In short: Serious WordPress or WooCommerce maintenance includes updates tested on a copy, backups with verified restores, security checks, monitoring, speed checks, small changes within a stated number of hours and a report you can actually read. Be wary of absolute promises such as ‘your site will always be safe’.
A WordPress site or WooCommerce shop is made up of many moving parts: the core, the theme, dozens of plugins, the server. Each one receives updates and each one can introduce a problem. If nobody looks after them, the site keeps working for a while. Then it stops when you least expect it.
What maintenance should include
Controlled updates
Updating WordPress, the theme and plugins is necessary because that is how many security holes get closed. Doing it blindly is risky. A good service tests updates on a copy first and only then applies them to the live site. On a shop it also checks that a test order goes through.
Backups with tested restores
Frequent copies stored off the server, and a restore that has actually been tested. See backups that actually work.
Security checks
Scanning for suspicious code and checking users and permissions. Protection against unwanted access. If something is compromised, whoever looks after the site must know how to clean it up and close the gap.
Monitoring
A system that sends an alert in three cases: the site isn't responding; the certificate is about to expire; the checkout stops working. Better to hear it from an alert than from a customer.
Speed and search checks
A regular look at loading times and at the errors Google reports. See a slow site sells less.
Small changes and support
Changing some text or a banner, or adding a page. Answering a question. A good service includes a set number of hours and says clearly what happens when they run out.
A report you can read
Every month or every quarter, a summary of what has been done and what needs deciding. Written so that someone non-technical can understand it.
Questions to ask before choosing
- Which tasks are included and which are charged separately?
- How are updates tested before they are applied?
- Where are the backups kept and who can restore them?
- What happens if the site is compromised? Is restoring it included?
- Who do I contact when there's a problem, and how will you reply?
- How many hours of changes are included?
- What access do you have to my site and how do you protect it?
- How do I leave the service and what do you hand over?
Signs that a service isn't serious
- Absolute promises such as ‘your site will always be safe’ or ‘zero problems’.
- No detail on what is done each month.
- Access to the site shared among several people through a single password.
- No way to see the activity log.
How much is it worth spending
It depends on what a day of downtime costs you. For a brochure site, an essential service with updates and backups is enough. A shop that sells every day also needs monitoring and a set number of hours for changes. Platforms with a lot of customisation need a custom-built arrangement.
Further reading: hacked website · WordPress and WooCommerce security · website care and maintenance
Frequently asked questions
What does WordPress site maintenance cover?
Controlled updates to WordPress, the theme and plugins, backups, security checks, monitoring of site activity, performance checks, small changes and a regular report.
Why should updates be tested first?
An update can break a theme or a plugin. Testing it on a copy means you don't find out on the live site, especially on a shop, where a test order also needs checking.
What should you ask before choosing a service?
What is included and what is charged separately; how updates are tested; where the backups are kept; what happens if the site is compromised; how many hours of changes are included and how you leave the service.