Good WordPress support covers six things: tested updates, off-site backups that are proven to restore, monitoring, security, a clear way to get fixes and small changes done, and a written record of what was done. If a plan only promises "plugin updates", it is maintenance in name only. This checklist is the one we use when we take on a site, and you can use it to compare any provider, including us.
The checklist
| What to expect | What good looks like | Why it matters |
|---|---|---|
| Updates to WordPress core, themes and plugins | Tested on a staging copy before they reach the live site, on a regular schedule | Most breakages after an update come from plugin conflicts. Testing first means you find out before your customers do |
| Backups | Automatic, stored away from your hosting server, kept for a set period | A backup held only on the same server can disappear with it |
| Restore testing | Someone actually restores a backup from time to time | A backup nobody has restored is a hope, not a plan |
| Uptime monitoring | The provider gets the alert and acts on it | You should not be the one who notices the site is down |
| Security | Hardening, login protection, admin account reviews, malware scanning, and clean-up included if something gets in | Clean-up is where costs jump if it is not covered |
| Fixes and small changes | A clear allowance or process for small edits and bug fixes | Avoids arguments about what counts as "support" |
| Response times | Written down, with a faster route for urgent problems | "We'll get to it" is not a response time |
| Reporting | A short monthly or quarterly summary of what changed | You can see what you are paying for |
| Access and ownership | You own the domain, hosting and admin accounts, and get full access on request | Protects you if the relationship ends |
| Data protection | A written agreement covering how the provider handles personal data on your site | Required under UK GDPR when a supplier processes personal data for you (see below) |
What is usually not included
Most support plans cover keeping the site healthy, not building new things. Expect these to be quoted separately:
- New pages, sections or features
- Redesigns and major content changes
- Moving to a new theme or rebuilding with a page builder removed
- Large migrations, such as changing host or domain
- Premium plugin and theme licences, which are normally billed to you by the vendor
- Hosting, unless the plan says it is included
None of this is a problem as long as it is written down before you start.
What drives the cost of WordPress support
We do not publish prices, because two sites that look alike can need very different amounts of care. These are the things that actually move the monthly cost, whoever you hire.
| Factor | Why it changes the work |
|---|---|
| Number and type of plugins | Every plugin is something to update, test and watch for vulnerabilities. Complex plugins such as booking systems and membership tools take longer to test |
| WooCommerce or other ecommerce | Updates need checking against checkout, payments and stock, and downtime costs you sales |
| Custom code | A custom theme or plugin needs someone who understands it, not just a one-click update |
| Theme and page builder | A page builder such as Elementor or Divi adds its own updates and add-ons to test. Old builder versions or abandoned add-on packs take more care |
| PHP version | Sites on an old PHP version need an upgrade plan, and some plugins need replacing before the upgrade is safe |
| Testing on staging | Testing every update properly takes time. Plans that skip it are cheaper and riskier |
| Response commitments | Guaranteed fast responses, or out-of-hours cover, need someone available |
| Change allowance | The more editing and small development work you expect each month, the more time is reserved for you |
| Hosting included or not | Managed hosting adds the hosting bill and the work of looking after the server |
| State of the site on day one | An old, neglected site usually needs a clean-up period before routine support makes sense |
When you compare quotes, compare them against the checklist above rather than on price alone. A cheaper plan that leaves out staging tests or clean-up can cost more the first time something goes wrong.
UK specifics worth checking
Data protection. Your website almost certainly holds personal data: contact form entries, customer accounts, orders. A support provider who can access that data is acting as a processor for you under UK GDPR, and the law requires a written contract between you covering how they handle it. The ICO explains what that contract must include in its guidance on contracts between controllers and processors. Ask any provider for theirs.
Where backups are stored. Ask where backups and any copies of your site are kept, and for how long. Backups contain the same personal data as the live site.
Cookies. If an update or a new plugin adds tracking, your cookie banner and policy need to keep up. The ICO's guidance on cookies sets out what consent you need. A good support provider will flag this rather than leave you to find out.
Questions to ask before you sign
- Do you test updates on a staging copy before applying them to the live site?
- Where are backups stored, how long are they kept, and when did you last test a restore?
- If the site is hacked, is the clean-up included?
- What are your response times, and what counts as urgent?
- What exactly is a "small change", and what happens when I need more?
- Will I have full admin, hosting and domain access at all times?
- Do you have a written data processing agreement?
- What happens to my site and data if we stop working together?
A provider who answers all eight clearly is probably doing the job properly.
Warning signs
- Updates applied automatically to the live site with no testing and no report
- Backups stored only on the same server as the site
- The provider holds the only admin login or owns your domain
- Security clean-up quoted as an extra after you have been hacked, when the plan claimed to cover security
- No written terms at all
How we handle WordPress support at MTX
Depending on the plan, we apply updates twice a month. We test updates on a staging copy or take a full backup first, and check the site after each round. Urgent security fixes go on sooner. Backups run automatically and are kept for three months. Small changes and fixes are included in our support packages, so clients do not need a separate quote for every edit. And our clients always own their domain, hosting and code: if they decide to move on, they keep everything.
If you want a second opinion on your current setup, we offer a free audit: we review your site and tell you what we would change first.
Questions
Is WordPress support the same as WordPress maintenance?
People use the terms interchangeably. Maintenance usually means the routine work: updates, backups and monitoring. Support usually adds fixes, small changes and someone to call when something breaks. Check what a plan includes rather than what it is called.
Can I just turn on automatic updates?
WordPress applies minor core updates automatically by default, and you can switch on automatic updates for plugins and themes. That keeps things patched, but nobody checks whether an update broke a form, the checkout or the layout. For a simple site that may be acceptable. For a site that brings in business, someone should test.
How often should a WordPress site be updated?
Security fixes should go on as soon as practical after release. Routine updates are usually batched weekly or fortnightly, tested, then applied together.
Does it matter if my site uses Elementor or Divi?
Not for whether it can be supported: both are mature builders. It matters for the work involved. Builder updates, and especially third-party add-ons for them, need testing like any plugin. We have used Elementor for most new builds over the last five years and still support Divi sites.
Do I need support if my site is new?
A new site has fewer problems but the same exposure: plugins still release updates and vulnerabilities still get found. The earlier support starts, the less clean-up is needed later.
Why don't you publish prices?
Because the cost depends on the factors in the table above, and a fixed price list would be wrong for most sites. We quote after looking at the site so the number reflects the real work.
