WordPress maintenance is not a task you finish. It is the day the site launches, forward.
A plugin update notice shows up in your dashboard on a Tuesday. Click it, and either nothing happens and you move on, or the site throws a blank white screen and you are troubleshooting a live outage before lunch. That small recurring moment, across WordPress core, the theme, every installed plugin, and the backups and security sitting underneath all of it, is what WordPress maintenance actually is. It starts the day a site launches and runs until the day it comes down, and it gets heavier as a site ages, because there is simply more installed on it by then. Below is what the job breaks into, what it costs in hours and dollars, and where a managed platform like Devani Hosting takes most of the list off the table by not carrying a plugin stack in the first place.
Seven things that keep a WordPress site alive, none of them optional.
From a single-page brochure site to an install running thirty-plus plugins, the pattern holds: the sites that stay fast, secure, and up are the ones where this list is somebody's real schedule, not a stack of unread notification emails.
- Update WordPress core, the theme, and every plugin, on a cadence. Core is the easy part: releases ship often but are usually well tested and rarely break a working site alone. Plugins are the workload. A typical small-business site runs fifteen to thirty active plugins, each shipping updates on its own schedule, so there is almost always something new in the queue every week. An unpatched plugin with a known vulnerability is one of the most common ways a site gets compromised, so the queue is not optional to skip.
- Test updates on staging before they go live. You do not apply updates to a live site and hope. A responsible process clones the site, applies the pending updates on the copy, and checks that pages render, forms submit, and anything transactional still works before pushing to production. That check is real time, thirty minutes to a couple of hours for a modest site, not a formality.
- Run automated backups, stored off the server, and actually restore one. Daily backups with a week or two of retention is a reasonable baseline; frequent changes or transactions deserve more. The detail nobody checks until it is too late is whether a backup has ever been restored. A backup that has never been tested is a hypothesis, not a safety net.
- Keep security ongoing, not a launch-day setting. Regular malware scans, monitoring login attempts for brute-force patterns, enforced two-factor on admin accounts, a short admin-access list, and reviewing logs rather than assuming silence means safety. A firewall is a layer, not a replacement for keeping the software patched.
- Watch uptime so you know before your customer does. Something has to actively check the site is up right now and alert if it is not. Without it, the first sign of a problem is a customer email or a missed order, hours or days late.
- Be ready to recover a broken plugin, because "safe update" is not really a thing. Even with staging, updates break sites. Recovery is its own skill: deactivate plugins one at a time, reload after each, isolate the culprit, then roll it back or open a support ticket. On an older or customized site this is a genuinely difficult debugging session.
- Keep performance up, because a fast site does not stay fast on its own. The database fills with revisions, spam, and expired transients; new content means new images to optimize; caching needs purging after changes; and every update is a chance for a quiet regression. Watching real Core Web Vitals over time is part of the job.
Plugins are the workload, and the queue never actually empties.
A typical small-business WordPress site runs somewhere between fifteen and thirty active plugins: a form builder, an SEO plugin, a caching plugin, a security plugin, a page builder, a handful of specific-purpose add-ons, and usually at least one thing nobody remembers installing. Each ships updates on its own schedule, and across a stack that size, there is almost always something new waiting. I have maintained sites where the list never empties. You clear a batch on a Monday and there are three new updates waiting by Thursday. Themes update less often, but when a theme is built on a major page-builder framework, a theme update and a page-builder update can land close together and interact in ways neither vendor tested for.
The part that separates a maintenance routine from a pile of notifications is testing. Clone to staging, apply the pending updates there, and confirm the pages render, the forms submit, and anything transactional, checkout, a booking, a membership gate, still works before the same updates touch production. Skipping the staging step saves that time in the moment and loses it, plus a lot more, the first time an update conflict takes the live site down during business hours. The staging step is the one nobody regrets doing.
A backup that has never been restored is a hypothesis, not a safety net.
Backups are only real the moment you restore one.
Every routine needs automated backups on a schedule, stored somewhere separate from the server so a single hosting failure cannot take out the site and its backup together. The detail that actually matters, and the one most site owners never check, is whether a restore has ever been run. I have seen a "we do backups" setup turn out to be a single nightly snapshot silently failing for weeks, because a plugin update had broken the backup plugin's own cron job and nobody noticed until a restore was needed and there was nothing usable to restore from. Testing a restore, even once a quarter, is the difference between a backup and a false sense of security.
The four jobs that do not end at launch.
Security monitoring
Locking a site down once at launch is not keeping it secure. Ongoing means malware scans, watching login attempts, enforced two-factor, a short admin list, and reviewed logs. A site with a current update queue and a clean access list is a far smaller target than one running six-month-old plugins with three admin accounts nobody remembers creating. The specific ways sites actually get breached are their own topic and deserve a proper look.
Uptime monitoring
Something has to be watching whether the site is up right now, with an alert if it is not. I once watched a client's disk quota fill quietly over a long weekend, not from an attack but from an unpruned error log and a database table nobody had ever cleaned, and the site was down for two full days before anyone noticed. Monitoring would have caught it in minutes. The gap between "something broke" and "someone found out" is entirely a maintenance question.
Broken-plugin recovery
Updates break sites often enough that recovery is a skill, not an edge case. I once traced a homepage outage to an SEO plugin and a caching plugin that both hooked into the same part of WordPress and fought over it, about six hours down until we isolated which two were responsible. A plan that covers "apply updates" but not "fix what an update breaks" is missing the part that actually costs money.
