Short answer: if you pay someone every month to look after your WordPress site and you couldn't say what they did last month, it's worth ten minutes to check. You don't need to be technical. You need your login, a cup of tea, and the eight checks below. By the end you'll know whether your site is being cared for, coasted, or quietly left to rot.
Plenty of WordPress sites run for years on a monthly fee nobody questions. The site loads, the invoice arrives, everyone moves on. Then one day there's a warning in Google, a contact form that's been broken since spring, or a plugin that let someone in. The problem is rarely that nobody was paid to prevent it. It's that nobody checked the work.
This guide is the same quick health check we run before taking on any WordPress site. Each check tells you how to look, and what good looks like. At the end there's a simple scorecard, a list of what a care plan should actually include, and how to switch provider without the site going down.
A care plan you can't see working is just a direct debit.
Why this matters more in 2026
WordPress itself is solid. The risk sits in the plugins and themes bolted onto it, and the numbers from the past year are not comforting. Patchstack's State of WordPress Security in 2026 report found:
- 11,334new vulnerabilities found across the WordPress ecosystem in 2025
- 91%of them were in plugins. WordPress core had just six.
- 46%had no fix available when they were made public
- 5 hoursweighted median time to first exploit for the most heavily targeted vulnerabilities
Source: Patchstack, State of WordPress Security in 2026.
Read that last one again. When a popular plugin has a hole, attackers are often trying it within hours, not weeks. A site that gets updated "every couple of months" is a site that spends most of the year exposed. And PHP, the language WordPress runs on, has its own clock: PHP 8.1 stopped getting security fixes at the end of 2025, and plenty of small business sites are still running on it, or older.
None of this means WordPress is a bad choice. It means a WordPress site needs someone actually doing the looking after. Here's how to tell if that's happening.
Grab your loginThe 10-minute check
You'll need an administrator login for your site (it usually lives at yourdomain.co.uk/wp-admin). If you don't have one, that is the first finding, and it's a big one. Your provider should give you admin access to your own website without a fight. If they won't, read our guide to getting your website back before anything else.
1. Pending updates (1 minute)
How to check: In the WordPress dashboard, go to Dashboard → Updates. You'll see whether WordPress, your plugins and your themes have updates waiting.
What good looks like: nothing waiting, or a handful released in the last few days. Red flag: a long list, updates marked as security releases, or a WordPress version several releases behind. If ten plugins are waiting and some updates are months old, nobody's been doing the updates, whatever the invoice says.
2. Site Health (1 minute)
How to check: Go to Tools → Site Health. It's built into WordPress and gives an overall status plus a list of critical issues and recommendations. Click the Info tab, open Server, and note the PHP version.
What good looks like: status "Good", no critical issues, PHP 8.2 or newer. Red flag: critical issues nobody has fixed, or PHP 8.1 or older. Old PHP isn't just a security problem. Newer plugin versions stop supporting it, which is often why updates "can't be done" on neglected sites.
3. The plugin list (2 minutes)
How to check: Go to Plugins. Count how many there are, and how many say "Activate" (meaning they're installed but switched off). Look for any notice saying a plugin has been closed or hasn't been tested with your version of WordPress.
What good looks like: every plugin is active and has an obvious job. For a typical small business brochure site that's often 10 to 20. Red flag: inactive plugins left lying around (they can still be attacked, so they should be deleted, not just switched off), two plugins doing the same job, or anything flagged as closed or abandoned.
4. Users (1 minute)
How to check: Go to Users and filter by Administrator.
What good looks like: you, your current provider, and nobody you don't recognise. Red flag: a username of "admin", accounts belonging to a designer or employee who left years ago, or administrator accounts you can't explain. An unexplained admin is worth treating as a possible break-in until proven otherwise.
5. Backups (2 minutes, one email)
How to check: This one's a question for your provider. Ask three things: When was the last backup? Where is it stored? When did you last test restoring one?
What good looks like: daily backups, stored somewhere other than the same server as the site, kept for at least 30 days, and a restore tested in the last few months. Red flag: "the host does that", vague answers, or backups that live on the same server. If the server goes, so do they. A backup nobody has ever restored is a hope, not a backup.
6. Google's view (1 minute)
How to check: Search Google for site:yourdomain.co.uk and scroll through the results. If you have Google Search Console, open Security & Manual Actions → Security issues.
What good looks like: only your own pages, and no security issues listed. Red flag: pages you didn't create, especially ones in another language, about pharmaceuticals, or full of odd product names. That's a classic sign of a hacked WordPress site, and it's surprisingly common for the owner to be the last to know.
7. The padlock and the forms (1 minute)
How to check: Load your site on your phone. Is there a padlock, with no "Not secure" warning? Then fill in your own contact form and check the enquiry actually arrives.
