A WordPress maintenance plan should tell you what gets updated, what gets tested, how the site can be restored and who acts when something goes wrong. Those details matter more than the length of the feature list. A site can pass an uptime check while its contact form or checkout is broken.

Use this guide to compare plans for your own website or for the sites you manage on behalf of clients.

1. WordPress updates and post-update testing

Routine maintenance covers WordPress core, plugins and themes. Before a higher-risk update, review release notes and compatibility requirements, confirm there is a recent backup and test on staging where available. A major WooCommerce release or a PHP version change deserves more preparation than a routine patch. Set the update order around the dependencies on your site.

After the update, check the live pages and workflows customers rely on. Open representative pages, send a test form submission and verify it arrives, or test cart and checkout on a shop. Agree in advance how the provider handles a failed update, including who rolls it back and when a compatibility fix needs a separate quote.

2. Backups and a tested restore process

A recoverable WordPress backup needs both the database and the files. The database holds content and settings, while the files include plugins, themes and uploads. Ask where backups are stored, how long they are retained and who checks that new backups are completing. Keep a copy separate from the server hosting the site.

Ask how often restores are tested, who performs them and whether recovery is included in your plan. A restore to staging can confirm that the backup opens and key functions work. Match backup frequency to the amount of data you can afford to lose. On an active store, restoring an older database can overwrite orders, customer changes or subscription activity recorded since that backup.

3. Security monitoring and incident response

Look for checks for known plugin and theme vulnerabilities, malware scanning and a process for reviewing alerts. A useful review also flags abandoned software, unnecessary administrator accounts and risky settings. Check dependencies before removing a plugin or theme, especially a parent theme required by an active child theme.

Ask who investigates an alert and which actions the plan covers. Monitoring can flag suspicious activity. A compromised site may need containment, malware removal and recovery, with its own scope and quote.

4. Uptime alerts and performance checks

Uptime monitoring checks a URL from outside your website and alerts someone when the check fails. Confirm which URLs are monitored, who receives alerts and what happens outside working hours. Agree response expectations separately from the monitoring itself.

Routine performance checks can flag a page that slows down after an update. Work such as rebuilding templates, reworking caching or improving Core Web Vitals across a site usually needs its own diagnosis and scope.

Want someone to handle the routine checks? See what WPFixit’s ongoing WordPress maintenance covers. If you run a shop or rely on a particular integration, agree which customer workflows need checking before you choose a plan.

5. WooCommerce maintenance

Agree which parts of the buying process will be checked after relevant updates. For a typical store, that means adding a product to the cart, checking shipping and tax for a representative order, and testing checkout. Where available, use a staging store with a payment gateway’s sandbox and prevent test emails, fulfilment actions and other integrations from reaching real customers.

Review theme template overrides when WooCommerce changes the templates they rely on. If you use subscriptions, memberships or custom integrations, agree the workflows and test frequency explicitly. Opening the checkout page confirms it loads. A test transaction checks more of the purchase path, while renewals and webhooks may need their own tests.

6. Elementor maintenance

Check that Elementor, Elementor Pro and any third-party add-ons are compatible before higher-risk updates. Afterwards, review representative pages on desktop and mobile, including Theme Builder templates such as headers, footers or product pages. If Elementor handles enquiries, submit a test form and verify delivery. New layouts, template redesigns and bespoke fixes should have an agreed scope.

7. Site access and reporting

Give the provider a named account with only the access the work requires. Use secure credential sharing, restrict access to staging copies and backups, and agree how customer data will be handled. Remove access when the work ends.

A useful monthly report says what changed, what was tested, which alerts need attention and what remains open. It should flag deferred updates and give you a next action where a decision is needed. If you manage client sites, ask for a sample report you can use in your own client updates.

What usually costs extra

Routine maintenance is scheduled upkeep. Ask the provider to document how they scope and approve work outside that schedule. Common examples include:

  • Development and content work. New pages, redesigns, custom features and complex integrations usually need a separate quote. Some plans include a limited allowance for small changes.
  • Emergency repairs. Urgent outage recovery, extensive incident response and full malware removal may be billed separately. Check response hours and who authorises the work.
  • Specialist work. Major performance projects, advanced payment or subscription troubleshooting, and repairs involving custom or third-party code may require a separate assessment or an agreed specialist plan.

Where a plan includes support time, check which tasks qualify, whether time rolls over and how extra work is approved.

Questions to ask before buying a care plan

  • What will you test on my site after an update?
  • When was the last successful test restore, and who handles recovery?
  • Who acts on an alert, and during what hours?
  • Can I see a sample report and the written scope for extra work?

Choose the right WordPress care plan

Compare WPFixit’s WordPress care plans to see what’s included for routine upkeep, technical support and specialist care. If you’re unsure which plan fits, send us your website URL and tell us which workflow matters most, whether that’s checkout, renewals or customer enquiries.

See pricing for costs or agency WordPress support if you look after client sites. For an existing, clearly scoped issue, see the Quick WordPress Fix.