WordPress maintenance plans: what a good one should include

WordPress's documentation is direct: you should always update WordPress to the latest version. It also explains that since version 3.7, most sites can apply minor and security updates automatically in the background, while major feature releases still need someone to click Update Now.

Updates matter for security as much as for features. WordPress's hardening guide says WordPress is updated regularly to address new security issues, and that older versions of WordPress are not maintained with security updates. It adds a sobering point: when a vulnerability is fixed in a new release, the information needed to exploit it is almost certainly public.

A good plan applies WordPress updates promptly, after a backup, and checks the site afterward.

Plugins and themes add features, and each one is more code to keep current. WordPress's hardening guide warns: do not get plugins/themes from untrusted sources. A maintenance plan should include:

• Updating plugins and themes as new versions appear
• Removing plugins you no longer use, since fewer plugins also means fewer things to update
• Checking that each plugin comes from a trusted source and is still maintained

WordPress's update guide also flags a common trap. If you've customized a default or classic theme without renaming it, updating can overwrite your changes. A careful maintainer knows which files on your site were customized.

WordPress's backup guide explains why backups matter in one line: your WordPress database contains every post, every comment and every link on your site. If it's erased or corrupted, you could lose all of it.

The guide's recommendations are practical:

• Back up your database regularly, and always before an upgrade.
• For smaller websites with fewer posts, back up once a week. For high-activity sites, back up daily.
• Keep at least 3 to 5 recent backups, stored in different locations, such as one on your hosting server and one in cloud storage.

The guide also notes that there are several ways to automate the backup process, and that with a proper backup of your database and files, you can quickly restore things back to normal. A backup only counts if it can be restored. Ask any provider how often they test a restore.

WordPress's hardening guide covers security in depth, and a few points belong in every plan. Keep backups and know the state of your installation at regular intervals. Get plugins and themes only from trusted sources. And protect the computers used to manage the site: the guide says to keep them free of spyware, malware, and virus infections, with the operating system and browser kept up to date.

Ask any provider how they handle logins, user permissions and monitoring, and what happens if your site is ever compromised.

After updates, a careful maintainer also does the small things WordPress's update guide mentions: clearing the cache if caching is enabled, so changes go live, and knowing that if problems appear after an upgrade, you can restore your backup and the previous version's files.

Maintenance isn't only about keeping a site safe. It's also about keeping it fast. Google Search Central says it highly recommends site owners achieve good Core Web Vitals for success with Search and a great user experience in general, and it points to the Core Web Vitals report in Search Console for measuring them. Google's web.dev guide describes the three Core Web Vitals and their targets:

• Largest Contentful Paint (LCP), which measures loading, should occur within 2.5 seconds of when the page first starts loading.
• Interaction to Next Paint (INP), which measures interactivity, should be 200 milliseconds or less.
• Cumulative Layout Shift (CLS), which measures visual stability: web.dev says pages should maintain a CLS of 0.1.

The guide recommends measuring at the 75th percentile of page loads, segmented across mobile and desktop. The guide also says tools should consider a page passing if it meets the targets at the 75th percentile for all three of the Core Web Vitals metrics. New plugins, larger images and theme changes can all move these numbers, so a good plan checks them after every significant change and on a regular schedule.

1. How quickly do you apply core, plugin and theme updates?
2. Do you back up before every update?
3. How often do you back up, how many copies do you keep and where?
4. When did you last test a restore?
5. How do you vet and remove plugins?
6. How do you monitor Core Web Vitals after changes?
7. What do you report to me each month?
8. What happens, and how fast, if the site goes down or gets hacked?
9. Who controls the hosting, domain and admin accounts if we part ways?

The best WordPress maintenance plans are boring in the best way. Updates happen, backups work and the site stays fast, so you can focus on your business.