--- title: "WordPress Website Maintenance Services & Plans — Dardo" description: "WordPress website maintenance services: tested core, plugin and theme updates, PHP upgrades, security checks, restorable backups and a monthly report." url: "https://dardo.studio/en/services/wordpress-maintenance/" language: "en" translations: {"es":"https://dardo.studio/es/servicios/mantenimiento-wordpress/","pt":"https://dardo.studio/pt/servicos/manutencao-wordpress/"} updated: "2026-11-12T12:00:00Z" --- # WordPress website maintenance WordPress website maintenance is the monthly work that keeps a WordPress site updated, secure and backed up after launch. Dardo's WordPress plans test every core, plugin and theme update on a staging copy before production, keep PHP on a supported version, keep off-site backups we have restored and send a monthly report. Plans start at USD 79 a month. By [Nicolás Cerón](https://dardo.studio/en/nicolas-ceron/) · Updated Nov 12, 2026 · 7 min read · From USD 79 a month [Get a proposal](https://dardo.studio/en/contact/?service=wordpress-maintenance) · [Message us on WhatsApp](https://wa.me/573132340197?text=Hi%20Dardo%2C%20I%27d%20like%20a%20proposal%20for%3A%20WordPress%20website%20maintenance) ## What a WordPress maintenance plan covers A WordPress plan covers the parts of the site that WordPress itself leaves to you: the plugins and theme, the PHP version, the backups and the checks that catch a failure before visitors do. The proposal lists which of these are in your plan and how often each one runs. - Core, plugin and theme updates, tested on a staging copy before production, with a rollback point - PHP upgrades to a supported version, tested first on staging - A plugin review: unused and abandoned plugins removed or replaced - Security advisories tracked for every plugin and theme the site runs - Off-site backups of the database and files, with scheduled restore tests - Uptime, SSL certificate, domain and form monitoring with alerts - A monthly report with updates, incidents, Core Web Vitals and the work done ## Why WordPress needs its own maintenance plan WordPress needs closer watching than most platforms because most of its code comes from third parties. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024: 91% in plugins, 9% in themes and only 6 in WordPress core. It also found that 46% were not fixed in time for public disclosure, and that heavily exploited vulnerabilities reached mass exploitation in a median of 5 hours. That is why a plan starts by cutting plugins. Every plugin the site doesn't need is removed, plugins whose developers stopped updating them are replaced, and the ones that remain are tracked against security advisories so a patch goes out as soon as it is tested. Want Dardo to do this for you? Tell us what you need. Nico replies personally within one business day. From USD 79 a month [Get a proposal](https://dardo.studio/en/contact/?service=wordpress-maintenance) ## Updates that don't break the site Updates run on a schedule, on a copy of the site first. Minor core releases, which carry security fixes, stay automatic: WordPress enables them by default on every site, and new installations since WordPress 5.6 also update major releases automatically. Major releases, plugins and themes are grouped, applied to staging, checked page by page and released with a rollback point. On a WooCommerce store, staging also runs a test order, database updates and the payment and email notifications before anything reaches production. Urgent security patches skip the schedule and go out as soon as they pass those checks. ## PHP, hosting and certificates WordPress.org recommends PHP 8.3 or greater, MariaDB 10.11 or MySQL 8.0 or greater, and HTTPS. PHP 8.2 receives security fixes only until 31 December 2026, and PHP 8.3 until 31 December 2027, so a site on an older version needs an upgrade planned, not postponed. We upgrade on staging first, because old plugins and themes are what usually break. Certificates need the same watch. Under the CA/Browser Forum's schedule, public TLS certificates can last at most 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029, so renewal has to be automatic and monitored on every hostname the site uses. ## Plan tiers for WordPress sites Plans differ in what they cover, how many change hours they include and how fast we respond. Plans start at USD 79 a month for Monitor; the price of each tier for your site is confirmed after the initial audit, because a brochure site with ten plugins and a store with forty cost different amounts to keep safe. __Plan tiers for WordPress sites__ | Plan | What it covers on WordPress | Who it fits | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- | | Monitor | Uptime, SSL, domain and form monitoring; urgent security updates; backups with a periodic restore test; a short monthly report | Stable WordPress sites with few plugins and someone in-house who edits content | | Maintain | Everything in Monitor, plus scheduled core, plugin and theme updates tested on staging, PHP upgrades, security scans, set change hours and the full monthly report | Business sites whose inquiries or bookings depend on forms, and WooCommerce stores | | Evolve | Everything in Maintain, plus a larger block of design and development hours for new sections and landing pages, and a quarterly review | Teams that keep improving the site and want one studio to design, build and maintain it | ## Taking over a WordPress site someone else built Every plan starts with an initial audit, also for sites another team built. It lists the hosting, DNS, theme, every plugin with its last update, custom code, forms and integrations, and who holds each account. WordPress's Site Health screen is one input; we also take a full backup and restore it in a separate environment to prove it works before we change anything. Ownership stays with you. Hosting, domain, DNS, WordPress admin and analytics accounts should be in your company's name, with Dardo invited as a user. If a former provider holds them, moving them to you is the first task. ## When to stop maintaining WordPress Sometimes the audit shows that maintenance is the expensive option. If a marketing site needs dozens of plugins to do what a static site does without them, or editors avoid the admin, a move to Astro or Webflow can cost less over two or three years than keeping it safe. The audit says so when it does, with the migration priced next to the plan. ## Questions before you choose **How much does WordPress website maintenance cost?