WordPress website maintenance: what it should cover

WordPress website maintenance covers the work that keeps a site up to date, secure and working once it is live: the core, the plugins, the theme, the PHP version, backups and fixing defects. WordPress does part of it on its own, not the rest. This guide explains what is automatic, what is not, what serious maintenance covers and what to write into the contract.

It is written for managing directors, marketing managers and CIOs whose WordPress site carries part of the business: contact requests, a WooCommerce shop, a customer area, custom-built plugins. For these sites, maintenance is often a matter of application maintenance rather than simple upkeep.

What is WordPress website maintenance?

WordPress website maintenance means the work that keeps a site running after it goes live: applying updates to the core, plugins and theme, tracking PHP and database versions, backing up, monitoring and fixing what stops working. It does not change what the site does; its evolutions are handled separately.

It covers the classic families of maintenance: preventive (applying an update before a vulnerability is exploited), adaptive (following a new PHP version), corrective (repairing what breaks) and, often negotiated separately, evolutive. Our article on evolutive maintenance draws the boundaries between the four.

Why does a WordPress site need ongoing maintenance?

A WordPress site needs ongoing maintenance because only its latest version is officially supported and most vulnerabilities come from plugins. The WordPress.org security page says it plainly: “only the latest version of WordPress is officially supported”. Fixes backported to older versions are a courtesy, with no commitment.

The core is not the weak point. According to Patchstack’s report on the state of WordPress security in 2026, 11,334 new vulnerabilities were recorded in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and only 6 in the core. The same report notes that 46% of these vulnerabilities had no fix from their developer when they were made public.

A vulnerability with no fix is not solved by clicking “update”: the plugin has to be disabled, replaced or its code fixed. That is what separates ongoing maintenance from occasional updates.

The environment matters too. WordPress recommends PHP 8.3 or higher, and MySQL 8.0 or higher or MariaDB 10.11 or higher. It still runs on PHP 7.4, but these end-of-life versions, WordPress.org warns, “may expose your site to security vulnerabilities”. Our article on the end of PHP 8.2 support details the version schedule.

What does WordPress update on its own, and what is left to do?

WordPress has applied its minor and security updates on its own since version 3.7; plugins and themes require action. The WordPress administration documentation distinguishes what goes out by default and what does not:

The same documentation asks you to back up before any update and to check that backups “are there and usable”. A backup that nobody has ever restored remains an assumption.

What should serious WordPress maintenance cover?

Serious WordPress maintenance comes down to seven tasks, carried out at a written pace and recorded in a log the client can read.

• Tested updates. Core, plugins and theme, applied first on a copy of the site (staging), then in production.
• Verified backups. Files and database, stored off the site’s server, with a restore test at fixed intervals.
• Plugin watch. On WordPress.org, a closed plugin shows “This plugin has been closed and is no longer available for download”, and the reason for closure only appears after 60 days. Another warns that it “hasn’t been tested with the latest 3 major releases” of WordPress. Each alert calls for a decision: keep, replace or remove.
• PHP and database tracking. The versions in use, their end of support, and the site’s compatibility before each change.
• Monitoring. Site availability, errors, forms that no longer send anything.
• Fixing defects. What breaks after an update or for no apparent reason, classified by severity (see our article on corrective maintenance).
• Reporting. What was updated, what was postponed and why, what awaits a decision from the client.

When does a WordPress site call for application maintenance?

A WordPress site calls for application maintenance as soon as it contains code specific to the business: a WooCommerce shop connected to an ERP, a customer area, a custom-built plugin, an exchange with a CRM. Updating is no longer enough: each update can break this code, and this code has its own defects and evolutions.

For a business site, you reason as you would for an application: an assessment of the code and plugins, tests before every release, a queue of qualified requests, tracking of technical debt. That is the scope of third-party application maintenance. When the site was built by a provider who is no longer around, our web application takeover method applies to WordPress too.

What should you check in a WordPress maintenance contract?

A WordPress maintenance contract is judged on six written points, not on the task list of a brochure.

• The scope. The core, plugins listed one by one, the theme, custom code: what is not named is not covered.
• The update method. The pace, testing on a copy of the site, and what happens when an update breaks something.
• Backups. Their frequency, where they are stored, how long they are kept and the restore test.
• Times per severity. Response and fix, with the hours during which they run.
• Out-of-scope work. What counts as an evolution and is estimated separately, before being done. The choice between fixed price and time and materials arises here too.
• Reversibility. Access (hosting, domain name, site administration), backups and documentation remain the client’s and are handed over at the end of the contract.

These clauses are detailed, for any application, in our guide to the application maintenance contract.

Frequently asked questions

WordPress maintenance: start with an inventory

Before choosing a formula, take an inventory of the site: the WordPress and PHP versions, the list of plugins with their last update, what was custom-built, and who holds the access. This inventory tells you whether the site needs regular upkeep or genuine application maintenance.

The iones team provides nearshore application maintenance from Tunisia for live sites and applications, WordPress included, and can start with an audit of what exists. You can also write to us for an initial discussion.