WordPress care plans are sold as a calendar. Updates on Tuesday, a backup icon, a report PDF. The failures that actually cost money don’t sit on that calendar.
A form can be dead for 12 days. A PHP ceiling can be larger than the machine. A backup file can be public.
This page is the list a maintenance package should be willing to name, line by line, before anyone talks about a retainer.
Tianwen Network was founded in 2017 and maintains 30 to 40 export WordPress sites. Liu Yu is the technical lead. The lines below are the failure shapes from that work.
They are not a claim that your site has each bug today. There is no package price on this page. Scope decides the quote.
Line: updates, with a log, not a reflex
A routine update can replace the site with a blank page. The useful response is a status code and a fatal that names a file, before anyone rolls the whole site back. Which plugin, which PHP error, which URL.
The longer diagnosis is how a white screen gets diagnosed before it gets patched. A care plan that “always restores last night’s backup” will also restore last night’s content loss, and sometimes last night’s bug.
Ask whether updates are tried on a copy that uses the same memory_limit as production. A staging site with a huge ceiling hides the exhaustion you are about to ship. Ask who is allowed to postpone an update, and what they write down when they do. Silence plus a green dashboard is not a decision.
Line: memory_limit against the RAM you are paying for
One recorded case is a 1-core, 1 GB machine with three WordPress sites. It stayed unstable. The cause was not “too many sites”.
PHP memory_limit was 1024M, the whole box before the operating system and MySQL. A single PHP process used 80 to 124 MB. The stable change was 256M, and workers cut from 6 to 4.
Six times 124 MB is 744 MB, before the database.
WordPress website maintenance packages that never read the live ini value will not catch this. Put the check on the list. Installed RAM, memory_limit, worker cap, and the product of workers times a measured process.
If the product is larger than the box, the plan is oversubscribed on paper even when noon looks quiet. Restarting PHP is not the check. The check is the arithmetic.
Line: disk, tables, and what the backup is copying
On a multi-site server the disk moved from 91 percent full to 37 percent full. The space did not come back from deleting a website. A filter plugin had written cache into the database.
One row was 30 MB. Enough rows of that size and the disk alert is a table problem wearing a hardware costume.
WordPress website management services that answer every disk alert with a bigger volume are selling storage for a scratch pad. The line item should say someone lists the largest tables, and says whether a cache may live in MySQL. Backups that snapshot those rows every night grow.
Restore time grows. The catalogue did not. Ask for the size of the last backup and the date of the last restore.
A backup that has never been restored is a file with a hopeful name.
Line: a form that a stranger can finish
One form was silently broken for 12 days. Two hundred and seven paid clicks landed on it. The root cause was a reCAPTCHA site key registered on another domain.
The page looked done. The button did not deliver. That class of fault is written up as an invalid domain for the site key.
If the site uses a challenge widget, the key’s domain list is part of the monthly check. A redesign, a domain change, or a staging copy promoted to production can break it without touching the layout.
The test is a real message to an outside inbox, on the production domain, after any change that touches DNS or the form plugin. A thank-you screen is not the test. Plugin updates will not do this test for you.
Mail can fail on a different layer while the thank-you still shows. The map of that layer is WordPress not sending email. A care plan that never sends is a care plan that will miss both faults.
Line: the first image, and the cache header
A product template carried a 15 MB image in the first screen. Hundreds of product URLs then failed Core Web Vitals. The server was not the broken part.
Google’s targets, stated on web.dev, are an LCP within 2.5 seconds, an INP of 200 milliseconds or less, and a CLS of 0.1 or less. A maintenance package that only updates plugins will watch those URLs fail every month and call the site healthy.
Cache is the partner line. On waimaodulizhan.com the homepage time to first byte went from 2.14 seconds to 0.067 seconds. The machine stayed.
The change was an nginx fastcgi_cache block another site on the box already had. The figure is one homepage. A care plan should know whether a cached HTML response carries a header someone can name.
If nobody can name it, there is no page cache. There is a hope.
Line: files the public should not be able to download
In a theme directory on one site, 36 files ending in .backup were reachable from the public web. They were copies, not secrets in the thriller sense, and they were still a publishing error. A care plan creates these files whenever someone edits live and saves a spare.
The line item is a sweep. Backup suffixes, SQL dumps, and old exports do not live under the document root. Find them.
Move them. Don’t wait for a redesign to feel ashamed of them.
The same sweep covers a plugin that logged too much. A debug log full of enquiry text is a file you did not mean to publish. Turn the logging off when the fatal is understood.
A care plan that leaves WP_DEBUG_DISPLAY on has traded a white screen for a public error. That is not a fix. It is a different leak.
Certificates, PHP, and a restore you have actually done
A certificate expires on a date. The site then looks broken to anyone who isn’t you, often with a warning wall rather than your homepage. Whose calendar holds that date?
If the answer is “the host emails someone who left”, the care plan doesn’t have an owner. Write the name of the living person, and a second name. The same pair should know where the domain registrar login is.
