What Should a Website Maintenance Plan Include?
Updates, backups, security, uptime, performance and renewals: what a good website maintenance plan covers, what it usually doesn't, and how to compare plans.
A website isn’t a brochure you print once. It’s software, and software needs looking after. Plugins release updates, security issues get discovered, certificates expire, forms quietly stop sending, and pages slowly get heavier as content piles up.
A maintenance plan is how you make sure someone is actually watching all of that. The trouble is that “maintenance” can mean anything from a monthly button-click to a genuinely hands-on service. Here’s what a good plan should include, what it usually doesn’t, and how to tell the difference when you’re comparing options.
Why maintenance matters
Most website problems don’t announce themselves. A contact form breaks and you assume business is slow. A plugin conflict takes down the checkout page on a Saturday. An outdated plugin becomes the way someone gets into your site.
None of this is dramatic until it is. Maintenance is the boring, consistent work that keeps it from getting to that point.
The core of a good maintenance plan
Software updates (core, plugins and theme)
On WordPress, that means three layers: WordPress core, every plugin, and the theme. Each one releases updates on its own schedule, and some of those updates are security fixes.
A good plan doesn’t just click “update all.” It should:
- Apply updates on a regular schedule, with security fixes handled promptly
- Take a backup first
- Check the site afterward to make sure nothing broke
- Ideally test larger updates on a staging copy before touching the live site
- Keep an eye out for plugins that have been abandoned by their developers
Sites built on other platforms or modern frameworks still have dependencies that need updating. The details differ, but the principle is the same.
Backups, and actually testing the restore
Everyone says they have backups. Fewer people have ever tried to restore one.
Look for:
- Automatic backups on a set schedule, more often for sites that change daily (stores, booking sites, busy blogs)
- Off-site storage, so a problem with your host doesn’t take the backups with it
- A retention window, meaning several past versions are kept, not just last night’s
- Restore testing. Every so often, someone should restore a backup to confirm it actually works
A backup you’ve never tested is a hope, not a plan.
Security monitoring
Security isn’t one tool. It’s a handful of habits:
- Malware scanning
- A firewall or security layer that blocks common attacks
- Login protection, such as limiting failed attempts and requiring strong passwords or two-factor authentication
- Reviewing user accounts so former staff and old contractors don’t keep admin access
- A clear process for what happens if something is found, including cleanup
No one can honestly promise a site will never be compromised. What a plan can promise is that someone is watching and knows what to do.
Uptime monitoring
Uptime monitoring checks your site at regular intervals and sends an alert when it goes down. The point isn’t the alert itself. It’s that your maintenance provider hears about the outage before your customers do, and starts working on it.
Performance checks
Sites get slower over time. Large images get uploaded, plugins pile up, tracking scripts accumulate. A good plan includes periodic checks on page speed and Core Web Vitals, plus fixes for the obvious problems: image compression, caching, and removing things the site no longer uses.
SSL certificates and domain renewals
An expired SSL certificate makes browsers show a security warning on your site. An expired domain can take the whole site and your email offline at once. Both are easy to prevent and surprisingly common.
Your plan should track renewal dates, confirm auto-renewal is set up, and make sure the domain is registered to your business, not to a former employee or a past vendor.
Forms and email deliverability
This one gets overlooked constantly. Contact forms are often the most important thing on a business website, and they can fail silently.
A good plan periodically:
- Submits test entries to every important form
- Confirms the notifications actually arrive, and don’t land in spam
- Checks that the site sends email through a proper mail service, not the server’s default mail function
- Verifies the domain’s email authentication records (SPF, DKIM and DMARC) are in place
That last point overlaps with your business email setup. If your forms and your inbox both run on your domain, they need to be configured to work together. Our Google Workspace and business email service covers that side.
Content updates
Most plans include a small amount of time for routine edits: swapping a photo, updating hours, adding a team member, changing a price. Check how much time is included, how you submit requests, and what happens when you need more than that.
Reporting
You should be able to see what was done. A simple monthly or quarterly report covering updates applied, backups completed, uptime, security scans and any issues found is enough. If a plan can’t tell you what it did, assume it didn’t do much.
What’s usually not included
Maintenance plans are about keeping an existing site healthy. They usually don’t cover:
- Redesigns or new page templates. A new section or a fresh look is a project. See website redesign.
- New features or custom development, such as adding a booking system or a member area
- Ongoing SEO work. Keeping the site technically healthy helps, but content strategy, local search and rankings work are a separate SEO service.
- Copywriting or large content projects
- Paid advertising management
- Hosting itself, unless the plan explicitly bundles it
- Premium plugin licenses, which usually stay in your name and on your bill
- Fixing problems caused by changes made outside the plan, like someone installing a new plugin without telling anyone
None of this is a knock on maintenance plans. It’s just worth knowing where the line is before you need something.
How to compare maintenance plans
Two plans with similar names can be very different. Use this as a checklist:
| Question to ask | What a good answer sounds like |
|---|---|
| How often are updates applied? | On a set schedule, with security fixes handled promptly and the site checked afterward |
| Do you test updates before they go live? | Yes, at least for major updates, often on a staging copy |
| How are backups stored and how long are they kept? | Off-site, automatic, with several versions retained |
| Have you tested restoring a backup? | Yes, periodically |
| What happens if the site is hacked? | A clear cleanup process, and whether it’s included or billed separately |
| Do you monitor uptime? | Yes, with alerts going to the people who will fix it |
| Do you check forms and email? | Yes, with test submissions on a regular basis |
| How much content editing time is included? | A specific amount, with a clear way to request more |
| What do I get each month? | A short report showing what was done |
| Who do I contact when something’s wrong? | A named person, not just a generic inbox |
Price matters, but it’s the last thing to compare. A cheap plan that only runs automated updates without checking the site afterward can cause as many problems as it prevents.
DIY or a plan?
If you have someone on your team who is comfortable with WordPress, understands backups and staging, and has time every month, you can handle maintenance in-house. Plenty of businesses do.
The risk is that maintenance is easy to skip when everyone’s busy, and the consequences only show up later. A plan turns it into a routine someone is accountable for.
Keeping your site in good hands
Whether your site is new or has been running for years, the right maintenance plan should leave you knowing exactly what’s being watched and who to call. Our website maintenance plans page explains what ours include. If your site runs on WordPress, our WordPress development page explains how we approach builds and long-term care. Questions? Get in touch.