What good looks like: padlock, and the test enquiry lands in your inbox within a minute. Red flag: a broken form. It's the single most expensive fault a small business site can have, because it fails silently. You don't get an error. You just stop getting enquiries.
8. Speed (1 minute)
How to check: Put your homepage into PageSpeed Insights and look at the mobile result.
What good looks like: the Core Web Vitals assessment passes, or is close. Red flag: a failing mobile score on a simple brochure site. That usually points to oversized images, too many plugins, or no caching, all of which a maintained site should have sorted. There's more on why it matters in our page speed piece.
Ask your provider for last month's report. A decent care plan sends one: what was updated, what was backed up, any issues found and fixed. If there's no report, there's no evidence the work happened.
Scoring your site
Give each of the eight checks a green, amber or red.
| Result | What it means | What to do |
|---|---|---|
| All green, or one amber | Your site is being looked after properly. | Nothing. Keep paying, and keep asking for the monthly report. |
| Two or three ambers | The basics are happening, but someone's coasting. | Send your provider this list and ask for a date by which each item will be fixed. |
| Any red on updates, users, backups or Google | Your site is exposed now, whatever you're paying. | Take your own backup today, change every admin password, then get it properly checked. |
| No admin access at all | You don't control your own website. | Sort access before anything else. It matters more than any of the other checks. |
What a care plan should include (and what's padding)
Prices vary, and we've broken those down in what a WordPress website really costs. What matters more than the price is what's actually being done. A proper care plan for a small business WordPress site covers:
- Updates at least weekly, with security fixes applied as soon as they're out, and the site checked afterwards.
- Daily off-site backups, kept for 30 days or more, with restores tested.
- Uptime monitoring, so someone knows when the site goes down before your customers tell you.
- Security monitoring for malware and suspicious changes, and a clear answer on who cleans up if something gets through.
- PHP and hosting kept current, not left on a version that stopped getting fixes.
- A monthly report in plain English.
- A small amount of change time, so you can get opening hours, prices or a new photo updated without a separate quote.
And here's what often fills out a plan without doing much for you:
- "SEO monitoring"
- "Unlimited support"
- "Premium security suite"
- "Performance optimisation"
- An automated email you never open
- Unlimited emails, with fixes quoted separately
- A free plugin, installed once
- A caching plugin switched on in year one
None of those are always padding. Just ask what each one means in practice, and what you'd see in the report.
A common questionShould updates just run automatically?
WordPress has supported automatic updates for plugins and themes since version 5.5, and minor core updates install themselves by default. So why pay anyone?
Because automatic updates solve half the problem. They get the fix installed quickly, which matters given how fast vulnerabilities get exploited. What they don't do is check the site still works afterwards. Occasionally an update clashes with another plugin or your theme, and the first you hear of it is a customer saying the contact form is broken.
The sensible middle ground, and what we do: security and minor updates go on quickly, larger updates are tested first, and after every round of updates someone actually looks at the site and submits the forms. If you look after your own site, switching auto-updates on is far better than forgetting to update at all. Just check the site weekly.
Changing handsHow to switch provider without drama
If the check went badly, moving to someone else is less painful than people expect. The order matters:
- Get your access before you give notice. Admin login to WordPress, login to the hosting, and access to wherever your domain is registered. Check each one works.
- Take your own backup. A full copy of the files and database, saved somewhere you control. Most hosts can do this from their control panel, or a backup plugin can.
- Check who pays for what. If your hosting or domain is paid through your current provider, you'll need to move them, and the domain is the one to get right. Don't let anything lapse during the move.
- Give notice in writing, in line with your contract, and ask for anything they hold that you'll need: licence keys for premium plugins, backup copies, notes on anything custom.
- Have the new provider run a health check before they take over, so you both know what state the site is in on day one.
- Change every password once handover is done, and remove the old provider's admin account.
Done in that order, your site doesn't go offline at any point, and nobody can hold it hostage.
Our takeWhat we'd do
If you ran the check and everything came up green, brilliant. Your provider is doing their job. Tell them, because good maintenance is invisible and rarely gets thanked.
If it didn't, you've got three honest options. Ask your current provider to fix the list. Move to someone who'll do it properly. Or, if the site is old, slow and held together by plugins, ask whether it's worth maintaining at all. Sometimes the cheapest fix is a cleaner rebuild, and sometimes it's a weekend of updates. It depends on the site, and anyone who gives you the same answer for every site isn't looking.
We look after WordPress sites too. Our WordPress care plans start at £95 a month with hosting included, every one starts with a health check, and you get a plain-English report every month. If you'd rather just have someone run this check for you, book a free 15-minute call and we'll tell you what we'd do, including if the answer is "leave it as it is".
Keep reading: Pay monthly or pay upfront? The honest maths · Domain, hosting and email, explained in plain English · Hacked WordPress site repair · Why is my WordPress site so slow? · Website security: the short list that matters · Free WordPress site checker
