? And how do I reach a human when the site is down on a Saturday?
Vague answers to the first two mean automated updates with nobody verifying the outcome. That might be all your site needs, but you should know that is what you bought. We fold maintenance into our Australian web hosting and care plans for a simple reason: when the hosting and the maintenance sit with the same team, nobody spends a Saturday morning arguing about whose fault the outage was. No lock in contracts, so if we stop being useful you leave.
Common questions
How often should WordPress plugins be updated?
Monthly for routine releases, and within a day or two for anything flagged as a security fix. Batch them, run them on a staging copy first, and test afterwards. Updating weekly is not more secure in any meaningful way and just multiplies the testing. What genuinely hurts is the other extreme: sites left untouched for a year, where the eventual catch up spans several major versions and breaks the layout.
Will my website break if I never update it at all?
Not immediately, which is what makes it dangerous. A site can sit unmaintained for a year and look perfectly fine while a known vulnerability in an old plugin quietly gets scanned by bots. The two common endings are a malware infection that injects spam pages into your domain, or the host forcing a PHP upgrade that the outdated code cannot handle, taking the site down with no warning.
Does managed hosting include maintenance?
Partly, and the gap is worth understanding. Managed hosting usually covers core updates, daily backups, malware scanning and server level security. It rarely covers plugin and theme updates on your specific site, testing afterwards, form checks, broken links or database cleanup. So you get the infrastructure half and not the site half. Read the inclusions list rather than the headline, and ask specifically about plugin updates.
What does WordPress maintenance cost in Australia?
Roughly $80 to $250 a month excluding GST for a standard business site with a person actually reviewing the work. Ecommerce sites sit higher, commonly $200 to $500, because a broken checkout costs real money and needs closer testing. Below about $50 a month you are buying automation with no human verification, which is fine as long as you know that is the deal.
Do I still need maintenance for a simple brochure site?
Yes, though a lighter version is defensible. Even a five page site has WordPress core, a theme and a handful of plugins, all of which are scanned by the same bots that scan everyone. The minimum worth doing is offsite backups, monthly updates with a quick page check, uptime monitoring and a form test. That is closer to an hour a month than two, and it is not optional if the site generates any enquiries.
Can WordPress updates be automated safely?
Core security releases, yes, and WordPress does this by default for minor versions. Plugins and themes are riskier, because that is where conflicts live. A reasonable middle ground is automatic updates for a small list of stable, well maintained plugins, manual staged updates for the page builder, ecommerce and form plugins, and automated visual regression checks if the site justifies the setup cost. Automation without verification is the trap.
What happens to my site if I stop paying for maintenance?
Nothing dramatic on day one. The site keeps running, then slowly falls behind on updates until something breaks or gets compromised. Before you cancel, get a copy of your backups and confirm you hold the logins for the domain, hosting and WordPress admin in your own name. Any provider worth using will hand those over without a fight. Ours are yours by default, no lock in contracts.
Not sure what your maintenance plan is doing?
Send us your URL and whoever currently looks after it. We will tell you straight what is being covered, what is not, and whether you are paying too much or too little. Australian support, no lock in contracts.