How to choose a WordPress maintenance service: what to compare and what to ask

A WordPress maintenance service applies updates, keeps backups, watches the site and makes small changes, for a monthly fee. On a sales page the offers look alike. They differ in what happens after an update, in whether a backup has ever been restored, in the hours a person reads requests, and in what you hold when you leave.

To choose one, put the same written questions to each service and check the answers against things you can see yourself: the Updates screen, a copy of a backup, the list of users. This page gives the questions and the checks. It is not a list of companies and it ranks nobody. The questions are the same whoever you put them to.

Do you need one at all

Not every site does. The work is a routine: a weekly round of updates, a look at the site and a check that backups ran, with slower checks each month, quarter and year. The WordPress maintenance checklist lists each task and what fine looks like.

Doing it yourself is enough when all three of these are true:

• The site is small and changes rarely, and a page broken for a day would be a nuisance, not lost sales.
• A backup plugin runs on a schedule and keeps its copies away from the site's server. WordPress backup plugins compared covers the choice.
• Someone has a regular slot in the calendar for the round, keeps to it, and knows how to update safely.

WordPress does part of the work itself. An administrator can switch on automatic updates one plugin and one theme at a time. By default WordPress then runs them twice a day and emails the site owner to say what was updated and what failed. Its documentation suggests making sure you can go back to an earlier version of the site before you turn them on, in case things go wrong. Nobody looks at the site after an automatic update.

A service is worth its fee when nobody will do the routine, when the site takes orders or inquiries and a fault costs money by the hour, or when nobody on your side could bring the site back from a backup. The WordPress maintenance cost calculator adds up what looking after the site yourself costs each month in time and tools, from figures you type in.

What a maintenance service does

Take away the plan names and the work is six lines.

• Updates to WordPress, the plugins and the themes, with a look at the site afterward and a way back when one goes wrong.
• Backups of the database and the files, kept away from the site's server, and restored when you ask.
• Monitoring. A program requests the site at a set interval and alerts someone when it does not answer.
• Security scanning, and telling you what was found.
• Small changes you ask for, up to a stated amount of time.
• A report of what was done.

WordPress's own documentation explains why. Older versions of WordPress are not maintained with security updates. A full restore needs both the database and the files. Prevention is sometimes not enough, so its hardening guide calls watching for intrusions very important.

Hosting, cleaning up after a hack and building new features are separate work. A plan may include one of them or none, so ask about each.

The differences that matter

Each difference below comes with what to ask and how to check the answer.

What "updates" means

Updates can be applied by a program on a schedule, or by a person who then looks at the site. WordPress already does the first at no charge. What you pay a service for is the look afterward and the way back.

Ask. How often are updates applied? Who looks at the site afterward, and at which pages? When an update breaks something, is it undone, and is that part of the price? Are updates tried first on a staging copy?

Check. After a round, go to Dashboard, then Updates. Nothing should be waiting. The screen reads "Your plugins are all up to date." and "Your themes are all up to date."

Backups

WordPress's documentation says to keep at least three to five recent backups, with copies in different places, and to back up a busy site daily.

Ask. How often is a backup taken? Does it hold both the database and the files? Where is it stored? How long is each one kept? Is a restore included, and can I have a copy when I ask?

Check. In the first month, ask for the newest backup as a download, or for a restore to a private copy of the site. A service that cannot produce either has answered the question.

The allowance for changes

Ask. How many minutes or hours a month? What counts as a small change? Does unused time carry over? When the time runs out, does work stop, get quoted, or get billed by the hour, and am I told first?

Check. The number is in the written terms and not only on the sales page, and each report says how much of it was used.

Hours of cover, and how long a reply takes

A reply is not a fix. A service that answers within an hour may still take days to do the work, so ask about both.

Ask. On which days, between which hours, in which time zone, does a person read requests? How long until a reply? How long until work starts? How do I report a site that is down, and what happens outside those hours?

