What ongoing care means
Updates are tested before they ship
Core, plugin, and theme updates should be applied to a copy first and checked against the paths that matter, rather than applied live and hoped for.
Automatic updates are not the same thing. They are useful for security releases, but they cannot tell you that your checkout still works afterwards. Therefore the value is in the check, not the click.
Backups are restored, not just taken
A backup that has never been restored is an untested assumption. Restore verification turns recovery into a procedure.
In practice, backups fail quietly for ordinary reasons: the database is included but the uploads folder is not, the schedule silently stopped months ago, or the only copy lives on the same server as the site. Consequently a restore rehearsal finds problems that a green tick in a dashboard hides.
Monitoring reaches a person
An alert nobody reads is not monitoring. Ownership and escalation must be explicit before monitoring can be sold as a service.
You get a record
A useful care record says what changed, what was checked, and what needs a decision. As a result, you are never dependent on one person’s memory, and a future problem starts with evidence rather than guesswork.
What WordPress maintenance actually prevents
It is worth being precise about the promise, because “maintenance” is sold to mean almost anything.
- Update fallout. The single most common cause of a site breaking on an ordinary Tuesday.
- Unrecoverable loss. Not by preventing failure, but by making sure a restore exists and works.
- Slow discovery. Finding out from a customer is the expensive way to learn the site is down.
- Accumulated drift. Abandoned plugins, unused accounts, and code nobody has looked at in two years.
It does not prevent hardware failure, provider outages, or a determined attacker. Nothing does.
How care differs from incident work
Incident work begins with a live fault and ends when the site is verified and documented. Care work has no such trigger, so it is scheduled, repetitive, and mostly invisible when it is going well.
That difference matters when you are choosing. If the site is broken right now, start with WordPress support instead. Meanwhile, if it is running and you want it to keep running, this is the right lane.
What ongoing care is not
It is not open-ended development. New functionality, redesigns, and feature work are projects with their own scope. Care keeps the existing site working and makes the boundary visible before work begins.
Nor is it a licence to accumulate small requests indefinitely. In short, a change that alters what the site does is a project, and it is quoted as one.
Is the site a good fit?
Care works best where there is somewhere to test, a host that allows necessary access, and custom code that can be reviewed. Missing prerequisites should be identified before a plan begins.
Some sites need work before they can be maintained at all. For example, a site with no staging environment, encrypted commercial code, or a host that forbids the access required cannot be cared for honestly, and saying so early is cheaper than discovering it later. The WordPress upgrade documentation sets out the baseline process this work builds on.
A site that has just changed platform is usually the strongest fit of all, because the prerequisites were settled during the move and nothing has had time to drift yet. Consequently the handover from a migration to WordPress into ongoing care is the cheapest moment to start, rather than after the first failed update.
Where maintenance plans commonly fall short
Two failures show up repeatedly when a site arrives from another provider.
First, the plan covers updates but nobody ever checks the pages that earn money. The update log looks perfect while checkout has been broken for a fortnight. Second, the reporting describes activity rather than outcomes: a list of plugins updated, with nothing about what was verified afterwards.
Both are easy to detect. Ask what was tested, not what was applied.
Questions worth asking any provider
Where do you test updates? If the answer is “on the live site”, you are buying hope.
When did you last restore one of my backups? A date is an answer. “They run nightly” is not.
Who sees the alert at two in the morning? A named route beats a dashboard nobody has open.
Where this sits alongside security
Maintenance and security overlap but are not the same purchase. Patching and backups belong to both, whereas attack surface, access hygiene and hardening are covered under security services. If a compromise has already happened, begin with hacked site recovery. Otherwise, read the service scope first.