Should you outsource WordPress maintenance? A decision guide for agencies and freelancers

Outsource WordPress maintenance when the work is routine, repeats across many sites and does not need what you know about the client. Updates, backups, monitoring, scanning and reports are that kind of work. Keep what does need you: the relationship, the decisions about each site, and anything the client expects from you in particular.

Three ways to get the work done

Every client site needs the same round, which the WordPress maintenance checklist lists. As the list of sites grows, there are three ways to get through it.

Which is cheapest depends on your own numbers. The care plan margin calculator works out what your agency keeps each month from the care plans it sells: what clients pay, less what the work costs you. Run it once with your own hours as the cost, and once with a partner's fee.

When outsourcing is the right choice

• The work is the same on every site. Standard themes and well-known plugins, updated in the same order and checked the same way.
• Maintenance takes hours you could sell as projects, and you have the projects. If nothing fills the freed hours, you have swapped your time for a fee.
• You are the only person who can do the round. It waits when you are ill and comes with you on vacation.
• The price of your plans covers a partner's fee and the time you will spend checking the work, and still leaves a margin.
• You are about to hire only for maintenance, and the sites do not yet fill a job.

When it is the wrong choice

• You have a handful of sites and enjoy the work. There is no problem to solve. A partner adds a fee, and someone to manage.
• The sites are heavily custom and nothing is written down. On a site it does not know, a partner cannot tell which update is the dangerous one. Document those sites first, or keep them and hand over the standard ones.
• Clients were promised that you personally do everything. Change the promise openly, or keep the work.
• The plan's price leaves no margin after a partner's fee. That is a pricing problem, and outsourcing does not fix it.
• You will not check the work. Outsourcing moves the doing. The client still holds you responsible for the result.
• A client's agreement rules it out. Some bar subcontracting, or name the people who may have access.

What to hand over and what to keep

Hand over work that is routine, the same on every site, and leaves a result you can check from outside.

• Updates to WordPress, plugins and themes, with a look at the site afterward and a way back.
• Backups. WordPress's documentation says a backup has two parts, the database and the files, and that you need both to fully restore a site.
• Uptime monitoring.
• Security scanning. WordPress's hardening guide says prevention is sometimes not enough, and calls monitoring for intrusions very important.
• The figures for the monthly report.
• Small edits against a written brief: swap this image, change this sentence on this page. Not every partner's plan includes them. WP Ministry's white label plan, for one, has no edit time, and a block of agency hours each month can be added to it.

What WordPress maintenance includes describes each of these jobs and the trace it leaves on a site.

Keep whatever depends on knowing the client.

• The relationship. The calls, the renewal and the bad news.
• Decisions about the site. What to build next, which plugin to replace, whether to move host.
• Design decisions. Anything where the brief would be "make it look better".
• Anything that needs a conversation with the client. A vague request becomes a clear one because you asked.
• Emergencies in which you decide what the client is told. A hacked site, lost orders, personal data exposed. A partner can do the technical work. What the client hears, and when, is yours.
• The accounts. Hosting, the domain and plugin licenses stay in the client's name or yours. A partner gets access to them, not ownership.

How to judge a partner without taking their word for it

Each question below comes with a way to check the answer. A site owner choosing a service for one site has a list of their own, in how to choose a WordPress maintenance service, and most of it applies to a partner too.

A sample report

Ask for a real report from a recent month with the client's name removed, not a designed sample.

Check that every line is something you could verify on a site: a version number, the date of a backup, an uptime figure with its period. The monthly maintenance report template shows a report in which every figure comes from a record.

A trial on two or three sites

Ask to start with two or three sites before you move the list.

Check by making one of them your own agency's site, where you will notice everything and no client is exposed. After each round, open Dashboard, then Updates. Nothing should be waiting, and the screen reads "Your plugins are all up to date." Under Tools, then Site Health, the Info tab gives the version of every active plugin. Compare it with the report.

How updates are tested, and what happens when one breaks a site

WordPress's own instructions for upgrading say to back up the database and the files first, and then: "Verify the backups you created are there and usable. This is essential."

Ask. Is a backup taken before every round? Are updates tried first on a staging copy, on every site or only on some plans? Who looks at the site afterward? When an update breaks a site, is it rolled back, is that part of the price, and who is told?

Check. Ask for the address of the staging copy of one trial site, and open it. Ask for the record of one round: when the backup was taken, what was updated, which pages were looked at.

Where backups are kept, and a restore you watch

WordPress's documentation says to keep at least three to five recent backups, with copies stored in different locations.

