Maintenance
What to ask a WordPress maintenance company before you sign
22 August 2026 · 6 min read
On this page
Every provider lists the same things: updates, backups, security, support. The list tells you almost nothing. These twelve questions do, and most can be answered from a pricing page without booking a call.
About the work
1. Who applies the updates — a person or a script?
You want to hear that a person checks the site afterwards. Automation applies the update; it does not notice that the checkout stopped working. Ask what happens when an update breaks something, and how quickly they would know.
2. Do you test on staging first?
For a shop this is close to essential. For a brochure site it is a nice-to-have. A provider who does not know what you mean is not the right provider for a WooCommerce site.
3. How do you handle a plugin with a published vulnerability but no fix yet?
The good answer involves judgement — deactivate, find an alternative, or mitigate — not "we wait for the update". This question separates people who understand security from people who run a scanner.
4. Are backups off-site, and do you test restores?
Off-site matters because a backup on the same server disappears with the server. Testing matters because silent backup failure is common.
About the money
5. Is hosting bundled?
Convenient, and it makes leaving harder. Not automatically bad — just know which you are buying.
6. Is malware cleanup included or extra?
A cleanup bought in a crisis runs $150–500. A plan that includes it free is worth materially more than one that does not, regardless of the headline price.
7. What counts as an included edit? Give me examples.
Insist on examples. "Small changes included" is where scope disputes come from. You want to hear something like: changing text on an existing page is included, designing a new graphic is not.
8. What happens if a task takes longer than my included hours?
The answer you want: we tell you first and quote it, and nothing starts until you approve. Not: we bill the overage.
About what happens when it goes wrong
9. What is your response time, in writing?
"Fast" is not an answer. "One business day" is. Also ask what counts as an emergency and whether that changes the answer.
10. Who actually does the work, and where?
Not a snobbery question — a continuity one. Is it one person who might be on holiday, or a team? Both are fine if you know which.
11. What do I get every month?
A report, ideally one written by a person rather than a PDF of numbers from a dashboard. If there is no monthly deliverable, you have no way to know whether anything is happening.
12. What happens when I cancel?
You should keep your site, your backups and your data, with no exit fee and no fight over access. Ask directly. The answer tells you how they think about the relationship.
The single most revealing question is number 7. Anyone who cannot give concrete examples either has not thought about scope, or is leaving it vague on purpose.
Warning signs
- No prices on the site. Sometimes legitimate for enterprise work. For a standard care plan it usually means the price depends on what they think you will pay.
- A call required before you can see anything. Friction serving them, not you.
- Unlimited anything. Unlimited edits, unlimited support. There is always a limit; one that is not written down is one you discover during an argument.
- Bundled hosting you did not ask for.
- No named response time.
- Testimonials with no names or businesses.
Comparing honestly
Cheapest rarely wins here. A $30 plan with no included cleanup, a three-day response time and automated updates is more expensive than a $79 plan that includes cleanup, the first time anything happens.
Compare on: response time, whether cleanup is included, whether a person checks after updates, and how clearly scope is defined. Those four explain most of the price difference in this market.
Ours are answered here — prices, inclusions, response times and scope examples, without a call.