Website maintenance should preserve availability, protect access and keep essential customer journeys working. It needs defined responsibilities across the host, application and external providers. An update log or backup notification is useful evidence, but each must be connected to practical checks and a recovery procedure.

This guide covers access management, update checks, recovery coverage and maintenance responsibilities. Discuss the relevant requirements through ITZ’s Website Maintenance service.

Access and dependencies

Review administrator accounts and remove access that is no longer required. Maintain an inventory of the platform, extensions and external services so that update and support responsibilities are clear.

List administrator accounts, hosting access, CMS extensions and external integrations. Remove access no longer required through an approved process and use separate accounts where supported. WordPress's hardening guidance emphasises reducing risk across the environment and application. Installing a security extension does not transfer every responsibility to the host or eliminate the need to manage access.

Controlled maintenance

Assess applicable updates and verify relevant functions after changes. Use backups and a suitable recovery approach before significant modifications. Avoid leaving critical maintenance dependent on an undocumented individual account.

Plan changes according to their urgency and effect on the site. Know which components are being updated, have a suitable recovery route and test representative functions afterwards. A layout may remain intact while a form integration fails. Record outcomes and unresolved issues rather than marking every update complete when the installation command finishes.

Request a Website Maintenance Review to discuss access management, update checks, recovery coverage and maintenance responsibilities.

Backup and recovery

Confirm what is protected, where copies are stored and who can restore them. A backup record is more useful when supported by representative restore checks and documented recovery steps.

Confirm backup coverage, storage location and access to restoration. WordPress's backup guidance distinguishes the database from site files; protecting only one may leave an incomplete recovery set. Test a representative restore in a suitable isolated environment and document the result. Recovery also depends on external services, credentials and the state you need to return to.

Suspected compromise

Preserve available evidence and coordinate containment with the authorised administrator. Investigation and recovery should identify the systems reviewed, actions completed and any remaining uncertainty or corrective work.

If compromise is suspected, coordinate with the authorised incident owner and preserve available evidence before making broad changes. Containment, investigation and recovery are related but distinct tasks. Simply restoring an old copy may reintroduce a vulnerable component or lose new legitimate data. Explain the reviewed scope and remaining uncertainty rather than promising that one scan establishes complete safety.

A practical example

Illustrative example: a booking site updates its CMS successfully, but the payment callback stops working. A representative post-change booking test can expose that dependency. A documented rollback and recovery decision should consider any orders created since the change, rather than overwriting production data without assessment.

Your review checklist

  • Inventory access, components and third-party responsibilities.
  • Check critical functions after controlled changes.
  • Verify backup coverage and a representative restoration route.
  • Define incident ownership and evidence-preserving escalation.

Frequently asked questions

Does routine maintenance eliminate all security risk?

No. It addresses defined operational responsibilities and identified weaknesses. Risk also depends on configuration, access practices, external services and the application itself.

References and further reading

Related services and guides

Discuss the next step

Request a Website Maintenance Review. Use the form below to discuss access management, update checks, recovery coverage and maintenance responsibilities. Share the relevant goals and existing arrangements; do not include passwords, private records or access tokens.

Request a Website Maintenance Review ↗

Reviewed and expanded on 15 October 2026. Examples are illustrative; the appropriate approach depends on your business requirements and existing systems.