WordPress maintenance and operations with SLA
We test updates before they go live, back up every day and get an alert if the site goes down.
When nobody is maintainingyour WordPress site
Many WordPress sites aren't looked after once they've launched. The agency that built the site has moved on to other projects, or the person responsible in-house has left. Often you only notice when your hosting provider emails you about a serious vulnerability, or when you log in and see that lots of plugins are waiting for updates.
It rarely means anyone did a bad job. Maintenance was often in the original quote, but the agreement was never signed.
post@client.no3 unreadHello,
We have found a critical vulnerability in Contact Form 7 (version 5.4) on client.no. The vulnerability is public and being actively exploited.
Please update the plugin within 48 hours. Otherwise we will take the site offline temporarily to protect the other customers on the server.
ReplyForwardIf you're comparing maintenance agreements, ask what is actually done. In some agreements, someone clicks "update all" once a month, without testing first and without keeping an eye on the site in between. For a simple site that may be enough, but you should know what you're paying for.
- Of hacked CMS sites run WordPress
- 90%
- From the site going down to our alert
- 60s
- Agreed uptime on the Pro tier
- 99.9%
- To test and publish an update
- <15min
Seven signs your WordPress site isn't being maintained
- WordPress is several versions behind, for example 6.4 when 6.7 is out. Security holes fixed in the newer versions are public and easier to exploit.
- Lots of plugins are waiting for updates. The most urgent are plugins that handle payments, forms or logins.
- Nobody knows for sure who has admin access. Former developers and staff who have left often still have an account.
- Nobody has tried restoring the site from a backup, so nobody knows whether the backup actually works.
- The site is slower than it used to be. The database keeps growing, and outdated plugins make every page view a little slower.
- Nobody is told when the site goes down. Usually a customer is the one who mentions it.
- It's unclear who is responsible for the site, and nobody has an agreement to look after it.
If three or more of these sound familiar, someone should go through the site and work out what's urgent.
How we testa WordPress update
Updates to WordPress and plugins are installed first on a copy of the site, with the same database and the same PHP version as the live site. There we submit forms, check logins and connections to other systems, and test payments if the site takes them. An automated test takes screenshots before and after the update and shows us if anything looks different.
woocommerce 9.4.1 → 9.4.2RunningPassed- Backup of production
- Copy to stagingPHP 8.4, same database
wp plugin update woocommerce- Contact form sent
- Checkout with a test card
- Login and My account
- Tripletex integration
- Screenshots compared32 pages
- Deployed through CI/CD
Once the tests pass, the update is published automatically. The whole job takes under 15 minutes. Done by hand, it takes around three hours.
Updating without testing is quicker, but faults are then often found only when a customer can't send a form or complete a purchase.
When the site goes downoutside working hours
A plugin update can crash the site, or the server can stop responding. The site then shows a blank page or an error message, and it can happen at any time of day.
Our monitoring detects the fault within 60 seconds and sends an alert. On the Enterprise tier, a senior developer starts troubleshooting within 30 minutes, also outside working hours. On Basic and Pro, work starts during working hours.
Most businesses manage fine without help at night. It's worth it when sales run around the clock, as in an online shop, or when customers expect to use the service at any time.
client.noOngoingResolved- Home page returns error 500Monitoring checks the site every minute
- Alert sent by SMS and Slack54 seconds after the site went down
- A senior developer has the caseEnterprise: within 30 minutes, at night too
- Cause: the database stopped respondingEvery connection was in use
- Database restartedCache cleared and warmed up again
- The site responds again33 minutes of downtime, report sent at 08:00
WordPress maintenance in three SLA tiers
| Basicfrom NOK 2,500 | Profrom NOK 5,500Most common choice | Enterprisefrom NOK 12,000 | |
|---|---|---|---|
| Response time, normal issues | Within 8 hours | Within 4 hours | Within 1 hour |
| Response time, critical faults | Within 4 hours | Within 2 hours | Within 30 min |
| Regular updates | Monthly, tested | Weekly, tested | Continuous |
| Security monitoring | Daily scan | Daily scan and firewall (WAF) | Daily scan, firewall (WAF) and penetration test |
| Backups | Daily | Daily, tested | Continuous, tested |
| Agreed uptime | 99.5% | 99.9% | 99.95% |
| Test copy of the site | Included | Included | Included |
| Performance review | — | Every quarter | Every month |
| Support hours included | 1 hour/month | 3 hours/month | 8 hours/month |
| Help outside working hours | — | — | Included |
The same site, with and without maintenance
A WordPress site gets slower when nobody maintains it. The database fills up with old revisions of posts, caching works less well, and outdated plugins make every page view a little slower. After a year the difference can be several seconds [1].
The servers your site runs on
Much of a site's speed and security comes down to the server. This is the setup when we run your site.
Fast hosting
Our servers run FrankenPHP and serve the first page in under 200 milliseconds. Typical Norwegian WordPress hosting takes 1–3 seconds to do the same.
Several layers of security
Plugins are checked every day against a list of known vulnerabilities, and we get an alert if WordPress files change without anyone asking for it. Logging in to the admin panel requires two-factor authentication and an approved IP address, and features that are often misused in attacks are switched off.
