Launch is not maintenance — stop calling the build “lifetime support”
A build SOW ends. Lifetime WhatsApp is not a patch policy. If the vendor cannot describe update cadence, you bought a screenshot.
Write the care window in the same week you write the sitemap. Otherwise the designer is gone when wp-admin shows red notices.
What “included support” usually means in India
Two weeks of “change the phone number.” It does not mean plugin compatibility in month seven. Get the weeks in writing.
Core, plugins, themes, and PHP — the update stack people skip
WordPress core is the easy click. Plugin and theme updates break layouts when the original builder used a page-builder soup. PHP on the host quietly goes EOL while the site “still loads.”
Update on staging or with a restore point. Update All on production Friday evening is how Monday starts with a white screen of death.
Count plugins like you count EMI
Every plugin is a vendor. Unused sliders, three form plugins, and a pirated “mega pack” are debt. Delete before you patch.
Backups that have never been restored are souvenirs
Host “daily backups” that cannot be restored by you are a story. You need a copy off the same VPS, a known retention, and one successful restore drill.
Malware cleanup without a clean backup is archaeology. The cheapest restore is the one you practised before the incident.
Where backups should not live
Only on the same disk as the hacked install. Only in the freelancer’s personal Drive. Only in a plugin that expired.
Security after cheap themes: logins, XML-RPC, and nulled code
Unique admin users, 2FA where practical, no admin/admin, and no leftover demo content users. Limit login brute force. Turn off what you do not use.
Nulled themes include extra “features.” Those features are often backdoors. Licence cost is smaller than incident cost during a sale week.
Security plugins are not a personality
One well-configured limiter plus updates beats five overlapping firewall plugins that slow TTFB on mobile.
Uptime, SSL, and the email that silently stops
Contact forms die when the host blocks PHP mail and nobody set SMTP. SSL auto-renew fails when the domain moved and DNS is a mess. Uptime is a chain.
Transactional mail (enquiries, WooCommerce) needs a named provider. “It worked at launch” is not a mail architecture.
Who gets the downtime SMS
Not only the agency. A founder or ops number should know the site is down before Instagram comments know.
Editor training is maintenance — the receptionist will publish
If a clinic manager pastes from Word with 40 spans, the mobile layout dies. Show three tasks: change hours, add a service paragraph, upload a compressed image.
Lock the layout in patterns/blocks so “edit” does not mean “accidentally delete the header.” That training belongs in handover, then a yearly refresh.
Hosting quality versus plugin pile — which one is the real host
A ₹199 “unlimited” plan with noisy neighbours will make a clean theme feel slow. A good host with 40 plugins will also feel slow. Fix both; start with unused plugins.
Managed WordPress or a known Indian/cloud host with PHP control is part of the WordPress product, not an afterthought coupon.
Caching is not a substitute for image diet
Hero PNGs at 6 MB defeat any cache plugin on Jio 4G. Maintenance includes media hygiene, not only server toggles.
Festival weeks: when neglect becomes a business outage
Diwali, Pongal, IPL, exam-result days — traffic and attackers both rise. Unpatched WordPress with ads live is a paid invitation to fail.
Freeze risky updates in the campaign window; patch in the week before. Coordinate with whoever runs ads so you are not deploying PHP during a sale.
A pre-festival checklist that is actually short
Backup restore dry-run, plugin audit, SSL date, form test to a real inbox, and mobile load on a mid-range Android. One afternoon.
What an honest monthly WordPress plan should say in the SOW
Hours or a named task list: updates, backup check, uptime, small copy edits. Exclusions: new landing page designs, SEO articles, WooCommerce catalogue rebuilds. Those are projects.
Brevia’s Dynamic + SEO SKU is ₹50,000 + ₹15,000/mo when search work is in scope. Care-only can be lighter. Do not blur them to win a pitch. Hub: Website Development.
Takeover audits before we say yes
We may refuse a swamp of page builders and malware until a rebuild is scoped. That refusal is cheaper than pretending a retainer can unrot a theme.
When leaving WordPress is the maintenance strategy
No editor, no care budget, five pages that never change — a static site from ₹18,000 can be the adult choice. Product UX and strict performance may belong on Next.js.
Leaving is a rebuild, not an export miracle. Plan redirects. Read redesign vs rebuild.
Do not migrate to escape a mess you will recreate
Wix will also rot if nobody owns content. Next.js will rot if nobody owns Git. Pick the maintenance personality you will actually fund.
Ready to automate one painful workflow?
Tell us your stack — n8n, Make, Zapier, WhatsApp, or Playwright. Chennai HQ · India delivery · reply within one business day.