A maintenance rhythm
your whole team can follow.
The full daily, weekly, monthly and quarterly maintenance methodology — plus an incident workflow — so care-plan delivery doesn't depend on what one person remembers to check.
Last reviewed 17 August 2026 by the Stack2 team — we run our own agency hosting operation the same way.
Undocumented maintenance is one resignation away from a client incident.
When maintenance lives in one person's head, quality depends entirely on that person's memory, mood and workload that week. A written SOP is what turns care-plan delivery into something the whole team — including a new hire in week one — can run consistently.
Before the task list: define what this SOP actually covers.
Purpose. Keep every site on a care plan patched, backed up, monitored and reported on — consistently, regardless of who's running maintenance that week.
Roles. A maintenance operator runs the daily and weekly cycle. An escalation lead owns anything that turns into a genuine incident. A site owner is accountable for each client relationship and signs off scope and exceptions.
Service tiers this SOP applies to. Monitoring-only sites get the daily checks only. Protect-level and hands-on sites get the full daily-through-quarterly rhythm below.
Daily
- Check for failed or skipped backups overnight — investigate same day, don't let a second failure stack on top of the first.
- Check uptime alerts for any site that went down — confirm it's back up and note the cause if known.
- Review new critical vulnerability notices against the plugin/theme inventory — patch immediately if a managed site is affected.
- Triage any client-reported issue into the escalation workflow below if it's not a two-minute fix.
Weekly
- Review pending core, plugin and theme updates across the portfolio.
- Run scheduled updates for Protect-tier and hands-on sites, with a backup taken immediately before each run.
- Spot-check each updated site's front end and admin dashboard after updates apply.
- Log and handle rollback exceptions (see incident workflow) — don't leave a broken update mid-week.
Monthly
- Send the client report — updates applied, uptime, backups completed, and any incidents with resolution notes.
- Review open tickets across the portfolio and close out anything stale.
- Run a five-minute profitability check per care plan: labour time against price, using the pricing calculator if margin looks off.
- Flag any client communication needed — scope creep, a site that's outgrown its tier, or a renewal conversation coming up.
Quarterly
- Full access review — confirm who has admin access to each site and remove anyone who shouldn't.
- A genuine restore test on a sample of sites — not just confirming a backup file exists, actually restoring it.
- PHP and plugin compatibility sweep ahead of major version deprecations.
- Care-plan scope and price review against the profitability check from the monthly cycle.
Incident workflow
Not every problem is an incident. A failed plugin update that's fixed by a rollback in five minutes is routine. An incident is anything client-facing, security-related, or unresolved after 30 minutes of troubleshooting — at that point, it moves to the escalation lead with:
- Severity — is the site down, degraded, or cosmetically broken?
- Ownership — the escalation lead owns it from this point; the maintenance operator stays available but isn't solely responsible.
- Client communication — the site owner decides if and when the client is told, based on severity and visibility.
- Post-incident notes — what happened, what fixed it, and whether the SOP needs a new exception entry so it doesn't repeat.
See how AutoCare, monitoring and reports map to this rhythm.
AutoCare applies the weekly update run on your schedule with an automatic backup before every change — and generates the monthly client report without anyone building it by hand. Uptime and vulnerability monitoring cover the daily checks around the clock.
14 days free. No credit card required.
Keep going.
How to Manage 100 WordPress Websites: The Agency Operations Playbook
Build a repeatable operating system for a growing client portfolio — inventory, access, updates, backups and reporting — instead of five dashboards and a spreadsheet.
The 30-Minute Client Website Portfolio Audit
Score ownership, access, maintenance, protection and risk across every client site to find the gaps before a client — or an incident — finds them for you.