Does your web host maintain your WordPress site? What hosting covers and what is left to you

Your host is responsible for the server: the hardware, the network, the web server software, PHP and the database server. What happens inside WordPress is mostly yours unless your plan says otherwise. That means plugin and theme updates, checking the site after them, a plugin that breaks a page, and the content itself.

Managed WordPress hosting covers more than shared hosting, but rarely everything, and two managed hosts can answer differently for the same job. Sometimes the host's plan is enough. This page shows how to find out for yours.

Where the host's job ends

WordPress's security documentation draws the line this way: web hosts are often responsible for the infrastructure a site sits on, and not for the application installed on it. It asks site owners to understand where the host's responsibility ends and theirs begins.

Three kinds of service come up on this page.

• Shared hosting puts your site on a server that hosts other websites besides yours.
• Managed WordPress hosting is a plan built around WordPress, where the host takes on some of the work inside it. "Managed" has no fixed meaning: each host defines it in its own documents.
• A care plan is a service, sold apart from hosting, that does the work inside WordPress: updates, backups, checks and fixes.

Who does what

The last column is what our own plans include, as listed on the WordPress maintenance service page. Another provider's plan will differ, so read its list the way you read your host's.

"Varies" fills much of the table because it is the true answer. The next section shows how far the answers spread.

What hosts say about their own plans

Hosts publish what their support covers, often on a page called "scope of support". Each statement below comes from that host's own documentation as it stood in October 2026, and is about that host only. Plans change, so read the page for your own plan. Where a host's terms are cited, this page reports what they say and is not legal advice.

Updates

WordPress does part of this itself, on any host. By default it installs its own maintenance and security releases in the background, and a site first installed on WordPress 5.6 or later gets major releases the same way. Plugins and themes update on their own only where an administrator has switched that on, one plugin or theme at a time. WordPress's documentation notes that a hosting company can switch those controls off.

Hosts then differ.

• SiteGround says its managed WordPress service includes automatic updates of the WordPress core and of free plugins. Updating plugins along with WordPress is an option in its updater's settings, and the updater saves a backup of the site each time it runs.
• WP Engine updates WordPress core automatically. Security and maintenance releases cannot be put off, and a major release can be deferred for 30 days. Its update program requests the site before and after an update and tries to roll back if the site does not answer normally afterward. It leaves plugin and theme updates to the customer's discretion and offers an automated update service for them separately.
• Kinsta says it does not provide updates for WordPress core, and that customers are responsible for installing, updating and removing plugins and themes. It sells automatic plugin and theme updates as an add-on. The add-on compares the home page and four other pages before and after, and restores a backup taken before the update if it finds a problem.

Where a host tests after an update, the test is automated: whether the site answers, or whether a handful of pages look the same. WP Engine's own page notes that an update can leave a feature incompatible with a plugin or theme without breaking the site. A form that stops sending or a checkout that stops taking payment is still yours to notice. How to safely update WordPress, plugins and themes has the routine.

When the site breaks

Each of these hosts separates a fault in the server from a fault in the site.

• SiteGround calls keeping its platform running its most essential responsibility. When its servers are up and a website is down, it says it may or may not be able to help. Problems that come from the website itself, such as code that causes errors or a conflict between parts of the site, are outside its support scope.
• Kinsta will help identify the PHP file behind a fatal error and disable the plugin or theme at fault to get the site back online. Fixing the code is left to that plugin's or theme's developer.
• WP Engine gives limited support for third-party plugins and themes: it helps identify issues on the server side and reads the logs. Plugin and theme bugs, and conflicts with WordPress core or custom code, are outside its scope.
• Bluehost says its support does not fix errors caused by third-party plugins or alter custom code. It can help identify the issue, and restore a backup or revert a change if one is available.

So the usual help is finding the fault, and sometimes switching off the plugin behind it. The repair is yours. How to tell whether the fault is the host or the site covers the faults that are the host's to fix.

Malware

• SiteGround fixes problems that arise from its own maintenance of server security, such as an exploit in the server software. Sites hacked through weak or leaked passwords, old website software or malware, which it places under the owner's full control, are not covered. It advises restoring from a backup and contacting cleanup professionals.
• Bluehost's user agreement has the customer use best efforts to keep their content free of malicious code. Its help pages say a compromised site may be suspended temporarily to protect the server, and that the owner is given the opportunity to clean the infection.
• Kinsta has a security pledge: if a site is hacked while hosted there, it works with the owner at no charge to try to undo the damage. The pledge excludes sites with nulled plugins or themes, and the owner must finish the follow-up steps within one business day to stay covered. It inspects only sites that show specific evidence of an infection.
• WP Engine scans and cleans a site that becomes infected while on its platform. It will not submit a site for a scan without a specific indication of infection, and it does not clean a site that arrived already infected.

