Every WordPress maintenance provider says the same five words on their homepage. Updates, backups, security, monitoring, support. The pricing pages look interchangeable and the feature lists all have ticks next to them.
These questions cut through that. Ask them by email so you have the answers in writing, and pay attention to which ones get a vague reply.
Questions about the work itself
1. Are updates tested before they go live, and what happens if one breaks something? You are listening for a specific process, ideally including a rollback. "We update everything automatically" means updates go straight to your live site unattended, which is the single most common way maintained sites break.
2. How often are backups taken, where are they stored, and how long are they kept? Three separate numbers. Off-site storage matters, because a backup on the same server as your site does not survive the event most likely to destroy your site. Retention matters because malware often sits undetected for weeks.
3. Have the backups ever been restored? The best question on this list. An untested backup is an assumption. Ask how often restores are verified.
4. What exactly does "security" mean on my plan? Make them name components. Scanning is not the same as a firewall, which is not the same as hardening, which is not the same as two-factor authentication. And ask separately: if malware is found, is removal included or billed?
5. Does the plan cover one site or several? Some providers price per site, some sell bundles. Neither is wrong, but know which you are buying before you add a second site.
The question that matters most
6. If a plugin update breaks my checkout at 9am on a Tuesday, do you fix it or do you tell me about it?
This one sorts the market in half. A large amount of what is sold as maintenance is monitoring plus notification. Something breaks, you get an email, and you still own the problem.
It is also where hosting stops being relevant. A host's uptime SLA covers the server only, and application errors, plugin conflicts and theme code are excluded by name. Those are what actually take WordPress sites down. So "we have 99.99% uptime" from a host and "your site is broken" can both be true at once.
What you want is a care SLA: a written commitment that broken things get fixed, not just flagged.
The fix: ask for the exclusions list in writing. A provider who cannot tell you what is not covered has not thought carefully about what is.
Questions about how they work with you
7. What is your response time, as a number? "Fast" and "priority" are not commitments. Hours, in writing, per tier. And ask whether that means a human replying or an automated acknowledgement, because plenty of providers count the auto-reply.
8. Who actually does the work? A named person, a rotating queue, or a script with a dashboard behind it. All three exist at similar prices, and you should know which you bought.
9. What do I get every month? A plain report showing what was updated, that backups ran and what the scans found, is reasonable to expect. Being handed login details to a dashboard you are expected to interpret yourself is not the same as being told what happened.
10. What is explicitly not included? New pages, design changes, feature builds and integrations are development, not maintenance. Find out the rate and the process before you need them, not during.
Questions about control
11. Do I keep ownership of my domain, hosting and site? The answer must be yes without hesitation. You should hold the registrar account and the hosting account in your own name. If a provider needs to own those for the arrangement to work, walk.
12. What happens if I leave? Ask about notice periods, contract length, and what you walk away with. You should get your site, your backups and your access, without a fight or a fee.
The fix: log into your registrar today and check the account holder name. Not the technical contact, the owner. This is a ten-minute check that people put off for years.
How Up Speed answers them
Since we would want you to ask us these too, here are our answers in the same order, plainly.
Updates are tested before they go live and rolled back if one causes a problem. Backups are scheduled and off-site, around four times a month, with 30-day retention on Starter, one-click restore, and restores tested quarterly. Malware scanning and 24/7 uptime monitoring on 60-second checks are on every plan, with firewall, hardening and two-factor login on Professional. Plans are per site: one plan, one website.
If a plugin update breaks your checkout, we fix it. Our SLA is a care SLA, covering plugin and theme conflicts, malware, failed updates and performance regressions, backed by 99.9% uptime and a service credit if we breach it in a billing month. It has real exclusions: third-party outages outside our control, and new development work, which is billed separately at $120 an hour.
Response is a real human within 48 hours on Starter, 24 hours on Professional, and a 1-hour emergency SLA on Premium. There is no dashboard for you to log into. You get a plain-English monthly report. You keep your domain, your hosting and your site, there is no contract, and you can cancel anytime.
Up Speed is founder-led and new, so we would rather you judge us on the written commitments than on a logo wall. The way to start is a free site audit with no credit card, and if the findings are the sort of thing you would rather not handle yourself, the Starter plan covers the ongoing routine.