What It Takes to Look After a WordPress Site

A WordPress site is never finished. It's built from parts written by different people (WordPress itself, a theme, and usually several plugins), and each one ships updates on its own schedule. It runs on a server whose software, PHP and a database, ages too. Looking after a WordPress site means keeping all of that current, keeping copies you can go back to, and noticing when something breaks before your customers do.

I still host and look after WordPress sites for clients, on LiteSpeed servers I run. This is what that work involves. If you look after your own site, use it as a checklist. If you pay someone to, use it to ask what you're getting.

Updates: WordPress, your theme and your plugins

WordPress has four kinds of automatic updates: core, plugins, themes and translations. Since version 5.6, new installations update themselves for both minor and major WordPress releases by default (WordPress documentation). Plugins and themes are different: by default they update themselves only in special cases, when WordPress.org's security team pushes a fix for a critical vulnerability. The rest wait for someone to click.

That's where most of the work is:

• Take a backup first. One release can close a security hole and break a page.
• Update, then check the site. Open the home page, your busiest pages, and anything that takes input: the contact form, the booking widget, the checkout.
• Remove what you don't use. Every plugin and theme you keep is one more thing to update. Delete deactivated ones instead of leaving them installed.
• Watch for abandoned plugins. Each plugin's page on WordPress.org shows when it was last updated. One that hasn't changed in years may not get a fix when a hole is found, and is worth replacing.

Backups you can restore

A backup has two parts, the database and the files, and you need both to fully restore a typical WordPress site (WordPress documentation). The database holds your posts, pages and settings. The files hold WordPress, your theme, your plugins and everything you've uploaded.

WordPress's guide suggests keeping at least three to five recent backups in different places, for example one on the server, one in cloud storage and one on your own computer, so one failure can't take them all.

Two rules I'd add:

• Back up before every update, not only on a schedule.
• Restore one now and then. A backup you've never restored is a hope. Put one on a test copy of the site and see how long it takes.

The server underneath

WordPress runs on PHP and a database, and both have versions that stop getting security fixes. WordPress recommends PHP 8.3 or greater, and MariaDB 10.11 or MySQL 8.0 or greater (WordPress requirements). It still runs on PHP as old as 7.4, but WordPress notes that those older versions have reached end of life and may expose your site to security vulnerabilities.

Moving to a newer PHP version is usually a setting at your host, but test first: a plugin or theme that hasn't kept up can stop working. Site Health's Info tab (Tools > Site Health), under Server, shows the version your site runs.

The rest of the server matters too: the web server software, the operating system, and the HTTPS certificate that has to renew on time. On shared or managed hosting, the host looks after those. On a server you rent yourself, someone has to.

Security basics

Most of it is housekeeping:

• One login per person, with the lowest role that lets them do their job. An Editor can publish and manage everyone's posts and pages without being able to install plugins or change settings.
• Remove accounts for anyone who no longer needs access.
• Long, unique passwords, and two-factor sign-in for every account that can change the site.
• HTTPS everywhere, including the login page.
• A plan for the bad day. Scan for malware, and decide in advance what happens if the site is hacked: where the clean backup is, and who restores it.

Speed and tidiness

A WordPress site tends to slow down as it fills up:

• Caching. A page cache serves a saved copy of each page instead of building it on every visit. On a LiteSpeed server, which is what I run, the LiteSpeed Cache plugin does this at the server.
• Images. Resize photos before you upload them. A photo straight off a phone is far larger than any screen needs.
• The database. Post revisions, spam comments and data left behind by old plugins pile up. Clear them out now and then, after a backup.
• Measure it. Run your key pages through PageSpeed Insights. My post on what to check in a website audit explains the numbers it reports.

Checks that catch problems early

Some problems don't announce themselves:

• Uptime monitoring tells you the site is down before a customer does.
• Forms fail quietly. A contact form can look fine while its emails stop arriving. Send yourself a test after every update, and now and then in between.
• Site Health. Tools > Site Health lists critical issues and recommended improvements (WordPress documentation).
• Search Console. Google Search Console reports pages Google can't reach and other errors.
• Renewals. Know when your domain renews and who pays for it. A lapsed domain takes the site, and any email on it, down with it.

For a longer list, see my website maintenance checklist.

A routine that works

Every month:

1. Back up, then apply updates.
2. Test the contact form, and the checkout if you have one.
3. Look at Site Health and Search Console.

Every few months:

1. Restore a backup to a test copy.
2. Remove plugins, themes and accounts nobody uses.
3. Check the PHP version.

Every year: confirm your domain's renewal date, and who has the logins to your domain, hosting and site.

How I can help

I host and look after existing WordPress sites case by case. Tell me about yours and I'll send a written quote for hosting and upkeep before anything changes. Content and design changes aren't included. A $500 deposit starts the quote. It's refundable until you accept, and credited to the work. Ask for a quote.

If the site is due for a rebuild instead, my plans start at $2,400, hosted on Vercel with the $79/mo care plan from launch day: hosting with SSL, daily backups, uptime monitoring, and security and dependency updates. See the plans.