** Plans start at USD 79 a month for Monitor: monitoring, urgent security updates, backups with a restore test and a short monthly report. Tested scheduled updates, security scans and change hours come in the higher tiers. The price for a WordPress site is confirmed after the initial audit, because the number of plugins, WooCommerce and the hosting change the work. **Do you maintain WooCommerce stores?** Yes. A WooCommerce store gets the same plan plus checks that matter for selling: plugin and extension updates tested against a test order on staging, database updates run after WooCommerce updates, and payment and email notifications confirmed after each release. Stores usually need the Maintain tier or higher. **Should automatic updates be on?** For minor core releases, yes: WordPress turns them on by default because they carry security fixes. For major core releases, plugins and themes, we prefer scheduled updates tested on staging, with a rollback point, because one plugin update can break a layout or a checkout. Urgent security patches go out as soon as they are tested. **What happens if the site is hacked?** We take the site offline or restore a clean backup, find how the attacker got in (usually an outdated plugin or a reused password), close it, remove unknown admin users and rotate the passwords and keys, then ask search engines to review the site if they flagged it. You get a short incident note with the cause and what changed. **Which PHP version should a WordPress site run?** WordPress.org recommends PHP 8.3 or greater. PHP 8.2 receives security fixes only until 31 December 2026 and PHP 8.3 until 31 December 2027, according to php.net. We upgrade PHP on a staging copy first, because old plugins and themes are what usually break on a new version. **Can you take over a WordPress site another team built?** Yes, after the initial audit. It lists the hosting, DNS, theme, every plugin with its last update, custom code, forms and integrations, and who holds each account. We take a full backup and restore it in a separate environment before changing anything, and moving the accounts into your company's name comes first if a former provider holds them. **Can I cancel a WordPress maintenance plan?** Yes. The notice period is in the agreement. When a plan ends we hand over the latest backup, the update and incident log, the documentation and any credentials we created, and we remove our users if you ask. ## [WordPress maintenance by city](https://dardo.studio/en/wordpress-maintenance/) - [WordPress maintenance in New Zealand](https://dardo.studio/en/wordpress-maintenance-new-zealand/) - [WordPress maintenance in the United Kingdom](https://dardo.studio/en/wordpress-maintenance-uk/) - [WordPress maintenance in Ireland](https://dardo.studio/en/wordpress-maintenance-ireland/) - [WordPress maintenance in Australia](https://dardo.studio/en/wordpress-maintenance-australia/) - [WordPress maintenance in the United States](https://dardo.studio/en/wordpress-maintenance-usa/) ## Sources & further reading Sources behind this page, with further detail from the original publishers. - [WordPress.org: Requirements](https://wordpress.org/about/requirements/) · wordpress.org - [PHP: Supported versions](https://www.php.net/supported-versions.php) · php.net - [WordPress Developer Resources: Upgrading WordPress and automatic background updates](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/) · developer.wordpress.org - [WordPress Developer Resources: Backups](https://developer.wordpress.org/advanced-administration/security/backup/) · developer.wordpress.org - [WordPress.org Documentation: Site Health screen](https://wordpress.org/documentation/article/site-health-screen/) · wordpress.org - [Patchstack: State of WordPress Security in 2026](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) · patchstack.com - [CA/Browser Forum: Ballot SC-081v3, schedule of reducing validity periods](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) · cabforum.org [Dardo](https://dardo.studio/) · [Services](https://dardo.studio/en/services/) · WordPress maintenance ## Start with an audit of your WordPress site Send the site's address, its host and the plugins it runs, if you know them. We reply with what the initial audit covers and how a plan would be scoped. [01 · **Compare the general plan** · Website maintenance](https://dardo.studio/en/services/website-maintenance/) · [02 · **Leaving WordPress?** · WordPress to Astro](https://dardo.studio/en/services/wordpress-to-astro/) · [03 · **Request a proposal** · Send your site and hosting details to Dardo](https://dardo.studio/en/contact/?service=wordpress-maintenance) ## Keep exploring. - [Service · **Website maintenance services**](https://dardo.studio/en/services/website-maintenance/) - [Service · **Website speed optimization**](https://dardo.studio/en/services/website-speed-optimization/) - [Service · **Web accessibility audit and remediation (WCAG 2.2 AA)**](https://dardo.studio/en/services/web-accessibility/) - [Service · **WordPress to Astro migration with every URL kept or redirected**](https://dardo.studio/en/services/wordpress-to-astro/)