WordPress Maintenance
Keep client WordPress sites secured, updated, and online — so your team is not firefighting core updates and broken plugins.
WordPress sites do not look after themselves.
Maintenance is the work that stops Friday-night emergencies.
Core updates, plugin clashes, failed backups, and “it was fine yesterday” malware do not wait for a convenient slot in your sprint. If nobody owns updates, the site owns you.
I handle core, plugin, and theme updates on staging first, then ship to live with backups and a rollback path — so your PM is not explaining a white screen to a client at 9pm.
This is white-label care for agencies: your brand in front of the client, a working site behind it.
Updates happen on staging. Live is not a test server.
Clicking “update” on production is not a maintenance plan.
I run core, plugin, and theme updates on a staging copy, check forms, login, checkout, and the bits that actually make the client money, then push live.
- Core, plugin, and theme updates on a schedule
- Staging checks before anything hits production
- A note of what changed and what still needs a decision
If an update breaks something, you hear it from me before the client does — with a rollback, not a shrug.
Cheap “unlimited support” is how sites quietly rot.
A £19 care plan that never touches staging is not looking after the site. It is invoicing you for hope.
Unlimited tickets sound generous until the queue is a shared inbox, updates are skipped because they might break, and the first anyone notices is when Google flags malware or checkout dies on a Friday.
I would rather agree a real window, a real contact, and a real restore path than pretend everything is covered. If a request is a rebuild, I will say so. If it is a plugin conflict, I will fix it on staging and ship it.
Backups are pointless if nobody has ever restored one.
A backup you have never tested is a bedtime story.
I take backups seriously: scheduled copies, a place they actually live, and a restore I have already walked through so we are not discovering a corrupt dump while the client is offline.
- Scheduled backups, not “I think the host does that”
- A tested restore path
- Rollback if an update goes wrong
When something fails, the question is not “do we have a backup?”. It is “how fast can we be live again?”.
Uptime and security are part of the job, not a dashboard screenshot.
If nobody is watching the site, you find out from the client.
I monitor uptime and the usual WordPress attack surface: outdated plugins, brute-force noise, malware, and the “it started redirecting to a pharmacy” special.
- Uptime and security monitoring
- Malware and broken-site emergency fixes
- A contact who already knows the stack
You stay in front of the client. I stay on the queue so a failed plugin does not become a reputation problem.
A care plan with a window, a contact, and a report.
Maintenance only works when it is boring and repeatable.
- Audit the current stack and risk areas
- Set a care plan: update window, backups, and contacts
- Run updates on staging, then live
- Report what changed and what still needs a decision
If this matches the work you need, share a few details and I will come back with a clear next step — hours, access, and what sits inside the plan versus a separate build.