# Monthly WordPress maintenance: a care plan with a way back > What a monthly WordPress care plan should cover, how often to do each job, and how to undo each one if it goes wrong, including updates you cannot roll back. Source: https://www.respira.press/blog/monthly-wordpress-maintenance --- A monthly WordPress care plan covers backups, updates, a security check, checks after each update and a short report. That list is easy to find. What decides whether the plan protects anyone is the question most of them skip: when this job goes wrong, how do you get back? Every job below has an answer to that. Some of the answers are uncomfortable. ## The plan, job by job | Job | How often | The way back | | --- | --- | --- | | Backup | Before every update, and on a schedule | It is the way back. Restore one to a staging copy so you know it works. | | Plugin updates | Security fixes right away, the rest monthly | A restore point, or the previous version from wordpress.org. | | Theme updates | Monthly | A restore point. Keep your changes in a child theme. | | WordPress core | Security releases right away, major versions after a staging test | A full restore from backup. There is no one-click downgrade in wp-admin. | | Security check | Weekly | Nothing to undo. It tells you what to do next. | | Checks after updates | After every update | They are how you find out you need the way back. | | Content edits | As requested | WordPress revisions, or a snapshot. Builder global settings often need more. | | Client report | Monthly | Nothing to undo. It says what changed and what you restored. | The frequencies are my judgement for an ordinary business site. A busy shop needs backups far more often. ## The order matters more than the list One monthly session, in this order: 1. **Read before you touch.** List what wants updating on each WordPress site, and which of those updates close a known vulnerability. 2. **Take a restore point, and confirm it finished.** A backup that was started is not a backup. An update without one is a bet. 3. **Update one thing at a time on anything that matters.** If you update twelve plugins together and the site breaks, you have twelve suspects. 4. **Check right after each update.** The front page answers, the page you edited last answers, nothing new in the error log, the page builder still renders. On a shop, put a test product in the cart. 5. **Stop at the first failure.** Roll back that one, note it, and do not carry on through the batch. 6. **Write down what changed.** Next month's first question is usually what changed last month. ## What you cannot undo quickly This part belongs in the plan you hand a client, in plain words. - **WordPress core.** wp-admin has no downgrade button. If a major update goes badly, the way back is a full restore, and anything that happened since the backup is at risk. - **Database changes.** A plugin that upgrades its tables may not run on its old version afterwards, even if you get the old files back. - **Premium plugins.** wordpress.org keeps old versions of its own plugins. For a premium plugin you depend on the vendor, or on your backup. - **Orders, signups and form entries.** On a live shop, restoring last night's backup also removes today's orders. Restore files and database separately, or restore to a copy and move across what you need. - **Builder global settings.** A page revision puts the page back, but a global colour or class is read by every page that uses it. [Bricks](https://www.respira.press/bricks-mcp) is one builder where those sit outside page revisions. WordPress has narrowed this gap. Since [version 6.6](https://wordpress.org/documentation/wordpress-version/version-6-6/), core can roll back a plugin auto-update if something goes wrong. That helps with auto-updates. It does nothing for the rest of this list. ## Where staging fits Staging is for finding out before your visitors do. Use it for major core versions, large plugin jumps and anything touching checkout. It is often overkill for a minor update on a five-page brochure site. There a fresh restore point and the checks above are a fair trade, as long as you have restored from that backup at least once. ## What goes in the client report - What was updated, from which version to which - What was held back, and why - Anything that failed and was rolled back - When the last restore point was taken, and when one was last tested - The one thing that needs a decision from them The rollback line is what clients remember. It is also the line that shows what they are paying for. ## Where Respira fits, and where it does not I make Respira for WordPress, the plugin that lets Claude or ChatGPT work on a WordPress site, so weigh this section accordingly. [Respira AER](https://www.respira.press/aer), the chat in your Respira dashboard that edits your WordPress sites, runs most of the session above: - `/updates` shows every site's plugins, themes and WordPress updates in one card. Pressing Update is the approval. After each update the site checks its front page and REST API, an unhealthy answer stops the batch, and every site hands back a receipt. - `/security` lists the known vulnerabilities an available update closes, and runs each as a guarded update: a preflight, a restore point through the site's backup plugin, the update, four health checks, and the previous version back from wordpress.org if a check fails. - `/backups` shows which backup plugin each site