Web Hosting Maintenance: Keeping Your Site Secure

Sites do not get “hacked” as a weather event. They drift: old PHP on Bluehost, a plugin from 2022, a contractor still in Administrators, a Let’s Encrypt renewal that failed silently. WP Engine and Kinsta constrain some of this. Shared cPanel makes you the patcher. Either way, an hour a month beats a weekend with a malware scanner.

Schedule WordPress core and plugins. Do it on staging first when SiteGround, Cloudways, Kinsta, or WP Engine give you a clone. PHP version bumps go the same way. Nulled themes skip the calendar and skip the internet. Delete what you do not run. Enable auto-updates only for things you can tolerate breaking, or for minor cores on brochure sites. WooCommerce deserves a slower, tested cadence. Hosts will not click Update for your Elementor kit. A2 and DreamHost will give you the PHP selector; you still have to use it. Put the cadence in a calendar with a name on it. Mood-based patching is how Tuesday becomes an incident.

Production-only updates are a maintenance anti-pattern. Staging catches white screens, payment plugin fatals, and PHP 8 surprises. If your host does not include staging (cheap HostGator, some Bluehost plans), use a duplicator copy or move to a host that does. After updates, click login, a form, and checkout. Then promote. WP-CLI on SSH hosts makes the dance scriptable. Maintenance mode is for the rare hard cut, not for weekly plugin sport. The staging URL should not be indexed. Security maintenance is mostly change control. Without it you are gambling with the live database. Kinsta and WP Engine include the button because they were tired of the gamble.

Quarterly: list WordPress users, panel users, and SSH keys. Remove the intern. Rotate keys. Disable FTP. Confirm 2FA on Namecheap, Cloudflare, and the host. Old twenty-fourteen themes in wp-content are unused attack surface—delete them. xmlrpc if unused. Review cron. This is maintenance that scanners do not replace. InMotion and SiteGround accounts accumulate addon domains and forgotten subdomains; those get outdated WordPress too. Inventory URLs. If you cannot name every live site on the account, you cannot patch them. Access hygiene is hosting security with a checklist. Do it on a boring Wednesday.

Confirm Let’s Encrypt auto-renewed. Confirm Cloudflare is still Full (strict). Download or verify an off-site backup, not only the host snapshot on SiteGround or Cloudways. Restore to staging once a quarter. Check disk and inodes so backups still fit. Failed silent renewals are how browsers scare customers on a Monday. Failed silent backups are how you discover the policy during an incident. Put both on the same calendar as plugin day. Hosts advertise 99.9% uptime; expired certs look like downtime. Maintenance is the unglamorous half of reliability. The other half is not clicking random “security plugin” upsells instead of doing this list.

A monthly hour: updates on staging, user audit, cert and backup glance, PHP still supported, monitor still alerting. That hour is cheaper than Kinsta’s incident process, and you should still buy Kinsta if the site warrants it—maintenance does not disappear on managed WordPress, it shrinks. Shared hosts make the hour longer. Raw AWS makes it longer still. If you will not do the hour, pay WP Engine or an agency to own it. Pretending Cloudflare is a janitor is how web shells land. Security products help. Calendars finish the job. Write the hour in the same place you write payroll. The site is an employee. It needs a shift.

Patch on staging, audit access, verify Let’s Encrypt and off-site backups, keep PHP current. SiteGround, Cloudways, WP Engine, and Kinsta make pieces easier; they do not replace the calendar. Skip the hour and you will meet the scanner on a weekend.