WordPress Maintenance: Auto-Updates and a Monthly Backup Are Not a Plan

Most Brisbane small business owners we meet believe their website is being looked after. Ask who does it, and the answer is usually the IT company or the hosting provider. Ask what they actually do, and it is nearly always the same two things: everything is set to auto-update, and a backup runs once a month.

That was a reasonable setup five years ago. In 2026 it leaves the front door of your business unattended, and the reasons have changed faster than most maintenance arrangements have.

What auto-update actually does, and what it does not

Auto-update applies whatever a plugin author publishes, the moment they publish it, with nobody watching. Most updates are fine. The ones that are not are the problem.

• A caching plugin update conflicts with your host’s own caching and the whole site goes down with a critical error.
• A page builder release changes how a template renders, and your homepage quietly loses its hero section on mobile.
• A plugin has been abandoned by its developer and will never receive another update, no matter what the toggle says. It just sits there, getting older and more exposed.

We have fixed all three of these on client sites this year. In every case the site had auto-updates switched on. In every case the owner found out from a customer, not from the system.

Auto-update is not maintenance. It is an unsupervised change to your website, several times a week.

A monthly backup protects you from less than you think

A backup is only useful if it exists when you need it, restores cleanly, and is recent enough to matter. A monthly schedule fails those tests more often than you would expect.

• Too old to be useful. If the site is compromised on the 3rd and you find out on the 28th, your only clean backup is nearly a month old. Every enquiry, blog post and price change since then is gone.
• Stored in the wrong place. Backups kept on the same server as the website disappear with the server. This year we saw a client site freeze completely because backup files had quietly filled the hosting account’s storage. The backups took the site down, and while it was frozen the site could not renew its security certificate either.
• Never tested. Almost nobody tries a restore until the day it has to work.

Proper backups run off the server, on a schedule that matches how often your site changes, and someone confirms they can actually be restored.

The threats have changed since that setup was chosen

1. Attacks are faster

Thousands of WordPress plugin vulnerabilities are disclosed every year, and attackers now use automated tools to exploit new ones within hours of them going public. The gap between “a patch is available” and “your site is compromised” is measured in hours, not weeks. A monthly check does not close that gap. Monitoring does.

2. AI now lives inside the dashboard

Page builders now ship AI assistants that can install plugins, edit templates and change settings with full administrator power. We wrote about one of them, Angie, after it took a client site offline. That is a new category of risk, and auto-update does nothing about it.

3. AI search reads your site directly

Google’s AI Overviews, ChatGPT and Perplexity now read your website to decide whether to mention you. A slow site, broken structured data, or a security plugin update that accidentally blocks AI crawlers can drop you out of those answers without anyone noticing. Keeping the technical foundations current is now part of maintenance, not a separate SEO project.

Why your IT department is the wrong place for this

This is not a criticism of IT. A good IT provider keeps your computers, email and network secure, and that is a full-time job. Your website is a different kind of asset. It is your marketing, your first impression and often your entire enquiry pipeline. It needs someone who looks at it the way a customer does.

Questions an IT ticket queue rarely asks:

• Is the contact form still sending? This is the most common silent failure we find. Forms break after updates and nobody knows until the enquiries stop.
• Did last week’s update change how the homepage looks on a phone?
• Has the site slowed down since the new plugin went in?
• Can Google and AI tools still read every page?
• Is anything in the plugin list abandoned, duplicated or no longer needed?

None of those show up on an uptime monitor. They show up when a person who knows the site checks it.

What proper WordPress maintenance looks like

• Monitored updates. Updates are applied by a person, checked afterwards, and rolled back if something breaks. Not left to a toggle.
• Uptime and security monitoring with host-level protection, so problems are caught in minutes rather than weeks.
• Off-server backups on a schedule that matches how often your content changes, with restores tested.
• Performance checks so the site stays fast for visitors and for the AI systems that now read it.
• A plugin review that removes anything abandoned or unnecessary, because every plugin is a door.
• A monthly report in plain English so you know what was done and what was found.
• A person you can email when something looks wrong, who already knows your site.

What it costs, and what it costs not to

A maintenance plan is a fixed monthly fee. A site outage, a hacked site cleaned up in a hurry, or a lost month of content and enquiries costs a great deal more, and it always arrives at the worst possible time.

Every WordPress site we build includes 30 days of maintenance after launch, and we recommend an ongoing plan for the same reason you service a car you rely on. Not because it is broken, but because you need it to keep working.

If your site is on auto-update and a monthly backup, and you are not sure who is actually checking it, that is worth a conversation. Our maintenance plans cover monitored updates, security monitoring, backups and content changes for a fixed monthly fee. Or start with the free website audit to see where your site stands today.

Examples are drawn from support cases resolved by Mino Design and Digital in 2026, with client details removed.