Monthly WordPress maintenance: a care plan with a way back

A monthly WordPress care plan covers backups, updates, a security check, checks after each update and a short report. That list is easy to find. What decides whether the plan protects anyone is the question most of them skip: when this job goes wrong, how do you get back?

Every job below has an answer to that. Some of the answers are uncomfortable.

The plan, job by job

The frequencies are my judgement for an ordinary business site. A busy shop needs backups far more often.

The order matters more than the list

One monthly session, in this order:

1. Read before you touch. List what wants updating on each WordPress site, and which of those updates close a known vulnerability.
2. Take a restore point, and confirm it finished. A backup that was started is not a backup. An update without one is a bet.
3. Update one thing at a time on anything that matters. If you update twelve plugins together and the site breaks, you have twelve suspects.
4. Check right after each update. The front page answers, the page you edited last answers, nothing new in the error log, the page builder still renders. On a shop, put a test product in the cart.
5. Stop at the first failure. Roll back that one, note it, and do not carry on through the batch.
6. Write down what changed. Next month's first question is usually what changed last month.

What you cannot undo quickly

This part belongs in the plan you hand a client, in plain words.

• WordPress core. wp-admin has no downgrade button. If a major update goes badly, the way back is a full restore, and anything that happened since the backup is at risk.
• Database changes. A plugin that upgrades its tables may not run on its old version afterwards, even if you get the old files back.
• Premium plugins. wordpress.org keeps old versions of its own plugins. For a premium plugin you depend on the vendor, or on your backup.
• Orders, signups and form entries. On a live shop, restoring last night's backup also removes today's orders. Restore files and database separately, or restore to a copy and move across what you need.
• Builder global settings. A page revision puts the page back, but a global colour or class is read by every page that uses it. Bricks is one builder where those sit outside page revisions.

WordPress has narrowed this gap. Since version 6.6, core can roll back a plugin auto-update if something goes wrong. That helps with auto-updates. It does nothing for the rest of this list.

Where staging fits

Staging is for finding out before your visitors do. Use it for major core versions, large plugin jumps and anything touching checkout. It is often overkill for a minor update on a five-page brochure site. There a fresh restore point and the checks above are a fair trade, as long as you have restored from that backup at least once.

What goes in the client report

• What was updated, from which version to which
• What was held back, and why
• Anything that failed and was rolled back
• When the last restore point was taken, and when one was last tested
• The one thing that needs a decision from them

The rollback line is what clients remember. It is also the line that shows what they are paying for.

Where Respira fits, and where it does not

I make Respira for WordPress, the plugin that lets Claude or ChatGPT work on a WordPress site, so weigh this section accordingly. Respira AER, the chat in your Respira dashboard that edits your WordPress sites, runs most of the session above:

• /updates shows every site's plugins, themes and WordPress updates in one card. Pressing Update is the approval. After each update the site checks its front page and REST API, an unhealthy answer stops the batch, and every site hands back a receipt.
• /security lists the known vulnerabilities an available update closes, and runs each as a guarded update: a preflight, a restore point through the site's backup plugin, the update, four health checks, and the previous version back from wordpress.org if a check fails.
• /backups shows which backup plugin each site runs and when it last ran.
• /run care-report writes the monthly client report.

Where it is weaker, plainly:

• It does not update on its own. A person presses the button, though a run that has worked can repeat daily, weekly or monthly and email a report.
• The guarded update covers wordpress.org plugins only, so a premium plugin is refused.
• Core updates stay on the same branch and have no rollback.
• A site with no backup plugin gets no restore point. Respira says so before anyone presses.

It is included in every plan, from €9 a month for one site, with a 7-day trial. Runs across several sites at once start on Builder, €19 a month for 5 sites, and your AI provider bills the tokens. If you want updates to run unattended at 3 AM, see the ten maintenance tools compared. Some of them do that, and for some sites that is the right call.

A care plan is a promise about the way back. Write that part down first.

Questions people ask