A certificate you can renew and a domain you cannot log into is a renewal you will fail in public.
PHP versions age out. A care plan that updates plugins and never says which PHP the site runs will discover the gap when the host forces the bump and a plugin fatals. The white-screen line above is that day.
The preparatory line is quieter. Name the current PHP version in the monthly note. Name the plugins that still declare they need the old one.
Move them, or replace them, before the host picks the weekend for you.
Once a quarter, restore a backup onto a spare database and open the homepage of that copy. Not every month. A quarter is enough to prove the dump is a site and not a partial file.
Record how long it took and what was missing. Media that didn’t come across, a domain hardcoded to production, a form that now points at the live inbox and will spam real customers if you submit it. The drill includes not submitting the form on the copy.
That sounds fussy until a test enquiry lands in a buyer’s thread.
Who answers when the note has a red line? A care plan without a person is a PDF. Ask for the name, the hours, and what “emergency” means in their words.
A down homepage is one definition. A form that stopped sending, while the homepage looks fine, is the one that matched the 207 clicks. If their emergency definition is only “site unreachable”, the form fault waits until the monthly PDF, which is how 12 days happen.
Does the monthly note name a person, or only a company? If it names only a company, ask who inside it read the memory_limit this month. A logo at the top of the PDF is not a reading.
The line we will not sell
Ranking guarantees don’t belong on a care invoice. Google writes that no one can guarantee a number 1 ranking, and says to beware of a guarantee, a claimed special relationship, or a priority submit. The page is Google’s note on hiring an SEO.
A maintenance package that bundles “we’ll keep you on page one” has changed the subject. Updates, forms, memory, disk, images, and public leftovers are the subject. Positions are not a monthly deliverable.
Search can still be in scope. It is a different contract, with its own done-condition. Mixing it into the care invoice is how a broken form gets billed as optimisation and nobody opens the inbox. Keep the invoices apart even if one company holds both.
What you should see in the monthly note
A useful note is short. Which updates ran, and which were held, with a reason. The live memory_limit and the worker cap, and whether they still fit RAM.
The largest table, if it moved. Whether a test enquiry arrived, and where. Any URL whose first image is still absurd, named, not averaged.
Any public backup file found and removed. Time to first byte on the homepage and on one product URL, from outside.
A note that says “all plugins updated, backup successful, site secure” can be true and still miss every line above. Security as a word is not a sweep for .backup files. Backup successful is not a restore.
Site secure is not a form test. Ask for the lines. If the vendor will not write them, the package is the PDF, not the work.
A WordPress monthly maintenance package is this note, not a tier name. Each line is a pass or a fail with a figure from the server: memory_limit against the RAM, the largest table, and whether a test enquiry arrived.
The same note names a first image that is still enormous, and any backup file the public could still download. A logo and the word secure do not fill those lines. A number from the box does.
WordPress monthly support is the person who reads a red line before the next month’s PDF. A package with no person is a document. Support with no lines is a chat that restarts PHP and calls the month done.
Write the lines into the agreement before the first invoice. Which updates may be postponed, and who signs that delay. Which inbox receives the test enquiry. What emergency means when the homepage still returns 200 and the form does not.
The 12-day silence happened under a definition that only counted an unreachable site. A form that looks finished is the case the package has to name, or the support hours never start. The monthly package does not include a new catalogue, a new theme, or a ranking.
Google says no one can guarantee a number 1 ranking, and this page already points at that note. Mixing page one into the package is how a dead form gets billed as optimisation. Keep the invoice on the lines. Ask who writes the note, by name, and which hours they answer.
A logo on the PDF is not WordPress monthly support. If the name is missing, you don’t have the package yet. You have a calendar reminder.
The ongoing version of this job, as a service rather than a checklist, is WordPress support and bug fixes. What a maintenance retainer covers on an export site, in service language, is WordPress maintenance for export sites. This page is the buying list you can hold next to either of them.
We still don’t print a price. Send the URL and which line you already know is failing. A quote comes back from the scope, not from a tier name.
WhatsApp is enough when the note is short. Message Tianwen Network on WhatsApp. Include the URL.
Leave the ranking line out. It isn’t a requirement we can take, and it isn’t one a care plan should pretend to meet.
Questions a care plan should answer
What should the monthly note include?
Which updates ran and which were held, the live memory_limit and worker cap, the largest table if it moved, whether a test enquiry arrived, any first image that is still enormous, and any public backup file you removed. A line that only says the backup succeeded can miss all of that.
What memory figures are we actually citing?
A 1-core, 1 GB machine running three WordPress sites was unstable with memory_limit at 1024M. One PHP process used 80 to 124 MB. The stable change was 256M, and workers cut from 6 to 4. Six workers at 124 MB are 744 MB before MySQL.
Does a care plan include a ranking guarantee?
It should not. Google says no one can guarantee a number 1 ranking. We will not put that sentence on an invoice. Search, if you buy it, is a separate scope.
Is a package price printed here?
No. Ask for a quote from the scope. The page lists the checks. It does not list a tier price.