Performance upkeep
The number you got approved at launch is not the number six months and forty plugin updates later. The database bloats, images pile up unoptimized, caching serves stale pages, and any update can quietly regress performance. Watching Core Web Vitals over time is the maintenance side of the same problem covered in why a WordPress site actually slows down.
What steady-state maintenance actually costs, before anything breaks.
This is the price of keeping a WordPress site current, not the price of a crisis. That total assumes nothing has gone wrong yet.
| How it is covered | Typical cost | What that buys |
|---|---|---|
| Your own hours (DIY) | 2 to 5 hours/month | Updates, backup checks, a monthly security review on a modest site, and considerably more the month something breaks |
| Professional maintenance plan | $100 to $1,000/month | Low end is update-and-backup; the higher end adds security monitoring, performance work, and priority support |
| Ecommerce maintenance | $500/month and up | A broken checkout is direct lost revenue, not just an inconvenience |
| Managed WordPress hosting | $30 to $100/month | Usually a separate line item from the maintenance plan, even when one company sells both |
| Devani Hosting | Free tier, paid plans scale | No plugin stack to patch, so there is no separate maintenance plan to buy on top of the hosting |
Add it up and a disciplined DIY owner on a modest site is realistically spending two to five hours a month when nothing breaks, while professional plans run roughly $100 to $1,000 a month depending on coverage, plus another $30 to $100 for the managed hosting underneath. That is a lot of homework for something that is supposed to just sit there and work.
Every task above exists because three separate things drift out of sync.
WordPress, the theme, and the plugin ecosystem are three separate things built by different people, drifting apart unless someone actively holds them together. That is the reason there is an update queue, a staging test, and a broken-plugin recovery process at all. Take away the plugin layer and most of the list stops being a recurring job.
That is the actual shape of Devani. There is no third-party plugin marketplace and no separate theme layer on top of the CMS, so there is no weekly queue to clear, no staging pass for a plugin combination nobody has tried, and no all-day debugging session hunting which of forty plugins broke the homepage, because there is no plugin stack to break. Devani Hosting handles what is left: the platform stays current on its own, backups run automatically with one-click rollback, SSL renews itself, and a global CDN serves media without a caching plugin to configure or purge. A free tier gets a site live on a free subdomain (yoursite.devani.io) in under a minute; paid plans add custom domains, more sites, more CDN storage, and multi-site tooling for anyone running several client installs from one login. Worth saying plainly: the CMS itself is free and open-source, so running it on your own server for about $5 a month, on your own update schedule, is always an option instead of the managed side.
Keep maintaining the WordPress stack
Everything you already depend on keeps working. Someone has to hold it together.
- ✓ Every plugin, custom theme, integration, and developer relationship the business already runs on carries straight over; lift-and-shift of the existing install, with a provider who knows it
- × The update queue, staging pass, backup checks, and broken-plugin recovery are permanent recurring work, two to five DIY hours or $100 to $1,000 a month, before anything breaks
Devani Hosting
Most of the list stops being anyone's recurring job.
- ✓ No plugin marketplace or separate theme layer, so no weekly queue and no untried-combination staging pass; platform stays current on its own, automatic backups with one-click rollback, SSL renews itself, global CDN for media, free tier live in under a minute
- × Hosts sites built on Devani, not an existing WordPress install with its plugin stack carried over, and it is a younger, smaller ecosystem than WordPress
The limit matters more than anything above it: this hosts sites built on Devani, not an existing WordPress install with its plugin stack pointed at new DNS. If a specific plugin, a custom theme, or a developer relationship built around that ecosystem is load-bearing for the business, a real WordPress maintenance provider, and what WordPress is actually like to maintain long-term, is the better call, full stop. Devani fits someone open to rebuilding on a platform where there simply is not a plugin stack to keep patched, in exchange for most of the list above no longer being anyone's recurring job.
What people ask before committing to a plan.
How much does WordPress maintenance cost per month?
Professional plans for a small-business site typically run $100 to $1,000 a month depending on coverage. Basic update-and-backup plans sit at the low end; plans that add security monitoring, performance work, and priority support sit higher. Ecommerce sites often start around $500 a month because a broken checkout is lost revenue. Managed hosting is usually a separate $30 to $100 line item on top. Doing it yourself trades the dollars for two to five hours a month, and more whenever something breaks.
Can I maintain a WordPress site myself?
Yes, on a modest site, if you keep a real schedule: clear the update queue on staging, confirm nothing broke before pushing live, run and occasionally restore backups, and do a monthly security and performance review. Budget two to five hours a month when nothing goes wrong. The month an update conflict takes the site down, expect considerably more, plus the debugging skill to isolate which plugin caused it.
What happens if you do not maintain a WordPress site?
It works right up until it does not. Unpatched plugins with known vulnerabilities are one of the most common ways a site gets compromised, and skipping updates for even a few months is a common way a fine, working site turns into a security incident or a blank white screen. Backups quietly fail, the database bloats and slows the site, and disk or database problems build up until something goes down, usually discovered by a customer rather than by you.
Do I still need a maintenance plan if I have managed WordPress hosting?
Usually yes. Managed hosting handles the server, and often core updates and backups, but the plugin queue, staging tests, broken-plugin recovery, and security review generally sit outside it, which is why the maintenance plan and the hosting bill are typically two line items. The way to remove the plan entirely is to remove the plugin stack that creates the work, which is what a platform like Devani Hosting does by not having one.
See what a site with no plugin queue feels like a year in.
No pressure to migrate anything today. Devani Hosting has a free tier and a site live in under a minute, so you can look at what maintenance is like when there is no plugin stack to patch in the first place.