A WordPress care plan is an ongoing service that keeps your website updated, backed up, secure and fast. A good one runs on a schedule and proves its work every month, so you never have to wonder whether your site is being looked after.
Use the checklist below to see what a complete plan should cover, whether you do the work yourself, have someone on staff handle it, or hire a provider.
In short:
- Updates, backups and security are the non-negotiables. Everything else builds on them.
- Updates should be tested before they go live, and backups should be test-restored, not just taken.
- Monitoring should catch downtime, slowdowns and broken forms before your customers do.
- You should get a plain-English report every month that shows exactly what was done.
Why WordPress needs ongoing care
WordPress is not a single piece of software. Your site is WordPress itself, plus a theme, plus a set of plugins, all running on a server with its own software. Each part is updated on its own schedule by different developers.
That flexibility is a big reason WordPress is so popular. It also means things change constantly. Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025. It found that 91% were in plugins, and that heavily targeted flaws were being exploited a median of just five hours after they were made public.
In plain terms: a business website that isn’t actively maintained doesn’t stay the same. It slowly falls behind, and the risk grows each month. A care plan is how you keep it current.
The core of every WordPress care plan
These are the essentials. If a plan leaves any of them out, ask why.
1. Tested software updates
WordPress core, your theme and every plugin should be updated on a regular schedule. The safest approach is to apply updates to a staging copy of the site first, check that key pages and forms still work, and then update the live site.
Clicking “Update all” on a live site can work, but when two plugins conflict, your contact form or booking page can quietly break. Testing first prevents that.
2. Backups you know will restore
Backups should run automatically, at least daily for most business sites and more often for online stores. They should be stored somewhere other than your web server, so a server problem doesn’t take your backups with it.
Most important, someone should test-restore a backup from time to time. A backup you have never restored is a hope, not a plan.
3. Active security
- A web application firewall that blocks malicious traffic before it reaches your site.
- Regular malware scans of files and the database.
- Login protection, including strong passwords, two-factor authentication for admins and limits on repeated login attempts.
- Vulnerability alerts for the plugins you actually run, so urgent fixes aren’t left waiting for the next scheduled update.
4. Uptime monitoring
Your site should be checked every few minutes, around the clock. If it goes down, the person responsible should know right away, ideally before a customer notices.
5. A current server environment
WordPress runs on PHP and a database. Older versions stop receiving security fixes. As of this writing, WordPress.org recommends PHP 8.3 or greater, MySQL 8.0 or MariaDB 10.11 or greater, and HTTPS on every site. A care plan should check these at least a few times a year and plan upgrades before support ends.
The WordPress maintenance checklist, by schedule
Here is a practical website maintenance checklist you can hand to whoever looks after your site. Adjust the frequency to your site’s size and how much it changes.
| How often | Task | Why it matters |
|---|---|---|
| Continuously | Uptime monitoring and firewall protection | Catches outages and blocks attacks in real time |
| Daily | Automatic off-site backups | Lets you recover from a bad update, a hack or a server failure |
| Weekly | Review and apply updates to core, theme and plugins (tested first) | Closes security holes and keeps features working |
| Weekly | Malware scan and security log review | Spots problems early, while they are small |
| Weekly | Test key forms, booking tools and checkout | Confirms leads and orders are actually reaching you |
| Monthly | Speed and Core Web Vitals check | Keeps pages fast for visitors and healthy in search |
| Monthly | Broken link and 404 check | Keeps visitors from hitting dead ends |
| Monthly | Remove unused plugins, themes and admin accounts | Every unused add-on is extra risk with no benefit |
| Monthly | Plain-English report to the business owner | Shows what was done and flags anything that needs a decision |
| Quarterly | Test-restore a backup | Proves recovery works and how long it takes |
| Quarterly | Database cleanup and optimization | Removes clutter that slows the site over time |
| Quarterly | Review user accounts and permissions | Removes access for former staff and vendors |
| Twice a year | Check PHP, database and server versions | Avoids running on software that no longer gets security fixes |
| Yearly | Renew domain, SSL and licenses; review accessibility and content | Prevents surprise expirations and keeps the site current |
If you’d rather not keep a list like this yourself, our managed WordPress hosting and maintenance covers this work for you, with the results in your monthly report.
Speed, search and the “quiet” maintenance tasks
Updates and backups get the attention. These quieter tasks are what keep a site performing well over the years.
Core Web Vitals and page speed
Google’s Core Web Vitals measure how fast your main content loads, how quickly the page responds when someone taps or clicks, and how stable the layout is while it loads. Sites tend to slow down over time as plugins, scripts and large images pile up. A monthly check catches slowdowns before they cost you visitors.
