A WordPress maintenance retainer should cover core, theme and plugin updates, off-site backups, security checks, uptime and performance monitoring, and a set amount of change work each month, such as new pages, price updates or fixes. The upkeep keeps the site safe, and the change work keeps it useful. On my IPL Biologicals retainer, which has run since 2025, the change work has included a sub-brand launch, bulk price updates and phone OTP login.
Why do WordPress sites need ongoing maintenance?
Because WordPress sites are made of moving parts. Core, the theme and every plugin get updates, many of them security fixes. PHP versions reach end of life. Hosts change their caching. Email providers change. Each of these can break something quietly, and the owner usually finds out from a customer.
Two examples from my 2025 work:
- A form that stopped sending. On Samko Holdings and Crowne Plaza London Kingston, a GoDaddy cache layer started swallowing form submissions. Upgrading PHP from 8.0 to 8.3 fixed both.
- Order emails that stopped. On IPL Biologicals, order emails stopped after the company moved from Gmail to Outlook. I restored them.
Neither was caused by the site owner. Both cost leads or orders until someone fixed them.
What does a maintenance retainer include?
| Area | What I do | Why it matters |
|---|---|---|
| Updates | Core, theme and plugins, with a backup first | Most WordPress security fixes arrive as updates |
| Backups | Off-site, such as UpdraftPlus to Google Drive | A backup on the same server dies with the server |
| Security | Wordfence, two-factor login and my HTTP Security Header plugin | Blocks the common attacks and protects logins |
| PHP version | Keep the site on a supported version | Old runtimes lose security fixes and behave oddly with host caches |
| Monitoring | Uptime and performance | You hear about problems before customers do |
| Change work | A set amount each month | New pages, price updates, fixes, small features |
What kind of change work does a retainer cover?
This is where a retainer earns its keep. IPL Biologicals makes biofertilisers and biopesticides, and its marketing team needs a developer on call for a steady stream of changes. On the retainer I have:
- Built the Grow Organic launch pages for a new gardening sub-brand inside the existing store.
- Added phone OTP login over SMS for customers and admins.
- Set up bulk MRP updates from a sheet, instead of editing products one by one.
- Added stock rules so fertiliser SKUs above 1 kg show as out of stock while the size dropdown stays uniform.
- Restored order emails and fixed WooCommerce Analytics order reporting.
- Published news posts, replaced the catalogue PDF and supported the Amazon Seller Central listing.
- Fixed the homepage banner autoplay and repaired the video tutorials page, adding Hindi tutorials.
- Built an international business page with a world map.
None of these needed a new project. Each was a request that would otherwise have waited.
Agree what counts as change work
Write down what fits inside the monthly allowance and what becomes a separate project, such as a redesign or a new store. It saves an awkward conversation later.
What should you ask before signing a retainer?
- 1
Where are backups stored?
Off the server, with a restore you have seen work at least once.
- 2
How are updates tested?
A backup before each round, then checks on the pages, forms and checkout that matter.
- 3
What happens when something breaks?
How you report it and how quickly someone looks.
- 4
How much change work is included?
An agreed amount each month, and what happens to unused or extra work.
- 5
Who holds the keys?
Hosting, domain, DNS and admin access should be in your name. I hand clients a backup and export of their own site on request.
- 6
What do you get each month?
A short summary of updates, issues and changes.
Do you need a retainer, or just occasional help?
It depends on how often the site changes and what it does. A brochure site with few plugins can be checked a few times a year. A shop, a site that takes bookings or payments, or a site a marketing team changes every week needs someone watching it.
IIID Inscape moved onto an ongoing maintenance plan after launch, because the site held an archive the institute could not recreate. That is the right instinct: the more it would cost to lose, the more the retainer is worth.
What does a good handover look like if you leave?
A retainer should never be a lock-in. You should be able to take your site to any developer with a full export, the admin and hosting logins in your name, and documentation of anything custom. When I moved five UK client sites between hosts in 2025, every client ended up holding their own backup.
For one-off moves, see how to move a WordPress site to a new host without downtime, and for the security side, the WordPress security checklist. Retainers are part of my hosting migrations, DNS and maintenance retainers service. Tell me what your backlog looks like and I will reply with a plan.