Tested backups
On Pro and Enterprise, we regularly restore the backup to a test copy and check that the site works. That way we know the copy is complete and how long a restore takes.
Monitoring every minute
We check every minute, around the clock, that the site responds. If it goes down, we get an alert within 60 seconds, usually before your customers notice.
What an operations agreement includes
Maintenance is the work that needs doing. Operations means someone is responsible for keeping the site running. An operations agreement with us covers both for a fixed monthly price, and you know who to contact. The agreement is built on four fixed routines.
Monitoring. We check every minute that the site responds, and get an alert within 60 seconds if it goes down. WordPress, themes and plugins are scanned for known vulnerabilities every day.
Updates. Every update is tested on a copy of the site before it goes live, even the ones that look small. Security updates are installed on the day they're released.
Backups. We back up every site daily. On Pro and Enterprise, we also check regularly that the backup can be restored.
- Monitoring99.98 % uptime, no incidents
- Vulnerability scans30 scans, no findings
- Updates14 tested on staging, 1 security update the same day
- Backup30 daily, restored on a test environment on 12 Sep in 6 min
- Response time2 cases, answered within 1 h 40 min (SLA: 4 h)
Pro plan with a named contact.
Response time. The agreement states how quickly we respond, from 8 hours for normal issues on Basic to 30 minutes for critical faults on Enterprise. Who handles the issue is agreed in advance.
If your site is down right now, you can get emergency WordPress help. To see what operations cost alongside development, look at our pricing overview.
When you can maintain WordPress yourself
If you have a simple site with no connections to other systems, you can maintain it yourself. The documentation on WordPress.org is good. We also offer simple hosting for people who want to do the work themselves. It comes with no SLA or management.
- Basic agreement, one year
- NOK 30,000
- One security incident
- NOK 15,000–80,000
- Lost sales, one day down
- NOK 50,000
Lost sales are for an online shop with NOK 50,000 in daily sales.
The hardest part is keeping up the routine all year. You need to install security updates when they're released, read what has changed before you update plugins, and have tried restoring a backup at least once. It's easy to put off when you're busy.
If the site takes payments, like an online shop, or connects to other systems, maintenance should be handled by someone who does it every day. Cleaning up after a break-in typically costs NOK 15,000–80,000, and lost sales while the site is down come on top of that.
How we take over maintenance
- 01 / 04
Health check
We look at the site from the outside: security, speed and which versions of WordPress and plugins it runs. We don't need access to the code, and afterwards you know what state the site is in.
- 02 / 04
Report
You get a list of what's urgent and what can wait. You decide what gets done, and when.
- 03 / 04
Takeover
We take over operations and maintenance. If your current hosting is part of the problem, we move the site to our servers at the same time.
- 04 / 04
Ongoing operation
You pay a fixed monthly price and have a written agreement on response times. When you get in touch, you talk to the developers who run your site.
The health check is free. You get a list of what should be done, and decide for yourself whether to go ahead.
Questions we often get
What does WordPress maintenance cost?
Maintenance with an SLA starts at NOK 2,500 a month. The lowest tier, Basic, includes updates, backups, monitoring and response during working hours. Pro starts at NOK 5,500 a month and adds a shorter response time, a firewall (WAF) and tested backups. Enterprise starts at NOK 12,000 a month and gives a 30-minute response, also outside working hours. If you want to do the maintenance yourself, we offer simple hosting from NOK 500 a month without an SLA.
How often should WordPress be updated?
Security updates should be installed on the day they're released. Other plugin and theme updates can be grouped and done weekly or monthly, depending on how important the site is. WordPress releases minor versions every four to six weeks and major versions two or three times a year. Larger updates should be tested on a copy of the site first.
What happens if WordPress isn't maintained?
The most common way in for an attacker is an outdated plugin with a known security hole. That can lead to malware on the site, downtime and lost data. If personal data is exposed, you usually have to report it to the Norwegian Data Protection Authority, and you can be fined. The site also gets slower over time, which affects both sales and your position in Google's search results.
Can I maintain WordPress myself?
Yes, especially if the site is simple, doesn't take payments and doesn't store sensitive information. The key is keeping up the routine all year: installing security updates when they're released, updating plugins regularly and having a backup you've tried restoring. For online shops and sites connected to Vipps, BankID or other systems, the work should be done by someone who does it every day.
What's the difference between operations and maintenance?
Maintenance is the work: updates, backups and fixing faults. Operations means someone is also responsible for keeping the site running, with monitoring and an agreed response time. Many people searching for "WordPress maintenance" really need operations: someone who deals with the problem when the site is down.
What's the difference between hosting and maintenance?
Hosting is the server your site runs on. Maintenance is the work on the site itself: updates, security, backups and fixing faults. One doesn't replace the other. A fast server doesn't help much if an outdated plugin lets an intruder in.
What does a WordPress operations agreement include?
On every tier you get tested updates to WordPress, themes and plugins, daily backups, security and uptime monitoring around the clock and an agreed response time during working hours. From Pro, backups are also tested and you get a performance review every quarter. Enterprise has a monthly review and help outside working hours.
Get your WordPress site assessed
Send us the site's address and a few lines about how it's used. We'll tell you how much maintenance it needs and which tier fits.