What Should Actually Be in a WordPress Maintenance Retainer

"WordPress maintenance" is one of the vaguest line items an agency or business ever pays for - often a flat monthly fee for a bundle of tasks nobody's ever clearly defined, which means it's also one of the easiest things to overpay for without realizing it. Here's what should actually be in a maintenance retainer, and where agencies commonly get less than they're paying for.

The baseline that should never be optional

• Core, theme, and plugin updates - tested on staging before production, not applied blind. Blind auto-updates are how a "maintenance" plan causes an outage instead of preventing one.
• Regular backups with a tested restore process - a backup nobody's ever restored from is a false sense of security, not an actual safety net.
• Uptime monitoring with real alerting - not a dashboard nobody checks, but something that actually notifies a human when a site goes down.
• Malware/security scanning on a schedule, not just "if something looks wrong."

What separates a real retainer from a bare-minimum one

• Database cleanup and optimization - expired transients, spam comments, orphaned post meta, and post revisions all accumulate and slow down every query over time if nobody's cleaning them out. Capping revisions alone is a one-line fix most retainers skip:

  /**
   * Cap post revisions to 3 instead of storing every autosave forever.
   */
  function rajangupta_limit_post_revisions( int $num, WP_Post $post ): int {
      return 3;
  }
  add_filter( 'wp_revisions_to_keep', 'rajangupta_limit_post_revisions', 10, 2 );
  

• Performance monitoring, not just uptime - a site can be "up" and still have degraded to a 45 PageSpeed score after six months of plugin updates and new content, silently costing leads the whole time.
• A defined allotment of small fixes/changes included monthly - a broken layout after a plugin update, a small copy change, a new team member added to a bio grid - rather than every tiny request going through a separate invoice.
• Actual response time commitments, in writing - "we'll get to it eventually" is not a maintenance plan, it's a mailing list.

Where agencies commonly overpay

The pattern to watch for: a maintenance retainer that's really just "we'll click update on plugins once a month" priced as if it includes proactive performance work, security hardening, and real support responsiveness. If a retainer's actual monthly deliverable fits in an email that says "updated plugins, nothing broke," that's not worth agency-tier pricing - that's a task, not a service.

What should be in the reporting, if you're paying for one

A maintenance retainer worth paying for should produce something concrete each month - not just "everything's fine," but a short report covering what was updated, the current PageSpeed/Core Web Vitals status, any security events flagged, and what (if anything) needs a bigger conversation. If a retainer produces nothing you could show a client or a boss, it's hard to know what you're actually getting for the money.

What I include in a retainer

Core/theme/plugin updates tested on staging, database cleanup on a weekly schedule, malware scanning, performance monitoring against the 90+ PageSpeed baseline every build starts with, and a defined block of monthly hours for small fixes and requests - billed as one predictable monthly number, not a surprise invoice for every five-minute change.

Related reading

• How to vet a white-label WordPress partner
• API integrations for WordPress: connecting to a CRM without breaking it

If you're currently paying for "maintenance" and aren't sure what you're actually getting, send me what's in your current plan and I'll give you an honest read on whether it's worth what you're paying - even if the answer is that your current setup is fine.