A month in the life of a managed website

Website maintenance is a hard service to picture. You pay every month, and when it’s done well, nothing seems to happen. So here’s what a month actually looks like for a WordPress site being looked after properly, week by week, including the part where something goes wrong.

Every day, in the background

Some of the work never stops:

• Uptime checks every minute on the homepage and the pages that matter most, like the checkout or the booking form. Alerts reach a person, not just an inbox.
• A nightly backup, copied off-site and kept for at least 30 days.
• Security monitoring: failed login attempts, unexpected file changes and new administrator accounts.
• An eye on security releases. When a plugin the site uses announces a fix for a vulnerability that’s being actively exploited, that update doesn’t wait for the monthly schedule.

Week 1: updates, tested first

Most months bring a handful of plugin updates, a theme update and sometimes a new WordPress release. Clicking “Update all” on the live site is how a lot of sites break, so updates follow a set routine:

1. Take a fresh backup.
2. Copy the live site to staging and apply the updates there.
3. Compare screenshots of the key pages before and after, to catch visual breakage like a missing menu or a squashed layout on phones.
4. Test what screenshots can’t show: forms, search, logins and a test order.
5. Apply the updates to the live site, and check again.

Most months, something doesn’t pass. Say a slider plugin’s update breaks the homepage menu on phones. That one update is held back at the old version, everything else goes live, and the plugin’s support forum is checked for a fix. When the fix is released, the update is tested again and applied. The site owner never sees the broken version.

Why updates go to a copy first: why we never test changes on your live site

Week 2: security and housekeeping

• Review the security logs. A burst of login attempts against one username might mean that account is being targeted, so its owner hears about it and two-factor authentication is double-checked.
• Check who has access. A former employee’s administrator account, still active six months after they left, is one of the most common findings.
• Tidy up. Remove spam comments, expired temporary data and old post revisions that bloat the database, and delete plugins that were deactivated and forgotten.
• Check renewals. The SSL certificate and the domain registration should both be set to renew.

Week 3: speed and search

• Test page speed on the key pages, using a phone profile. If a 4 MB banner has crept onto the homepage, it gets resized.
• Look at Search Console for pages that dropped out of the index, new 404 errors, and any security or manual action warnings. The 15-minute monthly Search Console check walks through it.
• Check the forms still deliver by sending a test enquiry and confirming it lands in the inbox, not in spam.

Week 4: the small jobs and the report

Looking after a site usually includes small changes: a new team member on the About page, new opening hours, this year’s price list swapped in. Those get done as they arrive.

Then comes the monthly report. A good one is short and written in plain English (here’s a sample):

• What was updated, and anything held back, with the reason
• Uptime for the month, and the cause of any incidents
• Backups taken, and when a restore was last tested
• Security events worth knowing about
• Anything that needs a decision from you, like a plugin that’s been abandoned and should be replaced

A quiet month still gets a report. Knowing nothing went wrong is useful too.

Once a quarter

Some checks don’t need to happen monthly:

• A restore test: a backup restored to staging, and timed.
• A plugin review: is each plugin still maintained, and still needed?
• A PHP and hosting check: is the PHP version still supported, and does the hosting plan still fit the traffic?

What the owner sees

Mostly nothing. The site stays up, fast and patched. A report arrives each month, and now and then a message asks for a decision. That’s what good maintenance looks like: problems handled before anyone outside notices them.

It’s also why “we’ll just update it ourselves” tends to work fine, right up until the one month it doesn’t, usually with no recent backup and no staging copy to test on.

Tested updates, off-site backups, monitoring and a plain-English monthly report are what our care plans are built around.

Want someone to look after your site every month? Let’s talk