Check. Send a real question before you buy. Note when the answer comes and whether a person wrote it. Treat that as the best case.

Who does the work, and where

This is a fair question to put to any service, in any country. You are handing over the keys to the site, and you are entitled to know who holds them.

Ask. Who does the work: your own staff, contractors, or another company working under your name? Which country and time zone are they in? How many people will be able to use my logins?

Check. The answer should agree with the hours of cover. A team whose working day does not overlap yours should be able to say who reads requests during your day, and when.

What is not included

Ask. Is hosting part of the plan? If the site is hacked, is the clean-up included, quoted or refused? What about new pages, new features and a redesign? Who buys and renews the licenses for paid plugins?

Check. Ask for the exclusions as a written list. A plan with no list still has exclusions. You will meet them on an invoice.

Access

Applying updates takes an Administrator account. In WordPress's own table of roles, only an Administrator on a single site can update WordPress, plugins and themes, and the same role can add and delete users. So the service's access cannot be narrowed by role. It can be kept to an account of its own.

Ask. Which logins do you need, and why each one: WordPress, hosting, DNS, the domain registrar? How are passwords stored, and who can read them? How is access removed when I leave?

Check. Create a separate Administrator account for the service. Do not share your own. On the Users screen you can see that account, and delete it on the day the plan ends. The checklist's monthly review of who can log in has the steps.

The contract

Ask. Is there a minimum term? How much notice ends the plan? Is there a refund, for how long, and on what conditions? What is handed back at the end: the newest backup, the logins, anything registered in your name for my site?

An administrator can read whatever personal data the site holds, such as customers, orders and form entries. Where the GDPR applies to your business, the European Data Protection Board's guide for small businesses says the relationship with a processor, meaning a party that handles personal data on your behalf, must be governed by a contract. Under it the processor acts only on your instructions, brings in no other processor without your written authorization, and deletes or returns the data when the service ends. Whether you need such a contract is a question for a lawyer. Whether the service can supply one is a question for the service.

Check. Read the terms before you pay. Where the terms and the sales page disagree, the terms are what you bought.

A store or a membership site

WooCommerce's own guide to updating says to check the store afterward: add a product to the cart, place a test order with a test payment method, and check the shipping, tax, payment and email behavior the store depends on.

Ask. After updates, does someone place a test order? On a membership site, does someone log in as a member and open a protected page? How often are orders backed up, given that a daily backup can be a day of orders behind?

Check. Ask to see the last test order. An order placed as a test is in the store's list of orders, with a date.

Reports

Ask. What does the report hold, and when is it sent?

Check. Read one against the site. The versions it lists should match the Plugins screen, or the Info tab under Tools, then Site Health, which gives the version of every active plugin. The backup it names should be one you can ask for. The monthly maintenance report template shows a report in which every figure comes from a record.

Warning signs

• A guarantee that the site will never be hacked or never go down. WordPress's hardening guide says security is risk reduction, not risk elimination. A service can promise the work, and say what it does when something goes wrong.
• Cover "around the clock" with no named hours. Ask who is reading requests in the middle of their night. If the answer is a monitor and not a person, the sales page should say so.
• Work "without limit". An allowance with no number still has a limit. Ask where it is: the size of one task, how many can wait at once, how long each takes.
• Lock-in. The hosting account, the domain or the plugin licenses are in the service's name. Leaving then means asking permission to take your own site. Keep each account in your business's name and give the service access to it.
• Reviews and client logos you cannot trace. A review with a full name and a business you can find is evidence. A first name beside a quote, or a row of logos with no links, is not. Ask for a client you can contact.

The questions to copy and send

Send the same list to every service you are considering, and compare the written answers side by side.

Each of the sixteen has a short, factual answer. A reply that passes over one has told you something. The care plan proposal template, written for agencies that sell these plans, shows what a clear offer looks like from the other side of the table.