What a Website Maintenance Plan Should Include

The short answer

Our monthly maintenance package is built around this list; use it to compare ours with anyone else's.

Updates and testing

Software that runs a website, whether WordPress and its plugins, a Shopify theme or a custom application's dependencies, receives security fixes constantly. Not applying them is how sites get hacked; applying them blindly is how sites break. A real plan does both halves: updates on a fixed rhythm, security fixes faster, and each round tested on a staging copy before production. Ask how the provider tests. The honest answer includes a staging environment, a short checklist of pages and forms checked after each update, and a way to roll back.

Backups and restores

A backup that has never been restored is a hope, not a backup. The questions that matter: how often, where it is stored, how long it is kept, and when it was last restored as a test. Daily backups stored somewhere other than the site's own server, kept for at least thirty days so that a problem discovered late can still be undone, and a restore test on a schedule. For a webshop, add the question of whether orders placed between the last backup and a restore are recovered, which needs the backup to be more frequent or the payment provider to hold the record.

• Daily, automated, with database and files both included.
• Stored off-site: different server, ideally a different provider.
• Retention of thirty days or more; a single most-recent copy overwrites the good version with the broken one.
• A documented restore test at least quarterly, with the time it took recorded.

Uptime and security monitoring

Uptime monitoring checks that the site responds, from outside, every few minutes, and alerts someone when it does not. Security monitoring looks for changed files, known vulnerabilities in installed software, expired certificates and unusual logins. Both are cheap to run and only useful if an alert reaches a person who will act, including outside office hours for a shop. Ask who receives the alert at two in the morning on a Sunday, and what they are contracted to do about it. A plan that only shows you an uptime graph at month end has monitored, not protected.

Response times and hours included

Two numbers must be in writing: how quickly the provider acknowledges and starts on an incident, by severity, and how many hours of ordinary work are included per month for content changes and small fixes. Response time is not fix time; a plan may promise to respond within hours without promising when the fix lands, and that is acceptable as long as it is honest. Included hours should roll into a defined process: what counts as included, what is quoted separately, and what happens to unused hours.

Reports you should receive

A monthly report is how you know the plan is doing anything. It does not need to be long: which updates were applied and when, the result of the post-update check, backup status and last restore test, uptime for the month with any incidents and their cause, security findings, hours used against hours included, and a short list of things that need your decision, such as an expiring domain or a plugin that is no longer maintained. If your provider cannot produce that in a few paragraphs, ask what they are actually doing.

When you do not need a plan: a small brochure site on a hosted builder such as Squarespace or Wix, where the platform applies updates and backups itself, needs a yearly check rather than a monthly plan, and we say so. A WordPress site, a webshop or anything with custom code and forms that bring in business needs someone responsible, either you with a routine or a provider with a contract. Our guide on maintaining your site yourself or outsourcing helps you decide which. If it is a provider, compare their plan against this list, then compare ours on the pricing page or book a call.

Frequently asked questions