No maintenance plan can promise a WordPress site will never be compromised. A serious recurring service reduces exposure, detects high-risk change early, proves backups and business functions, and keeps an incident response route ready.
Scope should follow the site’s value and architecture, not plugin count alone.
Maintain a complete inventory
List WordPress/PHP/database versions, plugins/themes/mu-plugins/drop-ins, custom code, sites/staging, users, integrations and owners. Record source and support status.
Remove abandoned components and temporary environments. Do not leave inactive vulnerable code on disk.
Review the inventory after every architecture change.
Apply controlled updates
Monitor security releases and update through staging, tested backup, compatibility matrix and rollback. Prioritise exposed critical components without waiting for a monthly date.
Test forms, checkout, cron and mail after changes. Replace unsupported plugins/themes rather than permanently pinning vulnerable versions.
Record clean release identifiers.
Review access regularly
Audit WordPress administrators/shop managers/application passwords, hosting/SFTP-SSH/database/email/DNS-CDN/tag/payment/backup/source users and tokens.
Use individual least-privilege accounts, MFA and unique secrets. Remove former staff/suppliers and expired emergency access.
Keep owner/recovery channels independent and documented.
Protect configuration and secrets
Store secrets outside themes/repositories/public backups, rotate on exposure and restrict one site/service per credential where practical.
Review wp-config.php, server rules, scheduled tasks and deployment automation. Monitor unexpected configuration changes without recording secret values.
Keep staging credentials separate.
Harden the hosting boundary
Separate unrelated sites/system/database users, restrict public PHP execution in upload areas where compatible, remove public database/file-manager/backups and apply provider-recommended permissions.
Review PHP versions/extensions, server cron, outbound mail limits and origin access behind CDN. Do not deploy blanket permission/firewall rules without testing forms, checkout and updates.
Keep configuration documented and reviewable.
Monitor high-value changes
Alert on privileged users/roles/tokens, executable/config files, plugin/theme installs, cron/actions, DNS/CDN/tag rules, payment/webhook changes and abnormal outbound mail.
Send logs/alerts to an independent protected channel. Exclude passwords, authorization headers, customer/order/form bodies.
Tune generated-file noise without ignoring executable uploads.
Prove backups
Create off-site protected filesystem/database/configuration backups at a frequency that matches order/lead loss tolerance. Test isolated restoration and record evidence.
Separate incident snapshots from operational rotation. Do not store ZIP/SQL files under public web roots.
Reconcile WooCommerce data between backup points.
Test business paths
Run synthetic logged-out forms, mailbox delivery, login/reset and WooCommerce sandbox/approved checkout checks on a defined schedule and after material changes.
Verify payment/webhooks, stock/orders, cron and analytics without polluting sales or using real cards. Clean test data.
Uptime alone is not form/checkout proof.
Maintain security/search reputation
Review Safe Browsing/Search Console security/manual actions, owners/sitemaps and hacked URL recurrence. Monitor transactional-mail provider reputation if the incident involved spam.
Correct public status/canonical/sitemaps and keep DNS/CDN owners secure.
Do not make repeated review requests without fixing live issues.
Respond to new vulnerability exposure
When an advisory affects an installed component, verify exact version/configuration/authentication requirements, available patch and public exposure. Prioritise by capability and business path.
Apply temporary route containment only as narrowly as possible, then update/replace through the tested process. Check sibling/staging copies and logs for exploitation evidence.
Do not wait for a scanner’s next monthly run.
Keep an incident process ready
Maintain current hosting/payment/legal/privacy contacts, containment method, evidence locations, credential-owner matrix and communication roles.
Rehearse safe maintenance and recovery access. Define what triggers urgent containment versus routine repair.
Do not keep a permanent hidden administrator as an emergency plan.
Report outcomes, not tool activity
A recurring report should state checks performed, evidence, issues, corrections, remaining risk and owner/deadline. It should not claim safety because scanners ran.
Request recurring protection when silent change would affect customers or revenue. A useful service preserves trust and recovery capability without overpromising invulnerability.