How to Choose a WordPress Maintenance Company

“WordPress maintenance” means completely different things depending on who you ask. For some providers it’s a monthly plugin update and nothing else. For others it’s backups, security monitoring, uptime checks, and someone who actually answers when your site goes down. The price range reflects that gap — I’ve seen plans anywhere from $30/month to over $500/month for what’s nominally the “same” service.

Here’s how I’d evaluate a maintenance provider if I were hiring one instead of being one — what to ask, what the answers should sound like, and where the corners usually get cut.

Start with what “maintenance” should actually cover

Before comparing providers, get clear on the baseline. A real WordPress maintenance plan should include, at minimum:

• Core, theme, and plugin updates — tested before applying, not auto-applied blindly to a live site. (Skipping these has real consequences — here’s what actually happens.)
• Backups that are actually verified to restore, stored off-server, on a schedule that matches how often your content changes.
• Uptime monitoring with a real alert to a real person when the site goes down.
• Security hardening and monitoring — login protection, malware scanning, and a response plan if something gets through. I run through this exact checklist on every site.
• A response-time commitment for when something breaks, in writing, not “we’ll get to it.”

If a plan is missing more than one of these, it’s not really a maintenance plan — it’s an update script with a subscription fee attached.

Questions worth asking before you sign anything

A provider’s answers to these tell you more than their pricing page will:

• “What happens if my site gets hacked?” A provider who can describe their actual cleanup process — isolate, assess, clean, verify, harden — has done this before. A provider who says “that won’t happen with us” hasn’t, or isn’t being straight with you. (Here’s what that process looks like when I run it myself.)
• “How often do you test that backups actually restore?” A backup nobody’s tested is a backup you’re hoping works — here’s what a real test looks like. If the answer is vague, that’s your answer.
• “What’s your response time for a down site vs. a minor bug?” These should be different numbers, in writing, not “as soon as possible.”
• “Do you manage my site, or does an update-then-forget script?” Ask specifically who reviews the update logs and what triggers a manual look.
• “What’s not included?” Every plan has a scope boundary — new feature development, content changes, design work. Get it in writing before you need something outside it.

Signs you’ve outgrown DIY (or your current setup)

Not every site needs a managed plan on day one. But there’s a point where doing it yourself, or leaving it to whoever built the site, stops making sense. I’ve written about the specific signs that mark that point — the short version is: if updates are piling up because nobody has time to test them, or the site has already gone down once with no one watching, you’re past it.

How pricing actually breaks down

Maintenance pricing scales with scope, not just site size. A brochure site with a handful of pages and low traffic costs less to maintain than an e-commerce site processing orders, mostly because the second one has more that can go wrong and more urgency when it does. I’ve broken down what actually drives the cost in more detail — worth reading before you compare quotes, since two providers quoting wildly different numbers are often scoping completely different work.

Red flags

• No written scope. If you can’t get a plain-language list of what’s included, assume it’s less than you think.
• No backup testing, or vague answers about it. This is the single most common corner cut in cheap plans.
• One person, no continuity plan. Fine for a small operation (it’s how I run mine), but ask what happens if that person is unreachable when your site goes down.
• Locked-in hosting with no export path. You should always be able to leave with your site intact if the relationship isn’t working.
• Security “included” with no specifics. Ask what tools they use and what a security incident response actually looks like — a vague “we monitor for threats” isn’t a plan.

What the first 30 days should look like

A provider worth keeping should, in the first month: run a full site audit (not just “looks fine”), confirm backups are actually restoring, apply any overdue updates carefully rather than all at once, and give you a clear picture of what they found. If a month goes by and the only thing that’s happened is an invoice, that’s worth asking about.

Frequently asked questions

What questions should I ask before hiring a WordPress maintenance company?

Ask what happens if your site gets hacked, how often they test that backups actually restore, their response time for a down site vs. a minor bug, whether a person actually reviews update logs, and what’s explicitly not included in the plan.

How much should I expect to pay for WordPress maintenance?

Plans typically range from $30/month for mostly-automated budget tiers to $500+/month for premium, business-critical coverage. I’ve broken down what actually drives that range in more detail.

What’s the biggest red flag when evaluating a provider?

No written scope, or vague answers about backup testing. If a provider can’t tell you plainly what’s included and can’t describe how they actually verify backups restore, assume you’re getting less than you think.

What should happen in the first month with a new maintenance provider?

A full site audit, confirmation that backups actually restore, careful handling of any overdue updates, and a clear report of what they found. If the only thing that’s happened by month’s end is an invoice, that’s worth asking about.

Where I fit into this

I run WordPress maintenance the way I’d want it run on my own site — updates tested before they go live, backups I’ve actually verified restore, and a security process I can walk you through in plain language rather than hide behind a dashboard. Here’s what that looks like and what it costs, or get in touch if you’d rather just ask me directly whether it’s the right fit for your site.