How to Choose a WordPress Maintenance Provider: Questions, Reports and Red Flags

On this page

1. Start with what your site actually needs
2. Questions to ask before you sign
3. What a monthly report should show
4. Response times: agree them in writing
5. Red flags
6. Freelancer, agency or your hosting company?
7. What a good first month looks like

Handing your website to a maintenance provider means trusting someone with your admin access, your backups and, when something breaks, your enquiries. Most providers promise the same things: updates, backups, security and support. The real difference shows up in how they do the work and how they behave when something goes wrong. Here's how to compare them before you sign.

Start with what your site actually needs

A five-page brochure site, a busy WooCommerce store and a membership site need very different levels of care. Before you speak to anyone, note down:

• What the site does for your business: enquiries, bookings, orders or just credibility
• How often you need content changes such as prices, photos or new pages
• What would hurt most if it stopped working, and for how long you could live with it
• Who has access today: an old developer, a marketing agency, your own team

For the tasks a plan should cover each month, see what a monthly WordPress maintenance plan should include. This guide is about choosing the person or company who does them.

Questions to ask before you sign

1. How do you test updates? Look for a backup before every update and a check of key pages afterwards, ideally on a staging copy for bigger updates. "We turn on auto-updates" is not a process.
2. Where are backups stored, and how often are they taken? They should be off-site, with several copies kept. Ask when they last restored one.
3. What happens if my site is hacked? Is clean-up included, charged separately or not offered at all?
4. What are your response times? For emergencies and for routine changes, and whether that means working hours or any time.
5. How many content changes are included? In hours or tasks, and what happens to unused time.
6. How will you access my site? A provider should have its own user account, not share yours.
7. Who pays for premium plugin licences, and in whose name are they?
8. Do you take on sites you didn't build? If yes, ask what the first health check involves.
9. What happens if I leave? Access, backups and licence details should be handed over without drama.
10. Can I cancel monthly, or is there a minimum term?

Vague answers to the first three questions tell you more than any sales page.

What a monthly report should show

A report is how you know the work is actually happening. It doesn't need to be long, but it should be specific.

Section	A useful report shows	Warning sign
Updates	Which plugins, themes and core versions were updated	"All updates done" with no detail
Backups	Dates, where they're stored and the last restore test	No mention of where backups live
Uptime	Any downtime, how long it lasted and the cause	A percentage with no explanation of incidents
Security	Scan results and anything that needed action	Scary numbers of "blocked attacks" with no context
Speed	Key pages tested and changes since last month	A single score with no pages named
Forms and checkout	Test enquiries or orders sent and received	Not tested at all
Work and next steps	Issues fixed, changes made and recommendations	No recommendations, month after month

Ask to see a sample report before you sign. Anyone doing the work properly will have one ready.

Response times: agree them in writing

"Quick support" means different things to different people. Agree severity levels like these, with a response time for each:

• Critical: site down, hacked, or checkout and payments broken
• High: contact form not sending, a key page broken on mobile
• Routine: content changes, new photos, price updates

Then check the details:

• Response or resolution? "We'll reply within an hour" is not the same as "we'll fix it within an hour".
• Working hours and holidays. Does support pause on Sundays, during Diwali or over long weekends? For overseas businesses, which time zone applies?
• How to reach them. WhatsApp, email or a ticket system, and which one counts for emergencies.

Red flags

• Asking for your personal admin login instead of creating their own account; see WordPress user roles explained
• Backups kept only on the same server as the website
• Using nulled (pirated) premium plugins to save on licences
• Registering your domain or hosting in their own name
• Long lock-in contracts, or a large annual payment upfront with no trial period
• "Unlimited" everything at a price that can't cover real work
• No reports, or reports that never change from month to month
• Being unable to explain in plain language what they did and why

Whoever you hire, run through the website ownership checklist so your domain, hosting and key accounts stay in your name.

Freelancer, agency or your hosting company?

Option	Strengths	What to check
Freelancer	Direct contact with the person doing the work, who gets to know your site	Who covers emergencies when they're unavailable
Agency	A bigger team and more formal processes	Who actually works on your site, and how requests are passed on
Hosting company's managed service	Server-level backups, security and sometimes automatic updates	Whether fixing plugin conflicts, broken layouts or forms is included; plans vary, so check current details

Many businesses combine them: good hosting for the server, and a developer for everything inside WordPress.

What a good first month looks like

1. A full backup before anything is touched
2. A health check of plugins, themes, PHP version, user accounts and security
3. A list of problems found, sorted by urgency, with what's included and what would cost extra
4. Uptime monitoring and off-site backups set up and confirmed
5. A first report that gives you a baseline to compare future months against

If a provider updates everything on day one without a backup or a health check, that's probably how they'll work every month.

For budgeting, see website maintenance cost in India. My own plans are month to month, include a monthly report, and start with a health check if I didn't build your site. I'm happy to answer every question above before you decide; see WordPress maintenance plans.