Maintenance is not a subscription; it’s insurance.
A WordPress site is not a finished product. It’s an assembly of software components, each evolving at its own pace: the core, the theme, plugins, the PHP version, the server. Each update to one can break another, and every day without an update opens an additional window of exposure.
This reality is poorly understood because it’s invisible. An unmaintained site continues to display normally for months, sometimes years. Nothing signals the degradation until it suddenly manifests as an unavailable site, injected content, or an unexplained drop in rankings.
Comparing the cost of a maintenance contract to the cost of an incident is therefore the only honest way to frame the question. On one side, a predictable and modest monthly expense. On the other, an urgent repair bill, lost revenue for several days, and a reputation rebuild with visitors and search engines.
The vast majority of WordPress site compromises do not exploit a core vulnerability, which is robust and quickly patched. They exploit an outdated plugin, a theme abandoned by its author, or a weak password. In other words, they target precisely what maintenance covers.
What an Attack Really Costs
Quantifying an incident requires adding up items that are often forgotten individually.
The Direct Technical Cost
Identification of the compromise, cleaning of infected files, database verification, clean reinstallation of the core and plugins, changing all access credentials, restoration from a healthy backup if available. This work can take days when the infection is old, because it’s necessary to go back to the compromise date to know which backup is still healthy.
This is precisely where the absence of tested backups costs the most. A backup from a week before discovery already contains the infection, and then it’s necessary to rebuild rather than restore.
The Operational Cost
During the intervention, the site is often inaccessible. For a business that receives inquiries via forms, each day of unavailability is a day without leads. For an e-commerce store, it’s lost revenue that cannot be recovered.
The Reputation Cost
A site flagged as dangerous by the browser displays a full-screen red warning. Once cleaned, lifting this flag takes from a few hours to several days. In the meantime, every visitor leaves with the impression that the company is unreliable.
SEO suffers the same fate. Google quickly de-indexes a compromised site and slowly re-indexes it. A position gained in eighteen months can be lost in ten days and takes several months to recover.
The Five Truly Used Entry Points
Understanding how attacks occur helps to understand what a contract should cover.
Outdated Plugins
This is by far the leading cause. A popular plugin with a published vulnerability becomes an immediate target, because the disclosure of the vulnerability is accompanied by the means to exploit it. The time between disclosure and the first automated attempts is measured in hours.
The practical consequence is that a monthly update rhythm is not sufficient for exposed plugins. Security patches must be applied without delay; functional updates can wait for a planned window.
Abandoned Themes
A theme purchased from a marketplace and not updated for two years is a permanent risk. The problem is exacerbated by the fact that many themes embed their own plugins, which do not update independently. A vulnerability in an embedded component depends on the theme author’s goodwill.
Weak Access Credentials
Reused passwords, accounts of former service providers never deleted, absence of two-factor authentication on administrator accounts. These three points cost nothing to fix and represent a significant portion of compromises.
End-of-Life PHP Versions
A PHP version that no longer receives security patches exposes the entire server. Many sites remain on an old version because an incompatible plugin blocks the upgrade, and no one dares to touch it.
Missing or Untested Backups
This is not an entry point, but it’s what turns an incident into a catastrophe. A backup that has never been restored is a backup whose functionality is unknown, and this discovery happens at the worst possible moment.
What a Real Maintenance Contract Covers
The term is used for very different services, from simple rebranded hosting to comprehensive monitoring. Here’s what it should encompass.
The Security Aspect
Updates to the core, theme, and plugins, with immediate application of security patches. Monitoring of intrusion attempts and blocking of aggressive IP addresses. Periodic verification of file integrity. Account and permissions management, including deletion of unused access credentials.
The Continuity Aspect
Automated, externalized, and tested backups. Availability monitoring with alerts in case of interruption. Staging environment for testing risky updates before applying them to production. Documented and proven restoration procedure.
The Performance Aspect
Monitoring response time, purging unnecessary tables, controlling database size, optimizing added images, periodic verification of performance thresholds. This component prevents the slow drift that causes a site to go from two to five seconds loading time in three years, a topic detailed in our article on Core Web Vitals.
The Technical SEO Aspect
Checking for broken internal links after page deletion, verifying redirects, monitoring indexing, alerting on errors reported by Search Console. An updated plugin can modify markup or block a resource, and no one notices without monitoring.