Ask. Where are backups stored, and in whose account? How long is each kept?

Check. Ask for one trial site to be restored to a private copy, and for its newest backup as a download. A partner that has never restored one of your sites has shown you nothing about its backups.

Who exactly will have access

Ask for names, not "the team". How many people will be able to log in, and which country do they work from? Does each log in as themselves? Where are credentials stored? What happens to a person's access when they leave the partner?

Check against the accounts. If you create one account per named person, as the next section describes, the Users screen is the list of who can log in.

The hours actually staffed

Ask. On which days, between which hours, in which time zone, does a person read requests? When an alert arrives outside those hours, does a person see it, or does a monitor record it until morning?

Check. During the trial, send a request at a time when you would really need an answer, and note when a person replies.

Whether they ever contact your clients

Ask. Does any email, alert, report, invoice or screen in the dashboard show the partner's name to a client? Which address do reports come from? What do the partner's staff do if a client writes to them directly? Does the agreement say the partner will not approach your clients, during the arrangement and after it?

Check. On a trial site, put an address of your own where the client's would go, and read everything that arrives, including the sender's domain. Then look at the dashboard as a client would. Branding on a report does not reach the Plugins screen, which names every plugin installed, or the Users screen, which shows each account's username, name and email.

How you leave

Ask. Is there a minimum term? How much notice ends it? What is handed back, and when are the partner's copies of backups and credentials deleted?

Check. Read it in the terms before you start. Keep hosting, domains and licenses out of the partner's name. Leaving is then a matter of deleting accounts, with no sites to move.

Put the answers in a written agreement, because a conversation is not something you can hold a partner to. At the least it should settle who may contact your clients, who holds access and how it is removed, what the partner does when its work breaks a site, confidentiality, the notice period, and what is returned or deleted at the end.

Handing over access safely

WordPress's hardening guide warns that someone who gets into an administrator account can install malicious scripts that may compromise the entire server. Two of its general ideas are limiting access and containment. For a partner, that means every login belongs to one named person, does no more than the job needs, and can be removed without touching anything else.

Taking access back when it ends

What your clients need to be told

Start with your own agreement with each client. The agreement decides this, not the name on the report. Look for a clause on subcontractors and whether it asks for notice or consent, any promise that the work is done by you or by named people, and what it says about keeping logins and data confidential. White label means the partner's name is not on the report. It does not mean your agreement lets you keep the arrangement to yourself.

An Administrator account can read whatever personal data a site holds, such as customers, orders and form entries. GDPR and WordPress lists what a site collects. Where the GDPR applies, it has rules for exactly this chain. Article 3 applies it to an organization established in the European Union, and to one outside it that offers goods or services to people in the Union or monitors their behavior there.

The regulation calls whoever decides why and how personal data is processed the controller, and whoever processes it on the controller's behalf a processor (Article 4, points 7 and 8). If your client is the controller and you handle its site's data on its behalf, a partner you bring in is, in the regulation's words, another processor. For that case:

• Article 28(2). A processor may not engage another processor without the controller's prior written authorization, which may be specific or general. Under a general one, the processor must tell the controller of any intended change, so that the controller can object.
• Article 28(4). The same data protection obligations that are in the contract between controller and processor must be put on the other processor by contract. If the other processor fails in them, the first processor remains fully liable to the controller.

So where the regulation applies, a subcontractor who handles personal data is a matter for both agreements: yours with the client, and yours with the partner. The European Data Protection Board's guide for small businesses puts it in one line: a sub-processor can only be appointed if the controller authorizes it in writing.

Running it once it has started

• One channel for requests. Clients write to you, or to an address in your name that you can read. The partner gets requests from one place.
• A written brief for each edit. The page's address, what is there now, what it should say instead in the exact words, who approved it, and when it is needed.
• Check the first months' reports yourself. Take two or three sites. Compare the versions in the report with the Info tab of Site Health, look at the Updates screen, and ask for a backup the report names. After that, check one site a month.
• Send the report yourself, with a line of your own. It is the client's evidence that the site is looked after, and your regular reason to be in touch.
• Agree the emergency route before the first emergency. The partner tells you, and you tell the client.
• Review access every quarter. Compare the Users screen with your record. People leave the partner too.
• Keep a page of notes per site: the host, what is custom, what must be looked at after an update. It makes the partner replaceable.

What you sell must fit what you buy. The care plan proposal template is the offer you put to a client. Before you send it, check that it promises no more than the partner has agreed to give you, in hours, in reply times and in who does the work.