What a WordPress maintenance virtual assistant should handle

A WordPress maintenance virtual assistant runs the routine that keeps a small business site working: a backup they have actually tested, plugin, theme and core updates applied in a safe order, a weekly check that the contact form still delivers, a look at who has admin access, and a short report each month. They are the person who notices the enquiry form broke on Tuesday before a customer mentions it on Friday. They are not a developer, and the useful version of this role has a clear line where their work stops and a developer's or your host's begins.

Below is the checklist, the order that stops an update from taking the site down, and the signs that you need someone more technical.

Key takeaways

• WordPress ran 40.2% of all websites on 3 October 2026, according to W3Techs, which is why its plugins are a constant target.
• The routine is backup, test the backup, update on a copy if you can, update live, then check forms and key pages.
• Give the assistant their own admin account, never yours, so you can see what they changed and remove them in one step.
• Custom code, server problems and a hacked site go to a developer or your host. An assistant contains and escalates.

Why a WordPress site needs a routine at all

W3Techs reported on 3 October 2026 that WordPress was used by 58.6% of websites whose content management system it could identify, or 40.2% of all websites. That popularity is the reason automated attacks look for out-of-date WordPress plugins first. Each plugin on your site is updated by a different author on their own schedule, and one abandoned plugin is enough.

WordPress applies minor core security releases automatically by default, and since version 5.5 in 2020 you can switch on automatic updates for individual plugins and themes. That helps, but it does not tell you whether the update broke your booking form, and it does nothing about the former staff member who still has an admin login. A person on a schedule covers those gaps.

The maintenance checklist

This is the routine we would hand an assistant for a typical brochure or lead generation site. A shop running WooCommerce needs more, mainly around payment and order testing.

WordPress maintenance routine for a small business site

How often	Task	What done looks like
Weekly	Check backups ran	Latest backup is dated this week and stored off the server
Weekly	Apply plugin and theme updates	Updates done in the order below, site checked afterwards
Weekly	Submit every form	Test enquiry received in the right inbox
Weekly	Clear comment and form spam	Queues empty, nothing real deleted
Monthly	Review user accounts	Every admin is a current person, unused accounts removed
Monthly	Check for broken links and slow pages	List of fixes sent or made
Monthly	Send a one-page report	Updates done, issues found, anything waiting on you
Quarterly	Restore a backup to a test copy	Site loads from the backup, so the backup is known to work
Quarterly	Remove unused plugins and themes	Deactivated items deleted, not left installed

The quarterly restore test is the one most businesses skip and the one that matters when something goes wrong. A backup that has never been restored is a hope rather than a backup.

The order updates should happen in

Take a fresh backup first. If your host offers a staging copy, apply updates there and click through the main pages and forms. Then update the live site: plugins first, then the theme, then WordPress core if a major version is waiting. Check the home page, the contact form, any booking or checkout flow, and the admin area. If something breaks, roll back that one plugin rather than the whole site, note it in the report, and leave it on the old version until a developer has looked.

Hold off on major version updates of large plugins, such as page builders or WooCommerce, for a week after release unless the update fixes a security hole. Early bugs are usually patched within days.

What goes in the monthly report

Keep it to one page. List the updates applied and any that were held back with the reason, the result of each form test, accounts added or removed, broken links found, and anything waiting on a decision from you. The last item matters most. If the report never asks you for anything, either the site is in good shape or nobody is looking closely, and after three months you should be able to tell which from the rest of the page.

Access, accounts and what the assistant can see

Create a separate WordPress user for the assistant. Do not share your own login. With their own account, the activity log shows what they changed, and removing them later takes one click. Our guide to sharing accounts with an assistant securely covers password managers and two-factor codes for the hosting and domain logins that do not support extra users.

Then consider what the site holds, because if your forms collect names, phone numbers or anything more sensitive, the assistant can see that data in the admin area or the form plugin's entries. Under Singapore's PDPA, if personal data is exposed in a breach that is likely to cause significant harm, or that affects 500 or more people, the organisation must notify the PDPC no later than three calendar days after deciding the breach is notifiable. Keep form entries only as long as you need them and delete the rest; data that is not there cannot leak.

If you want an outside benchmark for basic security practice, the Cyber Security Agency of Singapore runs the Cyber Essentials mark for organisations. Its requirements are a useful checklist even if you never apply for certification.

Where the assistant's job stops

The routine above is operational work. It needs care and a written process, not programming skill. A good website assistant can run it reliably and spot when something looks wrong. Some things belong elsewhere.

Send to a developer

Anything involving custom code in the theme or a plugin, a conflict between two plugins that rolling back does not fix, a design change beyond swapping text and images, and performance work that goes past image compression and caching settings.

Send to your host

Server errors, email delivery problems that are not the form plugin's fault, SSL certificate failures, and anything about PHP versions or server resources. Most hosts will handle these on a support ticket, and the assistant can raise the ticket and follow it up.

If the site is hacked

The assistant's job is to contain and escalate: put the site in maintenance mode if they can, change the admin passwords, tell you straight away and contact the host. Cleaning a compromised WordPress site properly, finding the back door rather than only the visible damage, is specialist work that is worth paying for.

When you do not need a maintenance assistant

Many managed WordPress hosts now include daily backups, automatic plugin updates and malware scanning in the plan. If yours does, check exactly what is covered before paying anyone to repeat it. The remaining gaps are usually the form tests, the user review and the monthly report, which take an hour or so a month and might sit inside a wider admin role rather than justify their own.

If an agency built your site and has you on a care plan, the routine may already be theirs. Read the plan. If it promises updates and backups but says nothing about restore tests or form checks, that is the part to ask about or to add.

And if the site is a five-page brochure that changes twice a year, with three plugins and no forms that matter, you can do this yourself in twenty minutes a month. An assistant earns their place when the site generates leads or sales, when there are several of them, or when nobody internal has the time to be consistent. For the content side of running a site, see how a web design assistant fits in, and turn the routine into a written SOP before you hand it over.

Frequently asked questions

What does a WordPress maintenance virtual assistant do each week?

They confirm backups ran, apply plugin and theme updates in a safe order, submit every form to check it still delivers, and clear spam. User reviews, link checks and a report happen monthly.

Should WordPress plugins update automatically?

For small, well-maintained plugins, automatic updates are usually fine. For page builders, ecommerce and anything your forms depend on, update by hand after a backup so someone checks the site straight afterwards.

Can a virtual assistant fix a hacked WordPress site?

They can contain it by changing passwords, switching on maintenance mode and calling your host. Cleaning the site and finding how the attacker got in needs a security specialist or developer.

How often should I test a WordPress backup?

Restore one to a test copy at least once a quarter. A backup that has never been restored has not been proven to work.

Sources

• W3Techs: Usage statistics and market share of WordPress (3 October 2026)
• PDPC: Required to notify the PDPC of a data breach
• Cyber Security Agency of Singapore: Cyber Essentials mark

If your site brings in enquiries and nobody is checking it on a schedule, book a call and we can walk through what a website assistant would take over.