We’ve been updating our monthly and weekly update processes to track new realities now that AI-driven hacking is the unfortunate norm. It’s a lot to keep track of, and our clients appreciate not having to do this work themselves. Here’s a peek behind our curtain at what makes a WordPress maintenance plan successful.
A website starts aging the day it launches. The plugins underneath it keep getting updates, and some of those updates close holes that attackers already know about.
Two events in early October show how little time there is to react. On October 7 at 21:47 UTC, Patchstack saw the first attacks on a flaw in Bricksforge, an add-on for the Bricks page builder. The public advisory went out the next day with a fix in version 3.1.8.10. The day before that, WordPress core shipped 7.1.3, its third security release in three weeks, with seven fixes.
Events like these rarely reach the news a business owner reads. Handling them takes someone with a standing process and the access to act on it. This post lays out what a WordPress maintenance plan has to cover, so you can judge whether the one you have, or the one bundled with your hosting, does.
A WordPress maintenance plan starts with an inventory
You cannot maintain what you have not listed. Every plugin and theme on the site goes on a list with four facts beside it: who made it, what it does for the business, when its author last published an update, and whether the author still maintains it at all.
The last column matters most. A plugin whose author stopped publishing two years ago will never get a patch, however severe the next flaw turns out to be. The inventory also surfaces plugins nobody remembers installing, which are the easiest ones to remove.
Webidextrous builds this list during onboarding and keeps an exclusion list beside it, so a plugin that should never auto-update is marked before the first cycle runs.
Update on a schedule that matches the threat
A monthly update window is a sensible default for most changes. Core releases, feature updates, and theme versions can wait for a tested cycle, and bundling them means one backup and one set of update notes.
Security flaws run on a different clock. Bricksforge went from first observed attack to public advisory in under a day, and The Hacker News counted 63 source addresses sending automated exploit attempts within the first days. A monthly window leaves a site open for up to thirty days against that.
A tiered WordPress maintenance plan handles both. Routine updates go in the monthly cycle, tested on a copy of the site first. A disclosed vulnerability in an installed plugin gets handled the day it is published, either by updating out of cycle or by blocking the exploit at the firewall until the update has been tested.
That second path is what virtual patching does. The Webidextrous Business Protection add-on includes it through Patchstack, with rules typically applied within hours of a disclosure, so the site is covered until the update has had its tested slot.
The steps that updating alone skips
Pressing the update button closes the hole. Four other steps decide whether the site is clean afterward.
Review who has an account. Several of the WordPress 7.1.3 fixes concerned what Contributor and Author accounts could reach, and Patchstack’s advice was to audit every account at Contributor level or above. Former staff and old agency logins are the usual finds.
Clear the caches. The 7.1.3 fix for a malicious Imgur embed did not remove embed data already cached in the database, so a poisoned page could keep rendering after the update until the cache was flushed.
Read the logs. For Bricksforge, Patchstack published the exact request paths attackers used, so a log search shows whether a site was probed before it was patched.
Look at the file system. Patching stops new attacks and does nothing about a web shell that landed earlier. The guidance for Bricksforge was to check the plugin’s temporary upload folder for PHP files that should not be there.
Webidextrous’s update notes record each cycle’s changes and skips, and a login check follows every update, so the owner has a written record to read.
A staging copy and a backup you have tested
An update that breaks the checkout page costs more than the flaw it fixed, so updates get applied to a copy of the site first. Every site Webidextrous hosts on Pantheon comes with Dev, Test, and Live environments, and the monthly cycle runs there before anything touches the public site.
A backup only counts once it has been restored somewhere. Ask whoever runs your site when the last restore test happened and how long it took. Pantheon takes automated daily backups of code, database, and files, and Webidextrous takes a further backup before any change it makes, so a bad update has a known restore point from minutes before it ran.
Reading a WordPress maintenance plan contract
Most hosting bundles cover the server itself, meaning uptime and the software under WordPress. Few of them cover the application sitting on top, and that is where both October events happened. When you read a maintenance offer, look for these items by name:
- A plugin and theme inventory with an exclusion list
- A stated update cadence, updates tested on a copy before going live, and written notes after each cycle
- Virtual patching or an out-of-cycle process for disclosed vulnerabilities
- A backup before every change, plus a restore that has been tested
- Uptime monitoring with a stated response time
The Webidextrous WordPress Care plan is built around that list. The base plan at $149 per site per month covers monthly tested updates, a backup before any change, firewall and malware scanning, uptime checks every 60 seconds, and update notes after each cycle, with outages acknowledged after 15 minutes of confirmed downtime. Business Protection adds Patchstack virtual patching, scheduled form testing, a contact-form spam filter, and a health and security review for $100 more per month. Plans run month to month with no setup fee.
If someone already looks after your site, hand them the list above and ask which items their WordPress maintenance plan covers. If the answer has gaps, the Health & Security Review ($149, credited to the first month if you start Care within 30 days) is a fixed-price way to find out what the site is carrying before you decide anything further.
Sources
- Patchstack: Bricksforge arbitrary file upload advisory, Oct 8, 2026
- The Hacker News: Attackers exploit CVSS 10.0 Bricksforge flaw, Oct 12, 2026
- Patchstack: WordPress 7.1.3 security release, Oct 6, 2026
- WordPress Developer Blog: What’s new for developers, Oct 14, 2026
- Webidextrous WordPress Care and Pantheon hosting pages, opened Oct 19, 2026
