“Hosting” and “maintenance” get used interchangeably in conversations about WordPress sites. They are not the same thing. Hosting is where your site lives. Maintenance is what keeps it healthy while it lives there. The distinction matters because when something goes wrong after a site launches, the first question is usually who is responsible for fixing it. If hosting and maintenance are conflated, that question often has no clear answer.
This post explains what each covers, where the gap between them tends to appear, and what to look for in a provider that handles both.
What hosting actually is
Hosting is the infrastructure layer. It is the server your site’s files and database live on, the network that delivers those files to visitors, and the environment your site runs in.
A hosting provider is responsible for:
Server uptime and reliability. Whether the physical (or virtual) server is running and reachable. A reputable managed WordPress host targets 99.9% uptime, which translates to roughly eight hours of potential downtime per year.
Server speed and configuration. PHP version, memory limits, server-side caching, and CDN configuration all live at the hosting layer. These affect how fast your site loads before WordPress itself has done anything.
Infrastructure-level security. Firewalls that block malicious traffic before it reaches your site, DDoS mitigation, and SSL certificate provisioning are hosting responsibilities.
Server-level backups. Many hosts take automated snapshots of the server environment at regular intervals.
What hosting does not cover is the WordPress application itself. Your host ensures the building is standing and the electricity is on. What happens inside the building is a separate matter.
What maintenance actually is
Maintenance, sometimes called a care plan, covers the WordPress application layer. This is everything above the server: WordPress core, your theme, and every plugin installed on the site.
A maintenance service is responsible for:
Update management. WordPress core, themes, and plugins release updates regularly. Some are security patches. Some add features. Some introduce breaking changes. A maintenance provider researches what each update does before applying it, tests it in a staging environment where possible, and applies it in a way that can be rolled back if something breaks.
Monitoring and error detection. A site can be online and still be broken. A plugin conflict might cause a specific page to fail. A JavaScript error might break a contact form. Uptime monitoring only tells you whether the server is responding, not whether the site is functioning correctly. Maintenance includes monitoring at the application level.
Fixing things when they break. Updates occasionally cause problems. Plugins conflict. A theme function behaves differently after a WordPress core change. Maintenance includes the labour of diagnosing and resolving these issues, not just detecting them.
Human oversight. The fundamental difference between hosting and maintenance is that maintenance requires a person who knows WordPress to look at what is happening inside the site on a regular basis. A server can be automated. Application-layer judgement cannot.
Why the difference matters
The analogy that holds up best is a commercial building. The landlord provides the building, the utilities, and the structural maintenance. None of that has anything to do with whether the tenant is running the interior properly.
You can have excellent hosting, fast servers, 99.9% uptime, and daily server snapshots, and still end up with a WordPress site that breaks because a plugin updated without anyone checking whether it was compatible, or because a security vulnerability in an outdated theme was exploited, or because three years of accumulated plugin conflicts finally caught up with each other on a Monday morning.
Conversely, you can have meticulous WordPress maintenance practices and still suffer downtime if the host’s infrastructure has problems or if the server environment is misconfigured for your site’s needs.
Both layers need ownership. Problems in either layer affect the same thing: whether your site works for the people visiting it.
The gap that causes most post-launch problems
The most common scenario I encounter when taking over a site is this: the client has hosting with a reputable provider, and nobody has touched the WordPress installation since the original developer handed it over.
There is no gap in coverage that anyone chose deliberately. It just happened. The host does what the host does. The original developer moved on. The client assumed the host was handling everything. The host assumed the client or their developer was handling updates. Nobody was.
This is where the Monday morning message comes from. The site broke, usually because of an update that ran automatically, or a vulnerability in a plugin that had not been updated in 18 months, or a PHP version change the host applied server-wide. I wrote about this specific failure mode in more detail in the post on why your client’s WordPress site broke after an update, but the root cause is nearly always the same: the application layer had no clear owner.
Hosting and maintenance need to be separate, clearly understood responsibilities with named owners. It does not matter whether they are with the same provider or different ones. What matters is that the question “who is responsible for keeping WordPress healthy” has an unambiguous answer.
What bundling them together looks like
One way to close the gap is to use a provider that handles both layers under a single arrangement. Managed WordPress hosting at the premium end of the market, and dedicated care plans from WordPress developers, often bundle infrastructure and application maintenance together.
The advantage is accountability. One provider, one point of contact, one answer to the question of who is responsible when something goes wrong. The disadvantage is that the two services have different cost structures and different skill requirements, which means bundled offerings vary significantly in what they actually include.
When evaluating a bundled offering, the infrastructure side is relatively easy to assess: server specs, uptime guarantees, CDN, backup frequency, and restore procedure. The maintenance side requires more scrutiny, because the critical variable is not what the provider lists but how they actually handle updates.
The questions worth asking any provider
Whether you are assessing a new hosting and care arrangement or reviewing an existing one, these are the questions that cut through the marketing:
Who is responsible for plugin and core updates, specifically? Not “we handle updates” but who, by name or by role, makes the decision to apply an update and does the work.
How are updates tested before being applied to the live site? The answer should involve either a staging environment or a defined testing process. “We apply them and monitor” is not sufficient for a site where downtime has a cost.
What is the rollback procedure if an update breaks something? How long does it take, who initiates it, and what is the acceptable window of disruption.
What does emergency support look like? If the site goes down on a Sunday evening, what is the response time and who responds. An SLA is useful but the practical answer matters more.
What is not included? Understanding the boundaries of what a care plan covers, and what falls outside it and becomes billable separately, is as important as understanding what is included.
The hosting and care service I offer is structured around clear answers to all of these. Infrastructure and application maintenance handled together, updates researched before being applied, human review after every update cycle, and a defined escalation process when something needs urgent attention.
Frequently asked questions
Is WordPress hosting the same as WordPress maintenance?
No. Hosting is the server infrastructure your site runs on. Maintenance covers the WordPress application layer, meaning core, themes, and plugins. A hosting provider ensures your server is running. A maintenance provider ensures WordPress itself is healthy, updated, and functioning correctly. Many sites have hosting in place but no defined maintenance arrangement, which is where most post-launch problems originate.
Do I need a separate care plan if I have managed WordPress hosting?
It depends on what your host includes. Some managed WordPress hosts include update management and monitoring at the application level. Many do not, or include it in a limited form. The key questions are whether a human reviews updates before they are applied, whether there is a testing process, and what the response looks like when something breaks. If your host cannot answer those questions clearly, a separate care plan is worth considering.
What is a WordPress care plan?
A WordPress care plan is a recurring service that covers the ongoing maintenance of a WordPress site at the application layer. Typically this includes plugin, theme, and core updates; security monitoring; uptime monitoring; performance checks; and some level of support for issues that arise. The scope varies significantly between providers, so the specific inclusions matter more than the label.
How often should WordPress be updated?
WordPress core, themes, and plugins release updates on their own schedules. Security patches should be applied promptly. Feature updates and major version releases benefit from testing before being applied to a live site. In practice, a well-managed site is reviewed for updates at least monthly, with security patches applied faster when the vulnerability is actively exploited.
What happens if no one manages WordPress maintenance?
Plugins fall out of date, which increases security vulnerability. Compatibility issues between plugins and WordPress core accumulate. Performance degrades. When an update eventually runs, whether manually or automatically, it is more likely to cause a problem because the gap between the current version and the updated version is larger. Most WordPress site failures are preventable with consistent maintenance.