Broken links and missing pages
When pages are renamed or removed, old links break. A monthly scan finds them so they can be fixed or redirected, which helps both visitors and search engines.
Plugin cleanup
Plugins are added for one project and then forgotten. Each one is code that needs updates. Removing what you don’t use is one of the simplest ways to lower risk. Plugins can also be discontinued by their makers, as happened with the Envato Elements plugin, so someone should be watching for that too.
Forms, tracking and integrations
Your website feeds your phone, inbox and CRM. A form that silently stops sending, or analytics that stop recording, can go unnoticed for weeks. Regular testing protects your lead flow.
Hosting vs. a care plan: who does what
Business owners often assume their host handles maintenance. Sometimes it does, partly. This table shows the usual split. Check your own agreements, because providers vary.
| Task | Basic hosting | Managed WordPress hosting | WordPress care plan |
|---|---|---|---|
| Server uptime and hardware | Yes | Yes | Monitored |
| Server-level backups | Sometimes | Usually | Yes, plus off-site copies and test restores |
| WordPress core updates | Rarely | Often automatic | Yes, tested |
| Plugin and theme updates | No | Sometimes | Yes, tested |
| Checking forms and key pages after updates | No | Rarely | Yes |
| Speed, broken links and cleanup | No | Partly | Yes |
| Monthly report in plain English | No | Rarely | Yes |
The best setup is often both: a strong hosting environment underneath, with a care plan looking after the WordPress layer on top.
Questions to ask before you choose a care plan
Whether you are comparing providers or reviewing what you already have, these questions get to the truth quickly.
- Do you test updates on a staging copy before applying them to my live site?
- Where are backups stored, how long are they kept, and when did you last test a restore?
- What security tools are in place, and who responds if something is found?
- How quickly will I hear about downtime, and how quickly will it be fixed?
- Do you check my forms, booking tools or checkout after updates?
- What is included in support, and what counts as extra work?
- What will my monthly report show?
- Who owns the site, the hosting account and the backups if I leave?
Not sure where your site stands today? Our free website review checks your WordPress version, plugins, speed and security basics, and explains what we find in plain English.
Signs your site has fallen behind on maintenance
You don’t need to log in to spot most of these.
- You can’t remember the last time anyone updated the site.
- Pages feel slower than they used to, especially on a phone.
- Form submissions have dropped off without a clear reason.
- Your browser or Google shows a security warning.
- You don’t know who has admin access, or whether former vendors still do.
- Nobody can tell you when your last backup was, or where it’s stored.
If several of these sound familiar, the site may need more than maintenance. Our guide to signs your website needs a redesign helps you decide whether to repair or rebuild.
Doing it yourself vs. handing it off
Plenty of owners start by maintaining their own site. That can work well if you have the time and a little technical comfort. Here is a safe way to do the basics yourself.
- Take a fresh backup and confirm it finished before you change anything.
- Update on a quiet day and time, not right before a busy weekend or a big promotion.
- Update plugins one at a time instead of all at once, so you know which one caused a problem if something breaks.
- Check your key pages after each update: home, top service pages, contact form, booking or checkout.
- Submit a test form and make sure it arrives in your inbox or CRM.
- Write down what you changed and the date, so anyone helping you later has the history.
The trade-off is time and attention. Updates arrive every week, security alerts don’t wait for a convenient moment, and restoring a broken site under pressure is stressful. Many practices, firms and home-service companies hand maintenance off once the website becomes a steady source of leads, because the cost of a quiet outage is higher than the cost of care.
If your current site was built in a way that makes updates fragile, it may be worth planning a rebuild on a cleaner foundation. Our custom WordPress website design work is built with long-term maintenance in mind, so updates stay routine instead of risky.
What a monthly care report should show
The report is how you know the work happened. A useful one is short, clear and specific.
- Updates applied: what was updated and whether anything needed fixing.
- Backups: confirmation they ran, plus the date of the last test restore.
- Security: scans run, threats blocked and any issues resolved.
- Uptime: any outages and how long they lasted.
- Speed: how your key pages are performing compared to last month.
- Recommendations: anything that needs your decision, explained simply.
That kind of reporting turns maintenance from an invisible expense into something you can see and trust.
The bottom line
A WordPress site is a business asset that runs on living software. With a clear schedule of tested updates, verified backups, active security and simple monthly reporting, it stays fast, safe and ready to bring in work for years.
Whether you handle the checklist in-house or hand it to someone else, the key is that every item gets done, on time, with proof. If you’d like the CORE Team to take it off your plate, learn more about our WordPress hosting and care.
