Affiliate disclosure: The Krystal links are affiliate links. If you buy through them, Formby Web Design may earn a commission at no extra cost to you. This guide assesses published service scope, not independently measured hosting performance.
A useful WordPress maintenance plan is an ownership map, not a vague promise to “keep everything updated”. It should state who monitors the site, who decides whether an update is safe, how backups are restored, what gets checked after a change and what happens when a customer journey fails.
Managed hosting can remove some infrastructure work from that map. See Krystal’s managed WordPress hosting if you want backups, staging and host-level controls bundled with the platform. A maintenance agreement is still needed when somebody must own plugin compatibility, form delivery, content changes and business-specific checks.
This guide is for comparing paid support agreements. For the owner’s day-to-day checks, use our website maintenance checklist. For the infrastructure decision, see shared versus managed WordPress hosting.
Start with the three layers of responsibility
| Layer | Typical owner | What must be explicit |
|---|---|---|
| Infrastructure | Hosting provider | Server availability, platform patches, certificates, backups and restore route included in the chosen service |
| WordPress application | Maintainer or web designer | Core, plugin and theme updates; staging; compatibility checks; rollback; error investigation |
| Business operation | Site owner and named staff | Correct prices and opening hours, legal text, mailbox access, lead response, stock, payments and approval of material changes |
The exact boundary varies by supplier. Never assume “managed” means every row is covered. Read the current service description, then put the remaining responsibilities into the maintenance agreement.
The minimum scope worth paying for
1. A current inventory and access register
The maintainer needs a controlled record of the hosting account, domain registrar, DNS provider, WordPress administrators, premium licences, form destinations and connected services. The contract should say who owns each account and how access is removed when a person or supplier leaves.
2. Backups with a defined restore process
“Daily backup” is incomplete without retention, storage location, restore permissions and a recovery target. A good scope says what is copied, how long versions remain available and how often a sample restore is checked. Use our WordPress backup restore-test checklist to examine the difference between having an archive and having a recoverable website.
3. Risk-based updates
Automatic updates can be appropriate for low-risk components, but a change affecting checkout, bookings, membership, forms or a heavily customised theme deserves a backup, staging check and named verification steps. The plan should define the workflow rather than promising every update will be installed immediately.
4. Monitoring that follows the money path
Uptime is only one signal. A site can return a perfect 200 response while its quote form sends nowhere. Monitoring should reflect how the business earns enquiries or sales: key pages load, certificates remain valid, forms reach the right inbox, payment or booking paths work and obvious server errors trigger investigation.
5. Security hygiene and access reviews
WordPress’s own hardening guidance treats security as risk reduction, not a one-click guarantee. Maintenance should cover supported software, least-privilege accounts, removal of unused extensions, strong authentication practices, logging where appropriate and an agreed response when a vulnerability affects the installed stack.
6. A change log and a short report
The useful report is not a wall of green ticks. It records material updates, failed jobs, issues found, backup or restore evidence, performance changes and decisions the owner must make. That history makes later fault-finding faster.
A simple update-risk matrix
| Change level | Example | Proportionate process |
|---|---|---|
| Level 1: low | Correcting brochure copy or replacing an image | Record the change and check the edited page on desktop and mobile |
| Level 2: medium | Routine plugin or theme update with no known custom dependency | Confirm backup, apply in a controlled window, clear caches and test core journeys |
| Level 3: high | Checkout, booking, form, database, PHP or major theme change | Stage first, capture acceptance checks, prepare rollback, update live, then repeat the checks |
This prevents two common failures: treating every change as an emergency, or treating a payment-plugin update like a spelling correction.
What should happen each day, week, month and quarter?
| Frequency | Useful activity |
|---|---|
| Continuous or daily | Availability alerts, certificate monitoring, backup-job alerts and security notifications appropriate to the stack |
| Weekly | Triage available updates, inspect error signals and submit important forms using a controlled test |
| Monthly | Review users and licences, sample a backup or restore step, check key pages and record performance or broken-link exceptions |
| Quarterly | Rehearse the recovery route, review suppliers and integrations, confirm business details and update the site inventory |
Urgent security advisories and active failures need prompt triage; do not wait for the weekly or monthly slot when the installed site is exposed. Agree an emergency patch or mitigation route with the maintainer. These are planning intervals, not universal rules. A busy WooCommerce store needs tighter checks than a five-page brochure site, and an active campaign may justify temporary extra monitoring.
A worked example: the local-service enquiry path
Imagine a Formby trades business whose website exists to generate quote requests. Its money path is:
An uptime monitor checks only the first part. A useful maintenance test loads the service page, confirms the phone link on mobile, submits a clearly labelled test enquiry, verifies delivery to the correct mailbox and checks that consent or retention settings still match the business process. It does not leave fake leads mixed with real customers.
Response time is not resolution time
A contract that promises a two-hour response may mean only that somebody will acknowledge the issue. Resolution can depend on a hosting provider, plugin developer, domain owner or payment service. Ask for separate definitions:
- Response time: when investigation starts or the incident is acknowledged.
- Workaround target: when a practical temporary route is considered, such as a visible phone CTA if a form fails.
- Resolution target: how priorities are set, with dependencies and exclusions stated.
- Support hours: the actual clock used for each target.
Where managed hosting fits
A managed WordPress platform can reduce the amount of infrastructure work a small business must coordinate. Krystal’s current managed WordPress page describes plan-dependent backups, staging, security controls and migration support; confirm the live plan details before choosing. You can compare Krystal’s managed WordPress options here.
Hosting does not automatically own your plugin licences, form destinations, DNS outside the account, email delivery, content accuracy, checkout configuration or acceptance testing. Put those gaps into the maintenance scope rather than discovering them during an outage.
Compare quotes on the same cost basis
Ask each supplier to itemise the recurring fee, onboarding, hosting, paid licences, included support time, excess-work rate, emergency cover, restore charges and exit assistance. Record whether VAT is included and whether unused time rolls over. Compare the same agreed scope over a year; a low monthly fee with separately charged recovery work is a different offer from an inclusive plan. These are quote fields, not Formby Web Design prices or promised service inclusions.
Questions to ask before signing
- Which accounts and licences remain in my business’s name?
- What exactly is backed up, where, for how long and by whom can it be restored?
- Which changes use staging, and what is tested before and after release?
- Which customer journeys are monitored beyond simple uptime?
- What counts as an incident, and what are the response and support hours?
- How are failed updates and rollbacks recorded?
- What work is excluded or separately chargeable?
- What access, documentation and export do I receive if the agreement ends?
Choose the plan from business risk, not a feature count
A brochure site with one lead form may need a lean plan with reliable backups, controlled updates and a monthly money-path check. A shop, membership site or booking system needs more frequent verification, clearer incident handling and staged releases. The right price follows the time, responsibility and recovery risk being transferred.
If you run a business in Formby, Freshfield or L37 and want a maintenance scope built around the way your website actually generates enquiries, ask Formby Web Design for a WordPress maintenance review.
Sources: WordPress security hardening guidance; WordPress updating guidance; Krystal managed WordPress service information. Checked 22 September 2026.
