5.1Maintenance & updates (core, themes, plugins)
The essentials in 30 seconds
- A WordPress site is living software: core, theme and plugins receive security and bug-fix updates.
- The absolute rule: a fresh backup before any update, then a test in staging whenever possible.
- Do not let technical debt pile up: the longer you wait, the riskier an update becomes.
Running mini-case — the maintenance contract
Hassan signs a monthly maintenance contract with Samir. Every month, Samir backs up the site, tests the updates on a staging copy, then applies them to production during off-peak hours. He checks the form, the shop and the key pages after each intervention. Hassan receives a simple report: what was updated and what was checked.
Sequel to case 5.4 — the site is alive, it needs care.
1. Back up, test, update
WordPress, themes and plugins evolve constantly: security patches, compatibility, new features. An out-of-date site is an easy target. But a poorly prepared update can break the production site — hence a process rather than an impulsive click.
Samir starts with a full, recent backup (files + database). When he has a staging site, he applies the updates there first and checks the key pages: home, form, shop, login. He only moves to production after validation, keeping the backup close at hand.
2. Automate without losing control
Minor security updates can be automatic; major updates and critical plugins — WooCommerce, for example — deserve a supervised test. Samir combines both: automatic for minor, controlled manual for major. He also watches abandoned plugins, which no longer receive patches.
Maintenance is a service: it is planned, documented and invoiced. A monthly report reassures the client and keeps a record of interventions. It is also the opportunity to check backups, administrator accounts and disk space.
🔎 Concrete example — Samir's monthly routine (Atelier Bahja case)
D-1: full backup + off-site export.
Day D: clone on staging, updates applied.
Tests: home, form, shop, login.
Evening: production update, immediate check.
Report: 3 plugins, 1 theme, core — OK.
→ Backup kept for 30 days.Result: an up-to-date site with no nasty surprises.
Lesson: the process reassures as much as it protects.
Section vocabulary
- Maintenance
- All the regular operations that keep a site up to date, backed up and working.
Simple example: Samir's monthly routine.
What it is not: delivering the site and never touching it again.
Reflex: a live site = it gets maintained.
- Staging
- A copy of the site where changes are tested without touching production.
Simple example: testing WooCommerce on staging before the update.
What it is not: applying a major update straight to production.
Reflex: test separately before publishing.
- Technical debt
- The backlog accumulated in updates and fixes, which makes the site fragile.
Simple example: three years without updating the theme.
What it is not: postponing updates indefinitely.
Reflex: the longer you wait, the riskier it gets.
- Minor / major update
- Minor: patches and security; major: an evolution that can affect compatibility.
Simple example: automatic security updates, major version tested.
What it is not: automating everything without distinction.
Reflex: auto for minor, supervised for major.
- Maintenance report
- A simple document listing the updates applied and the checks carried out.
Simple example: a monthly email to the client.
What it is not: intervening without leaving a trace.
Reflex: maintenance = traceability.
In practice — Setting up a maintenance routine
- List the site's core, theme and plugins, with their versions.
- Schedule a full backup before every update.
- Test the updates on a staging site or, failing that, during off-peak hours with a backup.
- After updating, check the key pages and record the interventions.
Ready-to-use script — proposing maintenance (25s)
"A WordPress site must be updated regularly, otherwise it becomes vulnerable. I suggest monthly maintenance: backup, testing the updates and checking the key pages. You receive a simple report every month."
Present maintenance as insurance, not as an expense.
Copy-paste template — monthly routine
FULL BACKUP: date _______________
STAGING TEST: yes / no
CORE / THEME / PLUGINS UPDATED: _______________
PAGES CHECKED: home / form / shop / login
INCIDENT: _______________
REPORT SENT: yes / noShowcase site
Monthly updates, backup and key page checks.
Shop
Order tests after every critical update.
High-traffic site
Systematic staging, maintenance window and monitoring.
Tight budget
Automatic backup and priority security updates.
✓ Best practices
- Back up before any update.
- Test on staging whenever possible.
- Keep a record of the interventions.
✗ Common pitfalls
- Updating without a backup.
- Leaving an abandoned plugin active.
- Automating everything, including major updates.
Key takeaways
- Maintenance is essential and regular.
- Backup before updates, test on staging.
- Minor automatic, major supervised.
- Maintenance is documented and invoiced.
48h Challenge — apply tomorrow
Create a routine: backup, plugin list, staging or off-peak test, key page check. Write the standard report. 25 minutes.
- I apply a safe update process.
- I test before production.
- I document maintenance for the client.
Frequently asked questions
Should automatic updates be enabled?
For minor security updates and trusted plugins, yes: it is safer than forgetting. For major updates or critical plugins, prefer a supervised test with backup and staging.
My host does not offer staging: how do I test?
Use a staging plugin, a local clone or, failing that, back up just before and update during off-peak hours, checking the key pages immediately. Without staging, the backup matters even more.
Is maintenance really necessary for a small site?
Yes: security flaws do not depend on the size of the site. An out-of-date site can be compromised and used as a relay for attacks. Maintenance remains light for a simple site.
What does Samir do before applying a major update to production?