Who Is Responsible for Updating My WordPress Website?

Nobody is responsible for updating your WordPress site unless you are paying them explicitly to do it. This is one of the most common sources of confusion for small business owners. They assume someone is handling it. Often no one is.

How does the responsibility split work?

WordPress has three layers, and each one has a different owner.

The server and hosting. Your hosting company is responsible for keeping the physical or virtual server running. They manage the operating system, the web server software, and the database engine. They do not manage what is installed inside WordPress.

WordPress core. The WordPress Foundation releases updates to the core software. On most setups, the site owner or developer applies these. Some hosts include auto-updates for WordPress core, but most shared hosting plans do not.

Plugins and themes. These are entirely your responsibility, or your developer’s if you are paying them for maintenance. The plugin authors release updates. No one automatically applies them to your site unless you have set up auto-updates or hired someone to do it.

In a typical small business setup, no single person is responsible for the whole system. Each layer has a different owner, and the connections between them are no one’s job.

What does my web developer handle?

It depends on your agreement. A developer who built your site was hired for the build. Unless you signed a separate maintenance contract, they stopped being responsible for updates when the project ended.

Many developers offer ongoing maintenance retainers. For $75 to $200 per month, they apply updates, monitor for problems, and respond when something breaks. If you do not have this agreement, your developer is not applying updates.

Most small business owners have never had this conversation with their developer. They assume the developer is watching. The developer assumes the owner is watching.

What does my hosting company handle?

Your host is responsible for:

• The server staying online
• The network staying connected
• The database engine running
• Backups, if your plan includes them

Your host is not responsible for:

• Applying WordPress core updates
• Updating your plugins or theme
• Responding to security alerts in your specific plugins
• Fixing conflicts between your plugins

Some managed WordPress hosting plans go further and include automatic plugin updates and malware scanning. Check your hosting plan’s documentation to see exactly what is included.

How do I find out if anyone is updating my site?

Log into your WordPress dashboard. Go to the Updates section. If you see many updates waiting, including for core, plugins, or themes, no one has been applying them.

You can also check your plugin list for the “Last updated” date. Plugins that have not been updated in more than a few months may be abandoned or may need attention.

What you can do today

1. Log into WordPress and check the Updates section. Note how many are waiting.
2. Contact your developer or agency and ask directly: who is responsible for applying plugin and theme updates on my site?
3. Check your hosting plan documentation for what is included.
4. If no one is doing it, either enable auto-updates with daily backups, or hire someone explicitly to manage this.
5. Consider whether the current arrangement makes sense, or whether a managed service would simplify who owns what.

Why this keeps adding up

The fragmented responsibility model is not a design choice anyone made deliberately. It emerged from how WordPress was built. Each component has its own owner. No one coordinated who is responsible for the connections between them.

For a business owner, the result is a website that depends on you knowing which layer is whose responsibility. Most owners find this out the hard way, after something breaks.

See /insights/website-maintenance-what-am-i-paying-for for a line-by-line breakdown of what maintenance includes. For the cost picture, see /insights/wordpress-maintenance-cost.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. One service, one responsibility.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.