I have worked in IT and development since 1998, and Rizonetech runs its own website, rizonetech.com, on WordPress. This paper uses what we do for that site, including what we have not built yet. Reviewed 12 October 2026 by Derick Payne, with the published facts read that day.
Why does an unchanged WordPress site still need maintenance?
Because the code around it keeps changing. In 2025, Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem, “91% of new vulnerabilities were found in plugins, and 9% were found in themes”, and only 6 in WordPress core. A site with no manual or automatic plugin updates keeps running the plugin versions it had on the day it launched.
WordPress updates itself only partly. By default it installs minor core releases automatically, and since WordPress 5.5 you can switch on automatic updates for plugins and themes, but “Plugin and theme auto-updates are disabled by default.” For WordPress core, since version 5.6 new installations are “opted-in to major updates by default” as well as minor ones, while older installations kept minor updates only, and settings from the host take precedence. So check your own site under Dashboard › Updates. Either way, someone has to decide which updates to apply and check the site afterwards.
What does a WordPress maintenance plan include?
Five things. A quote that leaves one out is a quote to question.
1. Updates, applied in a controlled way
WordPress’s own guide says: “Before you get started, it’s a good idea to back up your website.” A good plan goes further: test updates on a copy of the site where it can, check the key forms and pages after each update reaches the live site, and keep a way back if something breaks. No process can promise an update will never break anything, so the rollback matters as much as the test.
2. Backups you have actually restored
A backup proves itself only when you restore it. The UK’s National Cyber Security Centre says backups “should also be regularly tested to check they work as expected”, and recommends the 3-2-1 rule: at least 3 copies, on 2 devices, and 1 offsite.
Ask your host what it keeps. Pressable, which hosts our site, takes “backups of site files every 24 hours and databases every hour” and keeps them “for at least 30 days”. That is the host’s copy; a care plan should also say who restores, how fast, and when it was last tested.
3. Security basics
Plugins and themes accounted for nearly all the newly disclosed WordPress vulnerabilities in Patchstack’s 2025 data, so keeping them updated is one essential control. Others matter as much: remove plugins and accounts you do not use, protect forms against spam and abuse, and turn on multi-factor authentication for administrators, which the NCSC says “should be enabled on administrator accounts” where available.
4. Monitoring
You should not hear that your site is down from a customer. Uptime checks catch an outage, and regular checks of the forms and page speed catch the slow failures: a form that stopped sending, or a plugin that made every page slower. Ask how often the checks run, who receives the alerts, during which hours someone acts on them, and which response target applies when a check finds an outage.
5. A report you can read
A monthly report in plain language should list the updates applied, the backups taken and tested, anything that broke and what was done about it. Without it, you cannot tell whether the fee buys anything.
What should the service level agreement cover?
A service level agreement turns “we’ll get to it” into something you can hold. Check these things:
- Response and resolution. A response time is how quickly someone acknowledges the problem; a resolution time is how long it takes to fix it. An acknowledgement does not say when someone starts working on the problem, let alone when it is fixed, so ask which of these the agreement commits to.
- Hours. Business hours only, or after hours too, and at what rate.
- Scope. Which sites, which work and how many hours are included, and what counts as a separate project.
- Priorities and the clock. How a problem is classed (site down, a form broken, a small change), how you report it, when the clock starts, whether it pauses while they wait for you, and whether it counts business hours or all hours.
- Escalation and remedies. Who takes over if the first person cannot fix it, and what you get if a target is missed.
Our own terms set the hours in writing. We answer Monday to Friday, from 09:00 to 16:30 South African time, except on public holidays. Outside those hours we take critical issues only, at twice our normal labour rate. Hours are not a response-time promise: any response targets, priorities and escalation are those agreed in the client’s written scope. Support covers the services in that scope.
What do we do for our own site?
These are the practices our records show, and two we have not built yet:
- A backup before every planned database change. Our working rule is a server-side export of the database before any maintenance work that writes to the live database, on top of the host’s scheduled backups. Code changes go through a deploy script that backs up the theme first, checks each uploaded file’s fingerprint against our copy, and clears the caches.
- A restore we actually ran. On 11 October 2026 we took Pressable backups of the live site, a 1.9 MB compressed database download and a 1.8 GB compressed file system download. Each download’s size matched what Pressable recorded, and we fingerprinted both on arrival. We then restored both into a local copy of the site, checking the fingerprints again first, and the home page, a service page, the blog, the contact page and the tools page all loaded from the restored copy.
- Less to patch. In September and October 2026 we removed seven plugins, two more plugins and an unused theme, and eight stale user accounts.
- Forms that resist abuse. Every form uses Cloudflare Turnstile plus our own checks: a hidden field bots fill in, a signed token, a minimum fill time and a limit per address.
- Not yet built: uptime monitoring and the monthly report. We plan a monthly check of key pages, a test submission of each form, the backup age and a restore test every quarter. Until it runs, we cannot claim it.
What does a maintenance plan cost in South Africa?
It depends on the site, so compare quotes on what they cover, not on the monthly figure. Ask each provider for:
- the scope: which updates, which checks, how many hours of small changes;
- the backup plan: how often the database and the files are backed up, and how much recent data you could lose;
- the restore plan: where copies are kept and for how long, how quickly they will restore the site, and the last tested restore;
- the response targets and hours, including after hours;
- the monthly total, whether VAT is included, and whether hosting is separate;
- the exclusions, in writing.
We do not publish market price ranges here, because figures without a dated source and a stated scope get mistaken for a quote.
How does maintenance relate to POPIA?
If your site collects personal information through a form, keeping it maintained is part of protecting that information. POPIA section 19 requires “appropriate, reasonable technical and organisational measures” against loss and unlawful access, and asks you to “regularly verify that the safeguards are effectively implemented”. A provider that processes personal information on your behalf, such as a host or a maintenance provider with access to your form entries, is an operator under POPIA. Section 21 requires you to have a written contract making sure the operator “establishes and maintains the security measures referred to in section 19”, and requires the operator to tell you “immediately” if it believes personal information was accessed without authority. Section 22 then requires you to notify the Information Regulator and the people affected as soon as reasonably possible. So a maintenance agreement should cover the security measures and say how a breach notice reaches you.
Which questions separate real care from a line item?
- Which updates do you apply, how do you check the site afterwards, and how do you roll back?
- When did you last restore one of my backups, and what did you check?
- What is your response time, and is it a response or a resolution?
- What happens after hours, and what does it cost?
- Can I see a sample monthly report?
- What is out of scope and billed separately?
FAQ
Are automatic updates enough?
No. Depending on the site’s settings, they keep some or all of WordPress core current, and you can switch them on for plugins and themes, but nobody checks the site after an automatic update unless the plan says so.
How often should a backup be restored?
Often enough that you trust it. Agree the frequency from how often the site changes and what an outage would cost you, and test again after any change to how backups are taken. For our own site we plan a restore test every quarter.
Is the host’s backup enough?
It is a good start. Ask how long the host keeps backups, who can restore them, and whether a copy exists anywhere else.
What should you do next?
Check where your systems stand with the free IT health check. To have your site looked after this way, see Website Health and Performance. For what a new site costs, read our guide to WordPress costs in South Africa.
Published 16 June 2026. Last updated 12 October 2026.