The Difference Between Maintenance and Hosting
The confusion is perpetuated by commercial offers, and it costs businesses dearly who believe they are covered.
A host provides infrastructure: a server, disk space, bandwidth, sometimes a certificate and server-level backups. Its responsibility ends at the system layer. If your plugin has a vulnerability, it will not intervene, and if your site is compromised, it will suspend it rather than clean it.
A maintenance provider intervenes within the site itself. They know your plugins, test updates, restore a previous version when an update breaks a display, and correct regressions. These two services are complementary, and neither replaces the other.
Some managed hosting offers combine both levels, and this is generally the clearest option for a company that doesn’t want to manage two contacts. In such cases, precisely verify where each party’s responsibility ends, especially regarding post-incident restoration.
The Question of Update Frequency
Two schools of thought oppose each other, and neither is entirely right.
Automatic and immediate updates provide maximum protection against known vulnerabilities, but they expose sites to regressions: an untested plugin update can break a form, a display, or a checkout funnel, and no one notices for several days.
Planned and tested updates avoid regressions but leave a window of exposure. For a critical security patch, waiting for the monthly window means leaving the door open for several weeks.
The reasonable answer is a hybrid approach. Security patches are applied without delay, possibly automatically, because the risk of regression is lower than the risk of exposure. Major and functional updates go through a testing environment at regular intervals, with critical paths verified after application.
For an e-commerce store, this verification is non-negotiable: a broken checkout funnel for three days costs more than a year of maintenance. This is what distinguishes an e-commerce maintenance contract from a standard contract.
What You Can Do Yourself
A business without a maintenance budget is not condemned to inaction. Five actions significantly reduce risk and only cost time.
- Activate two-factor authentication on all administrator accounts, and delete unused accounts, especially those of former service providers.
- Uninstall unused plugins rather than just deactivating them. A deactivated plugin remains on the server and can still be exploited.
- Update the core and plugins at least once a month, after taking a manual backup.
- Check the PHP version with the host and plan the upgrade if it is no longer maintained.
- Test a restoration once a year in a separate environment, to know if the backup actually works.
These five points cover the majority of common risks. What they don’t cover is responsiveness to a critical vulnerability published on a Friday evening, and the ability to diagnose a subtle regression after an update.
Signs Indicating a Neglected Site
A few quick checks can tell you where you stand, without any particular technical skill.
Log in to the administration panel and look at the number of pending updates. Beyond five, monitoring is irregular. Beyond fifteen, it’s non-existent. Then look at the last update date for each plugin from the author’s side: a plugin not updated for more than a year is a risk in itself, regardless of your own monitoring.
Check for unknown user accounts, the PHP version displayed in the site health screen, and the date of the last successful backup. These three pieces of information are visible in three minutes and provide a reliable picture of the situation.
Finally, check the homepage loading time using a measurement tool. A properly monitored site maintains its thresholds over time; a neglected site continuously degrades. This check is part of the systematic points of a technical SEO audit.
Slow Drift, More Costly Than a Spectacular Incident
Attacks make headlines, but they don’t represent the primary damage observed on sites we take over. The dominant damage is a gradual erosion that no one dates and no one attributes.
It starts with accumulation. A plugin added for a specific need and never removed, a second for a form, a third for a gallery. Each loads its files on all pages, including those that don’t use it. After three years, the homepage loads forty files, twelve of which are useless.
It continues with the database. Article revisions pile up by the tens of thousands, tables from uninstalled plugins remain in place, expired temporary entries are never purged. Each query passes through this mass, and the server response time lengthens by a few tens of milliseconds with each layer.
It ends with broken links. A deleted page leaves behind all internal links that pointed to it, an erased image leaves an empty spot, an external service that closes leaves a dead script. None of these elements cause a breakdown, but all degrade the user experience and SEO.
The common point of these three drifts is that none trigger an alert. They are only noticeable by comparing the current state to that of two years ago, which no one does without organized monitoring.
Organizing Monitoring When Managing Multiple Sites
A company with several sites, or a structure that manages them for clients, quickly encounters a scalability problem. Manual site-by-site monitoring becomes untenable beyond a few units.
The first solution is centralized supervision: a single dashboard that displays pending updates, the status of the last backup, availability, and PHP version for each site. Without this view, the least visible sites are the ones that drift, because they never demand anything.