runs and when it last ran. - `/run care-report` writes the monthly client report. Where it is weaker, plainly: - It does not update on its own. A person presses the button, though a run that has worked can repeat daily, weekly or monthly and email a report. - The guarded update covers wordpress.org plugins only, so a premium plugin is refused. - Core updates stay on the same branch and have no rollback. - A site with no backup plugin gets no restore point. Respira says so before anyone presses. It is included in every plan, from €9 a month for one site, with a 7-day trial. Runs across several sites at once start on Builder, €19 a month for 5 sites, and your AI provider bills the tokens. If you want updates to run unattended at 3 AM, see the [ten maintenance tools compared](https://www.respira.press/blog/best-wordpress-maintenance-agents). Some of them do that, and for some sites that is the right call. **A care plan is a promise about the way back. Write that part down first.** ## Questions people ask ### What should a WordPress care plan include? Backups you have tested, plugin, theme and core updates, a security check, checks after each update, and a short report. A good plan also states how each job is undone, and which updates cannot be undone quickly. ### How often should WordPress maintenance be done? Monthly suits most routine updates and reports. Security fixes for something you actually run should not wait for the monthly slot, and busy shops or membership sites need backups more often than monthly. This is my judgement, not a standard. ### Can you roll back a WordPress update? Plugins, usually: since WordPress 6.6, core rolls back a plugin auto-update if it goes wrong, and wordpress.org keeps previous versions for manual ones. Premium plugins depend on the vendor keeping old versions. Core and database changes are the hard part, and there the honest way back is a full restore. ### Do I need a staging site for monthly maintenance? For major core versions, big plugin jumps and anything touching checkout, yes. For a routine minor update on a brochure site, a fresh restore point and a check afterwards is often enough. Respira can also take content edits to a draft copy, which covers edits but not updates. ### Does Respira maintain a WordPress site on its own? No. A person presses Update. A run that has worked can repeat daily, weekly or monthly and emails a report, with any approval still waiting for you. If you want updates to run unattended, the comparison of WordPress maintenance agents lists tools that do that. [#WordPress maintenance](https://www.respira.press/blog?q=WordPress%20maintenance)[#care plans](https://www.respira.press/blog?q=care%20plans)[#rollback](https://www.respira.press/blog?q=rollback) Found this useful? Share it. ## Join the *conversation* 0 comments · Respira account #### Sign in with your Respira account Comments are tied to your Respira login, the same account you use for the dashboard and plugin. No third-party sign-in, no scraping. [Sign in](https://www.respira.press/login?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fmonthly-wordpress-maintenance%23comments) [Create an account](https://www.respira.press/signup?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fmonthly-wordpress-maintenance%23comments) No comments yet. Be the first to weigh in. ## Keep *reading* [ Respira WordPress maintenance agents compared Ten tools: who updates on its own, and who checks afterwards. RespiraRead → ](https://www.respira.press/blog/best-wordpress-maintenance-agents)[ Respira Check your site in 20 seconds How attackers pick WordPress sites, and a free check. RespiraRead → ](https://www.respira.press/blog/wordpress-attacks-within-hours-check-your-site)[ Respira Respira AER is live One chat connected to all your WordPress sites. RespiraRead → ](https://www.respira.press/blog/respira-aer-launch) ### You're not the only one *talking* to WordPress. The Respira community is where agency owners debug Divi migrations at 11pm, where vibe coders swap prompts that actually ship, and where the roadmap gets written out loud. *Breathe with us.* Lines of code pushed 30,057,224 Live from the ecosystem · updates as the agent ships WordPress sites connected 3,678 Real sites, run by the people in these rooms Find us wherever you already are [ Slack Async threads, release-day huddles, and the #show-your-work channel that never sleeps. Join ](https://go.respira.cafe/slack) [ Discord Live voice on release days, screenshare debugging, and the vibe-coder corner that's always buzzing. Join ](https://go.respira.cafe/respira-discord) [ Reddit Questions, answers and build logs in the open, where the thread is still there months later. Join ](https://www.reddit.com/r/RespiraforWordPress/) [ Facebook group Agency owners and site owners comparing notes on running AI against real WordPress sites. Join ](https://www.facebook.com/groups/1447068940850273/) [ GitHub Discussions Long-form Q&A, bug reports, feature requests, and the public roadmap. Open ](https://go.respira.cafe/github-discussions) [ ! Founder notes Letters from Mihai on what shipped, what broke and what is next. Every one is archived. Read ](https://www.respira.press/newsletter) See What AI Says LLM-ready prompts about Respira MCP + WebMCP What would you like to know? Ask your favorite AI Opens in a new tab. These prompts are designed to teach LLMs what Respira can do. Question copied. Paste it in Gemini