A WordPress site does not break the day you stop looking after it. It degrades quietly over months, and the owner finds out when a customer mentions that the contact form never sent anything. This checklist covers what maintenance actually involves, how often each item needs attention, and which parts a business owner can handle without a developer.
What WordPress maintenance actually means
WordPress maintenance is the routine work of keeping the software, the plugins, the theme, and the backups current so the site stays secure and functional. WordPress itself is updated several times a year, and the plugins that add your forms, booking, SEO, or online ordering update far more often than that. Each update fixes bugs and closes security holes, which is why skipping them is the single most common cause of a hacked small business site.
The catch is that updates occasionally break things. A plugin update can change a layout, disable a form, or conflict with the theme. That is the real reason maintenance is work rather than a button, and it is why the order matters. First take a backup. Then update. Finally check the pages that matter, meaning the home page, the contact form, and anything that takes money. In practice this is twenty minutes a month on a simple site and an hour on a complex one.
The monthly list
A monthly pass handles everything that accumulates slowly, and it is the core of any maintenance plan. Start with a full backup stored somewhere other than the hosting account, because a backup that lives only on the server is useless the day the server is the problem. Then update WordPress core, then plugins, then the theme, in that order.
After updating, walk the site as a customer would. First load the home page on a phone. Then submit the contact form with a real address and confirm the email arrives, since a silently broken form is the most expensive failure a small business site has. Finally click through the pages that drive revenue, such as the menu, the booking page, or the service pages. For example, a clinic should submit its own appointment request once a month, because form delivery breaks far more often than owners expect and nothing warns you when it does.
Backups: the part that matters most and gets checked least
A backup is only real if it has been restored once. Many small business sites have a backup plugin installed, a green status badge, and an archive nobody has ever tested. The common failures are backups that include the files but not the database, backups stored on the same server as the site, and backups that stopped running eight months ago without anyone noticing.
Check three things. First, where the backup is stored, which should be off the hosting account entirely, such as cloud storage you control. Then how far back the copies go, because a single overwritten copy is no help if the problem started two weeks ago. Finally whether a restore has ever been performed. In practice, asking your developer to restore a copy to a staging site once a year is the only way to know the backup works, and it is cheap compared with rebuilding a site from a cached version of itself.
Security without buying anything
Most WordPress sites are not hacked by a targeted attack. They are swept up by automated bots that scan for known plugin vulnerabilities and weak logins, which means the defences that matter are unglamorous. Strong unique passwords on every administrator account, two-factor authentication on the login, and removing accounts for people who no longer work with you will do more than any paid security product.
Then reduce what there is to attack. First delete plugins you are not using, since an inactive plugin with a vulnerability is still code on your server. Then keep the number of administrator accounts small, giving staff the editor role instead when they only need to change content. Finally make sure your hosting has an SSL certificate active and the site loads over https everywhere. A well-built WordPress site starts with fewer plugins, which is why some sites need far less security work than others.
Speed and the things that slow a site down over time
Website speed decays as content accumulates, and the causes are usually the same three. Uploaded images that were never resized are the largest, since a photo straight from a phone can be several megabytes and a page with six of them will crawl on mobile data. Plugin bloat is the second, and a slow or oversold hosting plan is the third.
You can handle the first yourself. First resize images before uploading, keeping them under roughly 200 kilobytes for a normal page image. Then check the pages you have added since launch, because new content is where oversized images appear. For example, a restaurant that added twelve dish photos last spring may have quietly doubled its home page weight. The plugin and hosting questions need a developer to answer, and they are worth asking once a year rather than monthly.
What to do yourself and what to hand over
Dividing the work sensibly is what makes maintenance sustainable for a small business. The owner-side list is short and non-technical: upload properly sized images, keep hours and prices current, test the contact form monthly, and tell the developer promptly when something looks wrong rather than waiting for the next invoice.
The developer-side list is everything with a risk attached. Core and plugin updates with a backup taken first, restoring that backup when an update goes wrong, security hardening, hosting and performance decisions, and keeping an eye on the form delivery and uptime. First agree which side owns which item in writing. Then agree how urgent problems reach the developer, because a site that is down on a Saturday needs a path that is not email. We covered the questions worth asking about this before you hire anyone in what to ask a web designer.
What a maintenance plan should cost
Maintenance is priced monthly and should be small relative to what the site cost to build. On a custom small business site built between $5,000 and $20,000, an ongoing plan covering updates, backups, monitoring, and a modest allowance of small content changes is normal and worth paying for. The alternative is not free, it is deferred, and it arrives as an emergency rebuild.
Ask what the plan actually includes before comparing prices. First, whether backups are taken before updates or only on a schedule. Then, how many small edits are covered per month and what counts as one. Finally, response time when something breaks. In practice the cheapest plans are often just an automated updater with nobody checking the result afterward, which is how a site ends up with a broken form for three weeks and a perfect update history.
If you are not sure whether your WordPress site is being maintained or just hosted, send us the URL. We reply within one business day and will tell you what we can see from the outside, including whether the software is current.