The second is standardization. Using the same technical foundation across all sites, with the same list of validated plugins, significantly reduces the workload: an update tested once can be applied everywhere with the same level of confidence. Conversely, ten sites built differently require ten distinct tests.
The third is planning. A recurring, announced, and respected maintenance window is better than on-demand intervention. It allows for grouping checks, notifying users, and having the necessary time to roll back if an update goes wrong.
What Maintenance Brings to SEO
The link between the two subjects is rarely made, yet it is direct and measurable.
A site unavailable during a crawl is treated as an error. Repeatedly, this situation reduces the crawler’s frequency and delays the indexing of new content. For a site that publishes regularly, this latency has a real cost in visibility.
A slow site sees its crawl budget decrease. The crawler has a given time per domain, and a server that responds in one second allows far fewer pages to be crawled than a server that responds in two hundred milliseconds. For large catalogs, this difference determines whether new product sheets are indexed in three days or three weeks.
An unmonitored update can also modify invisible but crucial elements: blocking a resource in the exclusion file, deleting markup, changing URL structures, disabling the sitemap. These silent regressions are frequent and are only detected through indexing monitoring.
This is why we treat maintenance and organic search engine optimization as two facets of the same monitoring rather than two separate services. A position lost due to a plugin updated on a Tuesday costs as much as a position lost due to a competitor, and it is much easier to avoid.
The Case of Sites Built by a Disappeared Provider
A common and particularly uncomfortable situation. The site works, no one knows how it’s built, and the original provider is unreachable.
The first step is to recover access: WordPress administration, hosting control panel, domain name registrar, analytics accounts. This recovery can sometimes be long and requires proving ownership, which is simpler if the domain was registered in the company’s name. This is a point to check in any website specification document.
The second is an audit of the existing: what core version, what theme, what plugins, what PHP version, what modifications were made directly in the code. This last question is crucial, because a theme modified without a child theme will lose its customizations with the first update.
The third is the decision. Taking over a healthy but neglected site for maintenance costs a few days of remediation. Taking over a site built on a compromised base, with wild modifications and an abandoned theme, sometimes costs more than a website redesign. This honest evaluation is part of the job.
Maintenance According to Site Type
The useful scope varies greatly depending on what the site does, and paying the same contract for a ten-page brochure site and an eight-hundred-item catalog makes no sense.
For a brochure site, the main challenge is security and availability. Plugins are few, paths are simple, and a regression is quickly detected. Monthly monitoring with immediate security patches covers the essentials. This is the profile described in our article brochure site or e-commerce.
For an e-commerce store, everything changes scale. E-commerce plugins evolve quickly, the checkout funnel involves about ten technical steps susceptible to breaking, and unavailability directly translates into lost revenue. Verification after each update becomes mandatory, which explains the price difference. The choice of platform also influences this workload, a topic covered in our comparison WordPress or Shopify.
For an editorial site that publishes regularly, architectural monitoring is added. Each publication modifies the internal linking, each deletion leaves orphaned links, and the consistency of the structure degrades without periodic review. The principles of this review are those presented in our semantic silo method, applied in maintenance rather than construction.
How Much Does Serious Maintenance Cost?
Market rates span a range that makes comparison difficult, because the scopes are entirely different.
The cheapest offers generally cover automatic updates without testing and an unverified backup. They are better than nothing, but they protect neither against regression nor against serious incidents, because no human intervention is planned.
A comprehensive service includes human time: verification after updates, testing environment, active monitoring, and especially a commitment to intervention time in case of an incident. It is this commitment that costs, and it is what has value on the day it is needed.
The right question to ask before signing is not the monthly price but the content of three lines: what happens if the site goes down on a Saturday, how quickly will you intervene, and who pays for the restoration after a compromise. The answers immediately distinguish offers.
Key Takeaways
Maintenance is not justified by what it visibly provides, but by what it prevents. It is insurance, and like all insurance, it seems useless until disaster strikes.
Three elements differentiate a useful contract from a billing line item. Security patches applied without delay, because the window of exposure is measured in hours. Externalized and truly tested backups, because an un-restored backup doesn’t exist. A commitment to intervention time, because that’s the only thing that matters on the day of the incident.
If you don’t have a contract, start with the five free actions: two-factor authentication, deletion of unused plugins, monthly updates, PHP version check, annual restoration test. They cover the essential common risks, and they will give you a clear idea of the actual work involved in monitoring a site.
