What Maintenance Actually Includes
"Maintenance" gets used for everything from a monthly plugin update to full site management. For a site that takes donations or signs people up for events, the work breaks down into six jobs:
- Updates. WordPress core, themes and plugins release security fixes regularly, and running old versions is a common way sites get compromised. Updates should be tested before they reach the live site, because an update can break a form or a page layout.
- Backups you have actually restored. A backup that has never been restored is a hope, not a backup. It should be stored off the server that hosts the site.
- Security monitoring. Malware scanning, login protection, and a plan for what happens when something is found.
- Uptime monitoring. Someone, or something, should notice when the site is down before a donor does.
- Form and integration checks. After updates, submit a test donation flow (using the processor's test mode) and a contact form, and confirm the confirmation emails arrive.
- Account and renewal hygiene. Remove admin access for people who have left, and track domain, SSL and hosting renewal dates.
Where Nonprofit Sites Tend to Go Wrong
These are common failure patterns, described in general terms rather than as client stories.
The site was built by a volunteer, and the volunteer moved on. The login lives in someone's personal email. The hosting account is on a personal credit card. Nobody knows which plugins are essential. This is not a criticism of volunteers; it is a single point of failure. The fix is to document ownership: put the domain registrar, hosting and admin accounts under organizational email addresses, and keep a short written inventory of plugins and what each one does.
Updates are skipped because no one wants to break the site. That is a reasonable fear, and it is the argument for testing updates on a copy first rather than not updating. Skipped updates trade a visible, fixable risk for an invisible one. The WordPress.org guide to updating WordPress covers the basics.
Donation tools are treated as someone else's problem. If you use an embedded or hosted donation tool, the processor handles card data, but the WordPress page that embeds it still needs to load, and the plugin that connects them still needs to stay compatible. If you accept payments directly on your own site, ask your payment processor what compliance requirements apply to your setup. We do not give compliance advice here, and requirements depend on how payments are collected. The PCI Security Standards Council is the general reference.
Nobody watches the site during a campaign. Giving Tuesday falls on December 1 this year, the Tuesday after Thanksgiving. A good rule is to freeze non-essential changes in the days before a major campaign, confirm backups are current, and have a named person to call if something fails. If something does break, emergency WordPress support is available regardless of host.
Questions to Ask Anyone Who Offers to Maintain Your Site
- Are updates tested before they go live, or applied directly to the live site?
- Where are backups stored, and when was the last restore test?
- What is monitored, and who gets alerted?
- What happens if the site goes down at 9 p.m. on a Sunday? Is that covered, and at what response time?
- Who owns the hosting account, domain, and admin accounts? Can I take them with me if I leave?
- Is there a contract, and what does leaving cost?
- What does the monthly price include, and what costs extra?
The answer to the last question matters more than the headline price. Hourly billing can mean a surprise invoice in the same month you needed the help.
A Simple Self-Audit You Can Do This Week
Log into WordPress and open Dashboard → Updates. Count the pending updates. Open Users and look for people who should no longer have access. Check when the domain and hosting renew. Find your most recent backup and confirm where it is stored. Submit your own contact form and confirm you receive it. Fifteen minutes of this tells you more than a vendor's sales page will.
Preventing Problems Rather Than Reacting
The pattern behind most preventable outages is the same: changes made without testing, and nobody watching afterward. Our article on why WordPress updates need a process, not just a click explains what a safer update routine looks like, and who is actually accountable for your WordPress site covers the ownership question in more depth. If you would rather hand the whole job to one team, see managed WordPress. Municipal and public-sector organizations can start with our municipalities page.
