Website maintenance: what a monthly plan should include

We've taken over support for a lot of websites that already had a "maintenance plan." Most of the time it was a $40/month line item that meant almost nothing. No one had logged in for months. The CMS was four major versions behind. The last backup on record was from before the site's last redesign.

A maintenance plan is only worth paying for if it does specific, checkable things. Here's what we think belongs in one, because we build these retainers into our own website maintenance plans, and this is the checklist we hold ourselves to.

What a real plan actually covers

• Core and plugin/dependency updates applied on a schedule, not "whenever we notice"
• Automated daily or weekly backups stored off the hosting server, with at least one restore tested per quarter
• Uptime monitoring that alerts a human within minutes of downtime, not a dashboard nobody checks
• A stated response time for issues (same business day is standard, same hour for anything e-commerce or booking-critical)
• SSL certificate renewal handled automatically, with a fallback alert if auto-renewal fails
• A monthly or quarterly report showing what was actually done

That last point matters more than people expect. If your provider can't show you a changelog, you have no way of knowing whether the plan is doing anything at all.

Why outdated software is the real risk, not hackers picking on you specifically

Almost nobody gets individually targeted. Automated scanners crawl the web looking for known vulnerabilities in specific plugin or CMS versions, then exploit whatever they find. A site running a plugin with a disclosed vulnerability from eight months ago isn't unlucky if it gets compromised, it's just been sitting there unpatched and visible the whole time.

This is the part a cheap plan usually skips, because patching takes actual attention. Someone has to check for updates, test them against the live site (an update can break a theme or a custom integration), and apply them without taking the site down. That's work, and it's the work that separates a real plan from a billing line.

Backups you've never tested aren't backups

We've seen this go wrong more than once: a site gets hacked or a bad update corrupts the database, the agency reaches for "the backup," and it turns out the backup job silently failed three months ago, or it only captured files and not the database, or it was stored on the same server that just went down. A backup nobody has restored from is a theory, not a plan.

What plans typically cost

E-commerce and booking-driven sites should lean toward Standard or Premium. A maintenance gap on a brochure site costs you embarrassment. A maintenance gap on a site taking payments or bookings costs you revenue and, depending on what's exposed, possibly a breach notification to your own customers.

Signs you're paying for a plan that doesn't exist

• You've never received an update or status report, ever
• You don't know who to contact if the site goes down right now
• Your CMS admin shows updates pending that are months old
• Nobody can tell you the last time a backup was actually tested
• The "plan" is really just an hourly rate with a minimum, billed whether anything happened or not

If two or more of those are true, you're paying for insurance that doesn't pay out. Worth checking before you need it, not after.

What we do differently

We don't sell maintenance as an upsell nobody asked for. Every build we hand off includes a clear maintenance tier recommendation based on what the site actually does, with a changelog you can read and a real tested restore path if something goes wrong. If your current setup can't answer the basic questions above, that's usually the first thing worth fixing, before anything else on the site.