How AI automates a large share of your WordPress maintenance

Introduction: why you will not find a percentage in this article

Almost every article on this subject announces a figure: "automate 80% of your maintenance". We will not give one, and the reason is the subject of the article itself.

The automatable share depends entirely on what your maintenance contains, and that is not the same on a five-plugin brochure site as on a forty-plugin store. A percentage announced without knowing your estate is not information, it is a sales argument — and a public number you cannot derive goes wrong in silence.

What we give instead: the real breakdown of maintenance, what automates in each area, what must never be automated, and the method for calculating your own proportion. It takes an hour and the figure belongs to you.

1. What "maintenance" actually covers — six areas

Almost nobody makes this list, which is why the subject stays vague.

1. Updates — core, plugins, theme. The most visible area.
2. Post-update verification — does the site still work. The most forgotten area, and the most expensive when missing.
3. Backups — running them, and above all verifying they restore.
4. Monitoring — availability, load time, errors, certificate expiry.
5. Security — file integrity, accounts, access attempts.
6. Cleanup — a swelling database, orphan media, revisions, dead scheduled tasks.

Time does not distribute the way people imagine. Area 1 is the one you see; areas 2 and 4 are the ones that consume, because they require continuous attention rather than a one-off action. And continuous attention is exactly what a human does badly and a machine does well.

2. What automates completely, no argument

Three areas move over entirely, and there is no reason to hold them by hand.

Monitoring (area 4). Nothing human in it: you take a reading, compare to a threshold, raise an alert. A human "checking whether the site is up" does not do it at night, nor on Sundays, nor on holiday. The gain is not time, it is coverage.

Cleanup (area 6). Purging revisions beyond a count, removing old auto-drafts, dropping scheduled tasks from uninstalled plugins. Mechanical, judgment-free, to run on a schedule.

Integrity detection (area 5). Comparing file fingerprints at regular intervals and flagging what changed without anyone knowing. That is the principle explained in proactive protection against zero-day threats: you do not recognise the attack, you recognise the change.

3. The area that decides everything: post-update verification

This is the heart of the subject, and where most automations fail.

An automatic update without automatic verification is not automation, it is a bet. It moves the risk instead of reducing it: the fix is applied faster, and the broken payment page is discovered by a customer.

What automatic verification must cover, in order of importance:

• the pages that take money work — cart, payment, confirmation;
• the forms actually submit, not merely display;
• the main pages return a correct code and the expected content — a 200 does not prove a render;
• no new errors in the logs since the update;
• load times have not moved beyond a threshold.

And the rule that makes the whole thing safe: automatic rollback if any of those checks fails. Without it, you have accelerated the breakage.

⚠ The trap found everywhere: validating on form instead of destination. A check reading an HTTP code and not the served content can be green while a page redirects to an error. Verify what is rendered, not what is answered.

4. What must never be automated

Four decisions stay human, and automating them manufactures incidents faster.

Deciding NOT to update. A critical plugin whose new version breaks an integration is handled by judgment — not by a rule.

Trading availability against security. Applying a patch in the middle of a sales period is not a technical decision.

Removing a plugin. The audit prepares automatically, the removal is decided — see auditing your plugins in 5 steps.

Responding to a real incident. A compromise requires a chain of decisions, each depending on what was just found. No rule written in advance covers that.

5. What AI adds over plain scheduling

The distinction matters, because a good part of the above is done with classic scheduled tasks. Three things scheduling alone does not do:

Sorting the noise. A hundred alerts a week of which three matter is zero useful alerts — the human stops reading them after ten days. Grouping, deduplicating and ranking turns an avalanche into three lines.

Comparing to the usual rather than to a fixed threshold. "The contact page takes 900 ms" says nothing. "It takes 900 ms when it has taken 300 for six months" says everything. A fixed threshold produces false positives; deviation from the usual produces signals.

Reading error logs. Thousands of lines from which you want to know what is new since yesterday. That is repetitive volume with low per-item stakes — exactly the profile of what should be automated.

6. Calculating YOUR proportion — the method, in one hour

• For four weeks, note every maintenance intervention: what, how long, which of the six areas
• Mark each line automatable / not automatable, using sections 2 to 4 as the grid
• Sum the minutes in each column
• The ratio is your proportion — not an article's

What this exercise almost always reveals: time does not go where people think. On most estates, areas 2 and 4 — verifying and monitoring — weigh more than area 1, which is nonetheless the only one anyone talks about.

And a side effect worth the hour on its own: you will discover at least one task nobody does, usually testing that backups restore.

Conclusion

Maintenance automation is not measured in an announced percentage, but in the number of decisions you no longer have to make — without losing the ability to take them back.

Three areas move over entirely: monitor, clean, detect change. One area decides the safety of the whole: post-update verification, with automatic rollback. And four decisions stay human, the most important being the decision not to apply an update.

The test, on your own estate: if you left for three weeks, what would be detected, and by whom? If the answer is "by a customer", maintenance is not automated — it is deferred.

Next: the 10-minute security audit, auditing your plugins in 5 steps, automating agency processes and what our ecosystem automates. Our premium plugins come with a full refund within 14 days: see the catalogue.