What should a website maintenance plan include?

A website isn't finished when it goes live. WordPress, themes and plugins are updated frequently, backups need to run, and security issues appear without warning. A maintenance plan exists so that work happens reliably, whether or not anyone remembers.

But "maintenance" means very different things from one provider to the next. Here's what a website maintenance plan should include, what's usually extra, and the questions to ask when comparing plans.

The essentials every plan should cover

1. Updates, done safely

WordPress core, your theme and every plugin need regular updates. They fix security holes and keep things compatible.

The important word is safely. Updates occasionally break things. A good plan checks the site after updating and, for stores or complex sites, tests updates on a staging copy first. Ask how often updates run and what happens if one causes a problem.

2. Backups stored off the server

Regular, automatic backups of your files and database, stored somewhere other than your hosting server. A backup that lives on the same server as your website disappears with it if the server fails or is compromised.

Ask how often backups run, how many are kept, and how long a restore takes.

3. Security monitoring

At minimum:

• malware scanning
• login protection against password-guessing attacks
• a valid SSL certificate (the padlock)
• prompt action on plugins with known vulnerabilities

If your site is ever hacked, the plan should say whether clean-up is included or charged separately.

4. Uptime monitoring

Automatic checks that alert your provider when the site goes down, so problems are noticed in minutes rather than when a customer complains.

5. Small content changes

Most businesses need small edits every month: a new team member, updated prices, a banner, a new photo. Good plans include some editing time. Check how much, how to make requests and how quickly they're handled.

6. A simple report

A short monthly summary of what was updated, backed up and fixed. It shows the work is actually being done.

Useful extras

Depending on your site, these may be worth adding:

• Speed checks: image optimisation, caching and fixing slow pages
• Form and checkout testing: confirming enquiries and orders still arrive (lost form emails are a common, silent reason a website stops getting enquiries)
• Hosting management: your provider manages the server, renewals and SSL
• Domain and email renewals tracked so nothing expires
• Priority response for stores and business-critical sites

What maintenance usually doesn't include

Be clear about the boundaries so there are no surprises:

• New features or pages: building something new is usually quoted separately
• Redesigns: a new look is a project, not maintenance
• Content writing and SEO: these are usually separate services, such as our SEO service
• Third-party costs: hosting, premium plugin licences and domain renewals are usually billed separately

Does a WooCommerce store need more?

Yes. A store handles payments and customer data, and every broken update can cost sales. Stores benefit from more frequent backups (orders change daily), updates tested on staging, and regular checks that checkout, payment and order emails still work.

Questions to ask before you sign up

1. How often do updates and backups run, and where are backups stored?
2. Do you test updates before applying them to my live site?
3. What happens if my site is hacked? Is clean-up included?
4. How much editing time is included each month?
5. Do I keep admin access and ownership of my website and domain?
6. How do I cancel, and will you hand over everything if I do?

The last two matter most. A maintenance provider should manage your website, not own it. See who should own your domain and website.

Do it yourself or hand it over?

You can maintain a WordPress site yourself if you're comfortable with updates, backups and fixing the occasional conflict. Many businesses decide their time is better spent elsewhere.

Our website maintenance plans cover updates, off-site backups, security, monitoring and content changes, for sites we built and sites we didn't. Plans are monthly or annual, with the scope agreed in writing. Tell us about your website and we'll suggest the right level of cover.