Where a host cleans, it cleans on conditions, and it acts once there is evidence. Noticing is still yours. How to check whether your WordPress site has been hacked has the checks you can run yourself.

Monitoring, speed and edits

• Monitoring. Kinsta checks each site every three minutes. If a site is not loading because of its infrastructure, its engineers respond. If the cause is in the site, such as a plugin conflict or a code error, it notifies the owner, and the fix is outside its scope.
• Speed. SiteGround says performance problems caused by slow PHP code or database queries are outside its scope. Kinsta investigates a repeatable performance problem to rule out the server and the platform, and lists optimizing a site for speed tests as out of scope. WP Engine lists slow WordPress performance and performance audits among the things its support covers.
• Edits. Kinsta lists changes to a site's content, appearance and functionality as work for a developer. Bluehost's support does not modify HTML, CSS, JavaScript or PHP.

The WordPress site health check shows what one page answers to a request from outside right now. It is a single look, not monitoring.

A host's backup is not a backup you control

WordPress's documentation says most hosts back up the entire server, that requesting a copy of your site from those backups takes time, and that owners need to learn to back up and restore their own. It recommends keeping at least three to five recent backups in different places: for example one on the hosting server, one in cloud storage and one on your own computer. By that advice, the host's copy is one of three.

Here is what five hosts publish about their own backups, in alphabetical order.

A sixth host, Bluehost, describes its backups as a courtesy and says it is not liable for the data on an account. Its user agreement makes backing up the customer's sole responsibility.

What to check about yours

• How often. A weekly backup can cost you up to a week of orders, posts and form entries.
• Kept how long. A problem found after the oldest copy has gone cannot be undone from the host's copies.
• Both parts. WordPress's documentation says a full restore needs the database and the files. DreamHost's file restore on shared plans, for one, leaves the database as it is.
• Stored where. A copy on the same machine as the site shares that machine's fate. Kinsta says its backups sit on the same host machine as the site, and sells copies to your own cloud storage as an add-on.
• Who restores, and at what cost. Most of the plans above let you restore from the panel. One restores on request, for a fee.
• Whether you can take a copy away. WP Engine says its backups cannot be sent to another service automatically, though you can download one. Kinsta and WP Engine both disallow some backup plugins, and both allow tools that send backups to storage elsewhere.
• What happens when the account is the problem. Bluehost says backups are not given to accounts that have been suspended or terminated, unless it agrees otherwise in writing. SiteGround says deleting a site ends access to its backups. Kinsta keeps a deleted site's backups for 14 days.
• Whether a restore was ever tested. WordPress's documentation recommends making a manual backup once in a while to be sure the automatic ones work. Hostinger's own documentation advises downloading a copy and testing restores occasionally.

A backup you control is one you hold a copy of, outside the host, and have restored once. How to schedule automatic WordPress backups shows how to prove that a backup restores, and WordPress backup plugins compared covers the tools that send copies to storage of your own.

The ten-minute check

WordPress's guidance for a hacked site tells owners to ask the host what its backup policy is. Ask before that day, and ask about the rest at the same time.

An answer that does not name your plan, or does not say who does the job, is not an answer yet. Ask again, or ask for the page it comes from.

What to conclude

When the host's plan is enough

You do not need a care plan if the answers come back like this:

• the host updates WordPress core, plugins and themes, including the plugins you paid for;
• something tests the site after each update, and you are willing to look at the pages that earn you money yourself;
• backups are daily, hold both parts, are kept for weeks, sit away from the site's server, and can be restored by you;
• the host cleans a hacked site, on conditions you can meet;
• you have someone to call when a plugin breaks a page.

Add two things and you are covered. Download a backup once a month and keep it somewhere else. Restore one to a staging copy once, so you know it works.

What is left over when it is not

Going by the hosts' own documents, these are the jobs that most often stay with the owner:

• plugin and theme updates, above all for plugins bought outside WordPress.org;
• looking at the site after an update, beyond whether it loads;
• repairing what an update or a conflict broke;
• a second copy of the backups, outside the host;
• cleaning up after a hack when the host's conditions are not met;
• content edits, and speed work in the site's own code.

There are three ways to cover them. Do them yourself, on a schedule. Hire a developer each time something breaks. Or hand the routine to a care plan. Ours is the WordPress maintenance service: a monthly care plan that keeps one WordPress site updated, backed up, monitored and scanned, and restores it if an update breaks it. Hosting is not part of a plan, so it works beside your host and does not replace it.