What a WordPress maintenance report should actually tell you

If you pay for maintenance, the monthly report is the only evidence you have that anything happened. Most are close to useless — a PDF of numbers exported from a dashboard, sent automatically, read by nobody.

Here is what separates a report that proves work from one that performs it.

What a useful report contains

What was updated, and what happened afterwards. Not "17 updates applied" but which plugins, and confirmation that the site was checked afterwards. The number alone tells you a script ran.

What was found and dealt with. Blocked attacks are mildly interesting. A disclosed vulnerability in a plugin you run, patched within two days, is the thing worth reporting — it is the clearest evidence that someone is actually watching.

Backup status, honestly. Not "backups: enabled" but how many completed, where they are, and whether a restore has been tested. A report that cannot distinguish between "scheduled" and "succeeded" is not reporting on backups.

Uptime, with context. 99.98% means nothing without knowing what the outage was. Two minutes at 4am is noise; twenty minutes during business hours is a conversation.

Performance trend, not a single score. One PageSpeed number is a snapshot. The useful information is whether it is moving, and why.

Anything needing a decision from you. This is the section that makes a report worth opening. An abandoned plugin that needs replacing, a PHP version the host should upgrade, a form that has started failing. Things someone noticed and cannot fix without you.

A sentence in plain English. Written by the person who did the work. This is the part that cannot be automated, and it is the part that tells you whether a human was involved at all.

What tells you a report is theatre

• Only green ticks. Nothing is ever entirely fine. A report with no findings for three months means nobody is looking.
• Numbers with no interpretation. 4,281 attacks blocked. Is that a lot? Was one of them nearly successful? The number is chosen because it is large.
• No mention of anything that went wrong. Something always does. A provider who never reports a problem is either not finding them or not telling you.
• Identical wording every month. A template with the numbers swapped.
• No named person. If nobody signed it, nobody is accountable for it.

The test

Read last month's report and ask: could I tell from this whether the work was actually done?

If the report would look exactly the same whether a person spent two hours on your site or zero, it is not evidence. It is a receipt for a subscription.

A second test: does it ever ask me for anything? A provider genuinely watching a site will periodically find something they cannot fix alone — a host setting, a plugin licence, a decision about replacing something. A report that never asks is a report that never looked.

What we send

A monthly summary with the update count and what was checked afterwards, backups completed against expected, uptime with an explanation of any incident, the vulnerability position, hours used against your allowance, and a written paragraph from whoever did the work — including anything we think you should decide on.

It is deliberately short. A long report is easy to generate and hard to read, which is the wrong way round.

The plans are here, and the report is included on all of them. If you are currently receiving something that does not pass the test above, it is worth asking your provider what they actually do each month — the answer is usually informative either way.