A practical scope checklist for business websites and WooCommerce stores
Short answer
Hosting keeps the website’s server environment available; maintenance keeps WordPress, its extensions and the business-facing functions reviewed, updated and recoverable. A provider may offer both, but the contract should name who owns backups, restores, updates, monitoring, incident response and post-change checks.
You pay for hosting, the website opens, and everything looks covered—until an update breaks a form or a backup needs restoring. At that point, the useful question is who will investigate, recover the site and verify that customers can use it again. Agreeing that responsibility beforehand is easier than sorting it out during an interruption.
For example, a host may confirm that the server is working while a plugin conflict prevents an enquiry from reaching your inbox. That is an illustrative scope problem, not a claim that either provider has failed: the hosting environment and the WordPress application need different checks.
What WordPress hosting usually covers
Hosting supplies the server resources and services needed to deliver the website. Depending on the provider and plan, this may include storage, databases, network availability, server-level security, SSL support, email or DNS tools, automated backups and access to support. The exact combination varies, so the scope must be read rather than assumed.
Managed WordPress hosting may add WordPress-aware features such as staging, caching, update assistance or platform monitoring. That still does not automatically define who reviews a failed plugin update, verifies a restored checkout or edits a broken page. Those responsibilities belong in the service scope.
What ongoing WordPress maintenance covers
Maintenance is application-level work on the website itself. A practical plan can include WordPress core, plugin and theme updates; backup monitoring; security and uptime checks; review of errors; small content changes; and support when a website function stops working. The schedule and acceptance checks should match the risk of the site.
WordPress recommends keeping the software updated and backing up before an update so the site can be restored if something goes wrong. That makes an update process more than clicking an Update button: it should include a current backup, an appropriate test or staging route for higher-risk changes, and checks of important public functions afterwards.
Backups are not the same as a recovery plan
A dashboard that says backups are enabled is useful, but it does not by itself prove that the right files and database are included or that a usable restore can be completed. Confirm the backup frequency, retention, storage location, restore authority and the person responsible for testing recovery.
For a frequently changing WooCommerce store, the acceptable data-loss window may be much shorter than for a small brochure site. Orders, accounts, stock and payment-related events can change throughout the day. The plan should match the actual rate of change without promising that every external service or transaction can be reconstructed.
Updates need priorities and rollback rules
Not every change has the same risk. A minor core security update, a page-builder release, a WooCommerce update and a custom integration change may need different handling. Agree which changes can be applied routinely, which require staging, and which need a maintenance window or owner approval.
A post-update check should cover the functions that matter to the business: homepage and key service pages, contact forms, account login, search, multilingual switches and, for a store, cart, checkout, shipping and transactional emails. This is verification of the website’s condition, not a guarantee that every future incompatibility can be prevented.
Who should hold access
The business should know where the domain is registered, which hosting account contains the website, who controls DNS, and which WordPress users have administrative access. WordPress roles grant different capabilities; an Administrator can manage the full single-site installation, while an Editor has content-management permissions without the same plugin, theme and user controls.
Use individual accounts where the platform supports them rather than sharing one password among several people. Record the account owner and recovery route securely, and remove access that is no longer required. Do not place passwords, recovery codes or private client details in a maintenance worksheet or article.
Hosting and maintenance scope comparison
- Server availability, storage, database service and network infrastructure: normally hosting responsibility.
- WordPress core, plugin and theme update process: normally maintenance responsibility unless the hosting plan explicitly includes and verifies it.
- Backups: may be provided by hosting, maintenance or both; retention and restore responsibility must be explicit.
- SSL and DNS: often connected to hosting or domain management, but renewal and change authority must be named.
- Content edits, layout fixes and new features: usually separate maintenance or project work, not basic hosting.
- Performance diagnosis: can involve hosting, caching, themes, plugins, media and third-party scripts; ownership depends on the cause.
- Security response: hosting may protect infrastructure while the maintenance provider manages WordPress users, updates and application-level recovery.
Questions to ask before choosing a plan
- Who owns the domain, hosting account and primary WordPress Administrator account?
- What is monitored, how often, and what evidence is available?
- How frequently are backups made, how long are they retained, and who can restore them?
- Which updates are automatic, which are reviewed, and when is staging used?
- What checks are performed after updates or restores?
- Which support requests are included, and which changes become separate project work?
- What response path applies to downtime, security incidents or checkout failures?
- How are account access, handover and provider changes handled?
A clearer decision for a business owner
Choose the combination that gives your website a clear owner for infrastructure, WordPress care and recovery. If hosting and maintenance are supplied separately, document the boundary so an incident is not passed between providers. If they are bundled, confirm the same responsibilities rather than relying on the word managed.
Three practical next steps
- List your current hosting features, backups and WordPress support in one place.
- Ask each provider to confirm who handles updates, restore testing and faults in essential functions.
- Resolve any gap before renewal or the next significant website change.
Frequently asked questions
Does managed hosting replace WordPress maintenance?
Not automatically. Managed hosting may provide backups, caching, staging or update assistance, but the plan must state who reviews failed updates, tests restores and checks important public functions.
Who should own the domain and administrator access?
The business should know the registrar, hosting owner, DNS authority and primary WordPress Administrator. Use individual accounts where supported and document recovery ownership securely.
How often should a WordPress site be maintained?
The schedule should match how often the site changes and the risk of its functions. A WooCommerce store normally needs closer monitoring than a static brochure site, but exact intervals should be agreed rather than assumed.
Sources
- WordPress.org — WordPress site maintenance
- WordPress.org — Updating WordPress
- WordPress Developer Resources — Backups
- WordPress.org — Roles and capabilities
Need help clarifying what your website needs?
Explore our website care and hosting service, or tell us about your current setup. Share the type of website, your current support and the functions that matter most; we can discuss an appropriate scope without assuming you need to move everything.
