WordPress maintenance

In short: The WordPress core, theme and plugins need regular updates, especially when security fixes are available. Before updating, you need a full backup of the files and database and, if possible, a check in a test environment. If a “Fatal error” appears, look for the cause in the error log; checking plugins is one of the diagnostic steps.

Many people think: “The site has been built – surely it will run for years.” Unfortunately not. WordPress is a living system made up of:

• 
  

  the WordPress core,

  
  
• 
  

  the theme,

  
  
• 
  

  plugins.

  
  

All three parts change and evolve. If you do not update them, they start to become incompatible with each other or become insecure. The result: a Fatal error, “white screen” errors, a slow site, or worse – a hacked one.

How often should you update?

• 
  

  At least once a month.

  
  
• 
  

  For active stores – more often: once a week or whenever security fixes are released.

  
  
• 
  

  For paid plugins/themes, check that the licence is valid (usually once a year or every month). If the licence has expired, updates and security fixes no longer arrive.

  
  

Why do they need to “be compatible”?

• 
  

  Plugins have to be compatible with the WordPress core and the theme.

  
  
• 
  

  A WooCommerce update may require newer plugin versions (payments, delivery, VAT, etc.).

  
  
• 
  

  If one element is outdated, a single small conflict is enough for the site to throw a Fatal error.

  
  

A website is not a stone tablet – it is like a car:

• 
  

  Fuel = hosting, SSL, CDN, email.

  
  
• 
  

  Oil/filters = updates and security patches.

  
  
• 
  

  Service = backups, monitoring, error logs.

  
  

If you do nothing, one day it will not start. And sometimes the cost of the repair is > the “savings”.

• 
  

  Outdated plugins with known security holes → a bot “sews in” malware, starts sending spam or loads external script ads.

  
  
• 
  

  An expired licence for a paid plugin → no updates → after a couple of WooCommerce versions, incompatibility and a Fatal error.

  
  
• 
  

  A “white page” after pressing one wrong button with no backup. There is no way back, because you cannot get into the admin panel.

  
  

There are cases where the site cannot be recovered: there is no backup, the file system is infected, the admin panel is inaccessible, the host has blocked access. At such moments it is cheaper and faster to restore from an old backup (if there is one at all) or, unfortunately, to build the site from scratch.

Every month (or more often):

1. 
   

   A full backup (files + database), and check that it can be restored.

   
   
2. 
   

   Update: the WordPress core, theme and plugins (first on a staging/test environment or locally).

   
   
3. 
   

   Check the licences for paid plugins/themes and renew them.

   
   
4. 
   

   Look at the error logs, 404s and page speed.

   
   
5. 
   

   Security: scanning (e.g. Wordfence/Defender), a password policy, 2FA for admins.

   
   
6. 
   

   Fixes for broken images/URLs, a technical SEO check (sitemap, indexing).

   
   
7. 
   

   WooCommerce: an order test, a payment test (sandbox – in test mode), emails.

   
   

Once a quarter:

• 
  

  The PHP version (hosting), server updates.

  
  
• 
  

  A plugin audit: we delete unused ones (less code → less risk).

  
  
• 
  

  A performance audit (cache, CDN, database clean-up).

  
  

1. 
   

   Do not update anything “blindly” in the production environment. First try to switch on recovery mode.

   
   
2. 
   

   Check your email: WordPress often sends a Recovery mode link (“Your Site is Experiencing a Technical Issue”). If there is one, click it and open the admin panel in safe mode.

   
   

3. If you cannot get into the admin panel, connect via FTP/the hosting file manager and:

   • 
     

     In the /wp-content/plugins/ folder, rename the suspect plugin’s folder (e.g. woocommerce → woocommerce.off). This will disable only that plugin. If you do not know which plugin is causing the error, rename the whole plugins folder (e.g. to plugins.hold) — this will disable all plugins.

     
     
   • 
     

     If the site still does not work, rename the theme folder too, to theme-name.off; WordPress will switch to the default (Twenty Twenty-*).

     
     
4. 
   

   Clear the cache (if you use a caching plugin/CDN).

   
   
5. 
   

   Make sure the PHP version is compatible with your WordPress/Woo version (sometimes it needs to be lowered/raised).

   
   
6. 
   

   Check the error_log on the hosting or the WordPress debug log: it is only written if WP_DEBUG and WP_DEBUG_LOG are enabled in wp-config.php; by default the file is /wp-content/debug.log, but the path can be changed. It often shows clearly which line and which plugin is causing the error.

   
   
7. 
   

   Once the site is “up” again, apply the updates in sequence (one at a time), with a test after each step (re-enable the plugins folder and “start” each plugin one at a time).

   
   
8. 
   

   If you still cannot get in or the error comes back – restore from a backup (from before the incident) or, if it “crashes” when you activate a plugin, go to the plugins folder and deactivate that specific plugin by renaming it, e.g. from backupwp to backupwp1 (it will be deactivated automatically).

   
   
9. 
   

   Change the passwords (admins/FTP/DB), renew the security keys (wp-config.php) and run a security scan.

   
   

No backup? Create one immediately, as soon as the site is “back up”. Without a backup, every next update is a game of chance.

• 
  

  A staging environment for tests (a copy where you can click safely).

  
  
• 
  

  Monthly updates + licence renewal for paid plugins/themes.

  
  
• 
  

  Automatic backups (daily/monthly; stored outside the hosting).

  
  
• 
  

  Security: firewalls/scanning/2FA/limited admins.

  
  
• 
  

  Document which plugin/theme versions work together (changelog).

  
  
• 
  

  After every major WooCommerce update – a full order test.

  
  

What not to do:

• 
  

  ❌ Do not run major updates directly on the “live” site in front of visitors.

  
  
• 
  

  ❌ Do not keep inactive plugins for months. Delete them.

  
  
• 
  

  ❌ Do not skip licence renewals “to save money” – security patches are worth paying for.

  
  

• 
  

  Licence = updates + security fixes + support.

  
  
• 
  

  When the licence expires, you are left on an old version. Over time, it becomes the weakest link in the whole site.

  
  
• 
  

  Typically: a licence once a year or every month. Plan it in the budget like car insurance.

  
  

WordPress and WooCommerce maintenance is not an extra – it is a must.
Just like a car: fill up with fuel, change the oil, check the tyres – and drive safely.
For a website, that means: regular updates, backups, licences, security.
The result – a more stable, more secure and faster site.

If you do not want to do it yourself, let us know, and we will update your site for you every month!

Related: Website maintenance · WordPress maintenance, or website maintenance · WordPress and WooCommerce site maintenance.