Dreamseven Knowledge · Decision support
WordPress maintenance: security, backups, and responsibilities
WordPress maintenance connects updating, function checks, and preparation for error cases. An existing backup is only practically helpful when files, database, and the restoration path fit together.
From Dreamseven · Status: 13. October 2026 · All guides
Jump to your question
What’s included in a maintenance scope?
Define which website is supported, who approves changes, and which function checks are important. For an online shop, ordering and payment flows are relevant; for a company website, forms and mobile display are often key. Hosting, content changes, paid extensions, and repairs outside the agreement should be named separately. This way, monthly support can be compared with other offers without equating different services.
How can updates be planned?
Before a change, the current state and the backup are checked. For complex extensions, a suitable test environment is useful. After the update, the agreed functions are checked; if problems occur, an agreed rollback path is needed. The specific procedure depends on the website. A successful “update” click alone doesn’t prove that all business processes work.
The example of how changes, function tests, and open tasks can be documented is shown by the Example maintenance report.
What must a backup include?
For WordPress restoration, related files and the database are needed. This also includes your own extensions and uploaded media. Keeping a copy separately reduces dependence on the web server. How often backups are made and how long they are kept depends on how many new contents, requests, or orders might be lost. A periodically tested restoration shows whether the agreed backup is actually usable.
Which security measures are included?
Keeping software up to date, trusted extensions, individual accounts, and limited permissions reduce avoidable risks. Strong passwords and additional sign-in procedures protect access. Extensions and accounts that are no longer needed should be reviewed. These measures reduce risks, but they don’t guarantee protection against every attack. Responsibility for the server, website, and work devices should be clearly defined in operations.
What to do if you suspect an attack?
Document the time and observations and avoid uncoordinated changes. The investigation must clarify which files and access credentials are affected and how the incident occurred. Restoration and cleanup are linked to fixing the cause. Simply removing visible malicious code is not enough as an approach. Using the security request form from Dreamseven , the first information can be transmitted in an organized way; passwords do not belong in a freely written contact field.
How much does WordPress maintenance cost?
Costs depend on the condition, scope, update risk, effort for checks, and the agreed response paths. A small information website needs a different framework than a shop with multiple integrations. Dreamseven separates setup, ongoing tasks, and additional work in the offer. Before starting, access credentials, backups, and the desired support are checked.
Questions to help you decide
Before you take the next step.
Further technical resources
Discuss your project in detail.
Briefly describe your current situation. We’ll clarify scope, prerequisites, and the right next step.