Website Maintenance

A website is closer to a building than to a document. Once it is up, it needs looking after: things wear out, rules change, new problems appear, and what was accurate last year quietly stops being so. Sites that are maintained keep earning attention for years. Sites that are not slowly fall apart, usually without anyone noticing until something breaks.

This guide sets out what maintenance involves and gives a routine you can actually keep. Two articles go deeper into the content side: content refresh and how to redesign a website.

The two halves of maintenance

Technical maintenance keeps the site working and safe: software updates, security, backups, speed and broken things.

Content maintenance keeps the site useful: accurate facts, current advice, a structure that still makes sense, and a look that has not aged out of credibility.

Most maintenance plans cover the first half and ignore the second. Both matter. A secure site full of outdated advice is safe and useless.

Software updates

On WordPress, there are three things to keep updated: WordPress itself, your theme and your plugins.

WordPress applies minor releases, which include maintenance and security fixes, automatically on most sites, a feature it has had since version 3.7. Major releases, themes and plugins generally need you to act, either by updating them yourself or by switching on automatic updates for the ones you trust.

The server matters too. WordPress currently recommends PHP 8.3 or newer, and MySQL 8.0 or MariaDB 10.11 or newer, with HTTPS. Running on an outdated version of PHP is one of the most common, and most easily fixed, problems on older sites. Your host can usually change it in a few clicks.

Security

The most useful fact about WordPress security is where the problems come from. Patchstack’s report on 2025 counted 11,334 new vulnerabilities in the WordPress ecosystem, 42% more than the year before. Of those, 91% were in plugins and 9% in themes, while WordPress core had only six, all of low priority. Patchstack also found that 46% of vulnerabilities had no patch available at the time they were disclosed, and that heavily targeted flaws were being exploited at scale within hours.

The practical lessons:

• Use fewer plugins. Every plugin you remove is one you never have to patch.
• Choose maintained plugins. Check when a plugin was last updated and whether its developer answers support questions.
• Update promptly, especially when an update mentions security.
• Remove what you do not use, including deactivated plugins and old themes.
• Use strong, unique passwords and two-factor sign-in for every administrator.

Backups

A backup is only as good as your last successful restore. Many sites have backups that have never been tested, and discover they are incomplete on the day they need them.

The US Cybersecurity and Infrastructure Security Agency recommends the 3-2-1 rule: three copies of important files, on two different types of storage, with one copy kept off-site. It also advises keeping offline copies and being able to roll data back at least seven days. For a website, that usually means your host’s backups, plus a regular copy stored somewhere you control.

Test a restore at least once a year, on a staging copy, so you know the process works and how long it takes.

Speed and user experience

Google measures real visitors’ experience of a page through Core Web Vitals. The thresholds for a good experience are:

Metric	What it measures	Good
Largest Contentful Paint (LCP)	How quickly the main content appears	2.5 seconds or less
Interaction to Next Paint (INP)	How quickly the page responds to input	200 milliseconds or less
Cumulative Layout Shift (CLS)	How much the layout jumps while loading	0.1 or less

These are measured at the 75th percentile of page views, so a page has to be fast for most visitors, not just on your own connection. The usual causes of slow pages are oversized images, heavy themes and too many plugins, which is why speed and security often improve together.

Content upkeep

Content ages in two ways. Facts change: prices, rules, steps in a process, the names of things. And pages drift: a site that started with clear topics acquires duplicates, orphans and articles that no longer fit anywhere.

Keeping facts current. Review your most visited pages regularly and update what has changed. Google has systems designed to show fresher content for searches where freshness is expected, such as news or new releases, so keeping the right pages current pays off. Our article on content refresh covers how to do it.

Not faking it. Google’s guidance on helpful content asks site owners directly: “Are you changing the date of pages to make them seem fresh when the content has not substantially changed?” Change the date when you have changed the page, and only then.

Keeping the structure clear. Every few months, check for pages with no links pointing to them, articles that never link to their topic’s main page, and several pages answering the same question. Our guide to site architecture explains what a healthy structure looks like.

Keeping the look credible. Design ages more slowly than facts, but it ages. When a site’s look starts to undermine trust in what it says, it is time to renew it, carefully, as we explain in how to redesign a website.

A routine you can keep

Every week

• Apply updates to plugins and themes, or check that automatic updates ran.
• Glance at your uptime and security alerts, if you have them.

Every month

• Check that backups are running and complete.
• Look for broken links and pages returning errors.
• Review Search Console for crawl errors and sudden drops.

Every quarter

• Review your most visited pages for outdated facts.
• Remove plugins and themes you no longer use.
• Check Core Web Vitals for your main page types.
• Look for orphan pages and duplicate topics.

Every year

• Test a full restore from backup.
• Review the PHP version and hosting plan.
• Review every administrator account and remove the ones nobody uses.
• Decide whether the site’s structure and design still fit what it has become.

Doing it yourself or handing it off

Everything above can be done by one person with a few hours a month. The trouble is not difficulty; it is attention. Maintenance is the work that gets postponed because nothing is visibly broken yet.

If you hand it off, to a host, an agency or a tool, check what is actually included. Many maintenance plans cover updates and backups but nothing on the content side.

Where our products fit

Several of our products exist because of the problems in this guide, and we have an interest in mentioning them. WebShapeUp finds and fixes technical problems on WordPress sites, quoting each fix separately. FreshnessPilot keeps existing pages accurate with small, gradual updates, and never deletes a page. SiteRenewer handles a full visual renewal when the look has aged. We are also preparing two free plugins, TWA Shield for hardening and TWA Vault for backups. None of them is required to follow the routine above.