WordPress Maintenance: Updates, Backups and Staying Secure
A WordPress site isn't a finished object. It's a stack of software that keeps moving underneath you whether you touch it or not, and a site that was built once and then left alone drifts quietly out of date. Plenty of businesses in Edinburgh and across the Lothians are running sites that haven't been looked at since handover. Here's what maintaining one properly involves, and why it matters more than owners expect.
The moving parts
Maintenance makes more sense once you know what a WordPress site is made of. There are four layers, each updated by different people on different schedules.
- Core. WordPress itself. Security releases arrive on their own timetable and are usually small and safe.
- The theme. Controls how the site looks. Custom themes are often the least maintained part, because nobody upstream is releasing fixes.
- Plugins. Everything bolted on — contact forms, booking, shops, galleries, SEO tools. Each is a separate piece of third-party code with its own author.
- PHP. The language the whole thing runs on, controlled by your hosting. Versions reach end of life and stop receiving security fixes.
Abandoned plugins are the real risk
Sites are rarely compromised through some exotic new attack. Far more often it's a known weakness in a plugin, published openly when the fix was released, then exploited on every site that never applied it. Automated scanners trawl the web looking for exactly that.
The plugins that worry us most aren't the outdated ones — those can be updated. It's the ones whose authors have walked away. No update is coming, so the flaw stays open indefinitely. Before trusting a plugin, check when it was last updated, which WordPress version it claims to be tested against, and whether anyone is answering questions in its support forum. A good general rule: the fewer plugins you run, the smaller your exposure.
Why updates sometimes break things
People avoid updating because an update once broke their site, which is a fair concern. Plugins hook into core and often into each other, so when core changes how something works, or two plugins expect different versions of the same library, or a theme has been edited directly instead of through a child theme, an update can knock out a layout or a form. The answer isn't to stop updating — an unpatched site is the bigger risk — it's to update in a way where a break is recoverable.
Back up first, check on staging second
A WordPress site is files plus a database, and a backup that only captures one of them will not bring you back. Take a full copy before you touch anything, and prove at least once that you can restore it — the same discipline covered in our guide to business backup strategy.
A staging site — a private copy of the live site — lets you apply updates and click through the pages that matter before anything reaches customers. Good hosting includes one; if yours doesn't, that's worth weighing at renewal.
Don't ignore the PHP version
PHP versions are supported for a limited time and then stop getting security fixes, much like Windows reaching end of life. Sites left on an old version keep working, which is why nobody notices. Moving up is usually straightforward, but older plugins can break on newer PHP, so it's another change to try on staging first, not on a Friday afternoon.
Logins are half the job
Patching means little if an administrator password is reused elsewhere. Give people their own accounts rather than sharing one, drop everyone to the lowest role that lets them do their job, remove accounts when staff leave, and turn on two-factor authentication for anyone with admin rights.
What a sensible rhythm looks like
- Weekly. Apply plugin and core updates, ideally checked on staging, with a backup taken first. Load the site afterwards and use it.
- Monthly. Confirm backups are running and restorable, review user accounts, and test that contact and booking forms still deliver email.
- Quarterly. Audit plugins. Remove anything unused, and replace anything the author has abandoned.
- Yearly. Review PHP and hosting, and be honest about whether the theme is still supported.
WordPress sites we look after
We design and host business websites, and on the sites we look after this rhythm is simply the job: backups proven, updates checked on staging, plugins audited, PHP kept current. We also run email-only hosting and plan Microsoft 365 moves end to end, alongside our business IT support, managed IT services and cyber security for businesses across Edinburgh and the Lothians, from our base in Wishaw, with a clear quote before any work.