WordPress Maintenance in Sonoma County: What the Work Involves

WordPress runs about 40 percent of all websites, so if your Sonoma County business site went up in the last fifteen years, there is a fair chance it runs on WordPress. It is capable, flexible software. It is also software running on a server, assembled from parts written by many different people, and it needs looking after the way a work truck does.

The word “maintenance” gets stretched a long way. Plenty of monthly plans sold under that name amount to hosting and an invoice. Here is what the work covers, the signs that a site has gone without it, and how to tell when replacing the site would cost less than keeping it running.

Why WordPress needs regular attention

A WordPress site has three layers, and each one changes on its own schedule: WordPress itself (the core), the theme that controls the design, and the plugins that add everything else, from contact forms to booking widgets to SEO settings.

Most of the risk sits in the plugins. Patchstack, a security company that tracks WordPress vulnerabilities, counted 11,334 new ones across the WordPress ecosystem in 2025. Ninety-one percent were in plugins and nine percent in themes. WordPress core had six. Almost half had no fix from the developer by the time they were made public.

So most of the upkeep goes into everything bolted onto WordPress. A site with eight well-chosen plugins is a manageable thing to look after. A site with forty, a few of them abandoned, carries a standing risk every week it stays online.

What maintenance should cover

Core updates

Since version 3.7, WordPress has installed minor maintenance and security releases on its own by default, and fresh installs since version 5.6 take major releases automatically as well. That depends on the server cooperating. Someone still needs to confirm the updates are landing and deal with the ones that stall.

Plugin and theme updates, tested

Plugins and themes update themselves only when someone switches that on for each one, an option WordPress added in version 5.5. Either way the updates need checking. An update can break a layout, a form or a checkout, and you want to find that out before a customer does. Good practice is to update a copy of the site first (a staging site), check the pages that matter, then update the live one.

Part of this job is pruning. Remove the plugins and themes the site has stopped using, since inactive code still sits on the server. Keep an eye on the ones that have gone quiet, too. The WordPress.org plugin directory shows a notice on any plugin that hasn’t been tested with the latest three major WordPress releases, warning that it may no longer be maintained.

Backups, with a restore you have tried

A backup proves itself the first time someone restores from it. Maintenance should include automatic backups of both the files and the database, kept somewhere other than the server the site lives on, plus a test restore every so often. WordPress’s own upgrade guide says to back up both before upgrading and to check that the backups are usable.

Security housekeeping

Updates do most of the security work. The rest is housekeeping:

• One login per person, each with a strong password and two-factor authentication.
• Accounts removed when staff or vendors move on.
• A firewall or security service watching for known attack patterns.
• Someone checking the Security Issues report in Google Search Console. Google can put a warning label on an affected site in search results, or show visitors a full-page warning in the browser.

Uptime and certificates

Monitoring should tell someone the site is down before a customer finds out. The security certificate behind the padlock renews on a schedule, and when a renewal fails, browsers show visitors a warning page where your homepage should be.

PHP versions

This is the item owners hear about least. WordPress is written in PHP, and every PHP version has a fixed lifespan. PHP 8.1 and everything older have stopped receiving security fixes, and PHP 8.2 stops receiving them at the end of 2026. WordPress recommends PHP 8.3 or newer. It will still run on versions back to 7.4, and its requirements page warns that those older versions may expose a site to security vulnerabilities.

Switching PHP versions is usually a setting at the host. The work is confirming first that the theme and every plugin run on the new version.

Forms and email

Test the contact form every month. By default WordPress hands its mail to the web server to send, and that mail can land in spam or vanish with no error anywhere. A form that quietly stopped delivering looks exactly like a slow month.

Signs a WordPress site has gone without care

• The dashboard shows a stack of pending updates, or a notice that PHP needs updating.
• The plugin list includes things nobody can explain.
• User accounts belong to people who left years ago.
• Pages or links appear on the site that you never wrote, often spam, sometimes in another language.
• Visitors mention a certificate warning, or Google shows a warning beside your listing.
• Pages load slowly, or parts of the layout look broken on a phone.
• Nobody can say when the last backup ran, or where it is stored.
• Nobody has the admin login.

A ten-minute check you can do yourself

If you can log in, you can see most of this.

1. Tools > Site Health. WordPress grades its own setup and lists critical issues, including an outdated PHP version and plugins waiting for updates. The Info tab shows your WordPress version, and the Server section shows PHP.
2. Dashboard > Updates. Count what is waiting.
3. Plugins. Look for anything inactive, and look up anything unfamiliar on WordPress.org.
4. Users. Note any accounts that shouldn’t be there, and check with whoever manages the site before deleting them.
5. Search Console > Security Issues, if you have Search Console set up.
6. Your contact form. Send yourself a message and confirm it arrives.

When a rebuild costs less than maintenance

Sometimes the cheaper path is a new site. These are the usual signals:

• The theme the whole design depends on has stopped receiving updates.
• Key plugins are abandoned, and replacing them means redesigning pages anyway.
• The site only runs on an outdated PHP version.
• The site has been hacked, especially more than once. Cleaning a compromised site is careful work, and a reinfection usually means something was missed.
• The plugin count is high for what the site does. A five-page brochure site with thirty plugins is carrying a lot of weight it has no use for.
• You pay every month and still need to call someone for a simple text change.

A rough rule: if catching the site up would cost more than a year of maintenance, or would mean replacing the theme anyway, price a rebuild alongside it before you decide. Our post on website costs in Sonoma County lays out what a replacement typically runs.

How we handle WordPress

Our own builds are custom static sites hosted on Cloudflare. With no plugins and no database on the server, most of the list above simply goes away. A well-run WordPress site with a careful maintainer is a perfectly good setup too, and if that is what you have, keep it.

We take on existing sites case by case. It depends on what the site is built on and what shape it is in. A clean WordPress install on a decent host is usually straightforward. A neglected page-builder site with dozens of plugins is often cheaper to rebuild, and we will tell you which one you have.

Maintenance is part of the $200 Website Plan, along with hosting and the build itself, and our website maintenance page lists exactly what it covers. To see where your WordPress site stands first, the free audit checks speed, SEO and your Google profile against three local competitors, and says so plainly when the site is fine as it is. If a rebuild makes more sense, the web design page covers what goes into one.