Website maintenance is sold as a monthly line item and rarely explained, which is why most people paying for it could not tell you what they are getting. Here is what the work actually is, based on what I do and on the things I have found on sites that were nominally being maintained.
Updates are the easy part, and the part everyone means
WordPress core, plugins, themes. Clicking update is thirty seconds. The work is everything around it: knowing which update is likely to break a page, having somewhere to find out before it is live, and being able to put it back if it does.
Auto-updates left entirely alone will eventually change something visible on a Saturday night, and nobody will notice until Monday. Auto-updates turned entirely off will leave a known vulnerability sitting on the site for months. Neither extreme is maintenance. Deciding which category each plugin belongs to is.
A backup you have never restored is not a backup
This is the one worth being blunt about. Almost every site I look at has a backup plugin installed, and almost nobody has ever tested what it produces.
I watched a backup fail silently on my own hosting. The files archived fine, 129 MB of them, and the command reported success. The database export produced no file at all. Nothing errored, nothing warned; there was simply a backup with no database in it, which is a backup of a website’s furniture with the building missing.
Two things follow. Check that the backup contains both the files and the database, by looking rather than by trusting the green tick. And keep a copy somewhere other than the server it is backing up, because a backup living on the machine you are protecting against is not protection.
Security is mostly configuration, and some of it is not free
A security plugin installed is not a security plugin working. Wordfence is the one I use, and its own status percentage is worth understanding: on the free tier, roughly half the firewall score is simply unavailable. The remaining portion is behind the paid licence, and no amount of configuration will move it.
That is not a criticism of the plugin. It matters because a dashboard showing an amber score sends people hunting for a misconfiguration that does not exist. Knowing the ceiling of what you are running tells you when to stop looking.
The genuinely useful settings are unglamorous: limit login attempts, keep the admin username off admin, keep file editing disabled in the dashboard, and know which plugins have been abandoned by their authors. An unmaintained plugin is a bigger risk than an out-of-date one.
The risk that lives next door
This one is specific to shared hosting and it is almost never mentioned, so it is the part of this post most worth reading.
On a typical shared plan, every site in the account runs as the same Unix user. That means PHP running on any one of them can read and write the files of every other one, no matter how the permissions are set. An old subdomain nobody has logged into for two years, running a plugin abandoned in 2021, is not a separate site. It is a door into the main one.
I found exactly that on my own account: an unused subdomain sitting alongside the live site, sharing the same user. It was deleted rather than patched, because a site nobody needs is not worth maintaining and every month it stays is a month of exposure for the site that does matter.
So part of maintenance is an inventory. What else is on this hosting account, who still needs it, and what is running on it.
Watching for the things that break quietly
Everything above is scheduled work. The harder half is noticing what fails without announcing it.
- Contact forms. A form that has stopped delivering looks identical to a form nobody is filling in. Send yourself one occasionally.
- Email deliverability. Site mail sent straight from the server lands in spam often enough that it is worth checking where yours arrives.
- Card previews. Change a theme and a share card can go blank. Nothing on the site looks wrong.
- Payment and subscription details. An expired card on a recurring charge fails silently on the provider’s side, not yours.
The common thread is that none of these throw an error anywhere you would see it. They are found by checking, or they are found by a customer.
What it is not
Maintenance keeps a site working. It does not make it faster, it does not make it rank, and it will not fix a page that gives visitors no reason to get in touch. Those are separate pieces of work and worth buying separately, with separate expectations.
If your site is working but slow, that is a different problem with different causes, covered in why your WordPress site feels slow. If you are not sure which of the two you are dealing with, a performance audit will tell you before you spend anything on either.