What Does Website Maintenance Include? Full Service Breakdown

“Website maintenance” is one of those phrases that means whatever the person selling it wants it to mean. One provider means four plugin updates a month. Another means updates, backups, security scanning, uptime monitoring, speed work, content edits and a monthly report. Both call it the same thing and charge wildly different prices for it.

This article is the full list, task by task, with how often each one runs and who normally does it. If you are earlier in the question than this, read the full scope of the work first. If you already know you need it and want to compare quotes, this is the page to read with a quote open beside it.

The Complete Task List

Everything a maintenance plan can include falls into eight groups. The table below is the whole scope in one place. Every row after it is the same list with the reasoning attached.

1. Monitoring: Knowing Before Your Customers Do

Monitoring is the cheapest thing on the list and the first thing to insist on. A monitor checks that your site answers, from outside your own network, every few minutes. When it stops answering, somebody is told.

Two things belong in this group. Uptime, which catches outages, expired domains and failed deployments. And certificate expiry, which catches the specific failure that puts a full-page browser warning in front of every visitor. Both are automatic once configured, which is exactly why there is no excuse for their absence.

2. Backups: Two Copies, One of Them Somewhere Else

A real backup has three properties. It runs on a schedule without anybody remembering. It lands somewhere other than the server it came from, because a server failure that takes your site takes any backup stored on it. And it includes the database as well as the files, because a WordPress site without its database is a folder of code.

Frequency should match how much you would accept losing. An online store taking orders through the day wants daily backups at least, because the gap between backups is the window of orders you cannot recover. A five-page brochure site that changes twice a year is fine on weekly.

The part most plans quietly skip is the restore test. A backup nobody has ever restored is a claim, not a safety net. Ask any provider when they last tested a restore of your site specifically.

3. Security: Scanning, Patching and Hardening

Security in a maintenance context is not a firewall product. It is three habits.

Scanning looks for malware and for files that changed when nobody changed them, which is often the first sign of a compromise. File integrity monitoring catches things a signature scan misses.

Patching is the one that actually prevents most incidents. When a vulnerability in a popular plugin is disclosed publicly, automated scanners begin looking for sites still running the vulnerable version almost immediately. Applying security patches on disclosure rather than on next month’s schedule is what keeps you out of that window.

Hardening is the smaller set of one-time jobs that stay done: removing unused plugins and themes rather than leaving them deactivated, keeping user accounts to the people who still work with you, and making sure administrator logins are protected.

4. Updates: The Work Everybody Means by Maintenance

Updates are what most people picture, and they are the most misunderstood item on the list, because pressing update is a fraction of the job.

The job is: take a backup first, apply the updates, then look at the site. Load the homepage, a key inner page, the contact form and, on a store, add something to the cart. Updates break layouts and break forms, and a plan that updates without a visual check afterward is trading one risk for another.

Batching monthly is safer than updating the moment every notice appears, because you are testing one set of changes rather than twenty. The exception is a security patch, which goes on immediately, on its own, with its own check.

5. Functional Testing: The Part Nobody Else Does

This is the group that separates a real plan from a cron job with an invoice.

Your contact form is the most valuable thing on your site and the most likely to fail silently. A test submission that actually confirms arrival in the inbox is the only way to know it still works. On a store, the same goes for a test transaction through checkout.

Broken links belong here too. Internal links break when you rename a page. External links rot when somebody else’s page moves. Neither announces itself, and both cost you a little credibility and a little search performance every month they stay.

6. Performance: Keeping the Speed You Launched With

Sites get slower on their own. Each new plugin adds requests. Each uploaded image is a little heavier than it needed to be. Each tracking script blocks a little more of the render.

A monthly performance check means measuring the real numbers Google uses, on a phone rather than on a desktop, and comparing them with last month. What you are looking for is the direction of travel. A page that has gone from two seconds to four has a cause, and the cause is much easier to find this month than next year.

7. Content and Housekeeping

Most plans include a small allowance of content edits: a price change, a new team member, updated opening hours, a seasonal banner. It is worth knowing exactly how much is included before you need it, because “small edits” is where plans differ most.

Housekeeping is the unglamorous rest. Clearing spam. Removing post revisions and expired transients that bloat the database. Deleting the plugins somebody trialled two years ago. None of it is visible to a visitor, and all of it is why a maintained site feels different to work on.

8. Reporting: The Proof It Happened

A maintenance plan you cannot audit is a subscription, not a service. The report is what makes it a service.

A useful report says what was updated, what the scans found, whether the backup ran and was tested, what the speed numbers were this month against last, and whether the form test passed. If a report is a list of green ticks with no numbers and no detail, you are paying for reassurance rather than work.

What Is Not Included, and Should Not Be

Two things get confused with maintenance often enough to be worth stating plainly.

Hosting is not maintenance. Your host runs the server, the network and usually the server software. That is where their responsibility ends. They do not update your plugins or test your forms. If you want the distinction in detail, that is covered in the main guide.

New work is not maintenance. A new page template, a redesign, a new booking system or an SEO campaign are projects. They are quoted as projects. A maintenance plan that claims to include unlimited development is either capped somewhere in the small print or is not going to survive the relationship.

How the Scope Changes With the Site

The list above is the general case. Three kinds of site pull away from it enough that it is worth saying how, because a plan sold on one shape of site fits another badly.

An online store moves several rows up a level. Backups become daily at minimum, because the interval between backups is the window of orders you cannot recover. Checkout testing joins form testing and happens after every update round without exception, since a broken checkout is worse than an outage: it takes the customer to the last step and fails there. Payment gateway and shipping plugin updates need watching individually rather than as part of the batch, because those are the ones with API deadlines set by somebody else.

A site with logins or member areas adds user account hygiene to the list. Old administrator accounts belonging to former staff or past contractors are one of the most common ways a site is compromised without any software vulnerability being involved at all. Reviewing who still has access, and at what level, belongs on a quarterly cycle.

A five-page brochure site can genuinely relax most of the table. Weekly backups instead of daily, monthly updates, quarterly for everything else. The one row it must not relax is the form test, because on a brochure site the form is the entire commercial purpose of the website. Everything else on that kind of site is presentation; the form is the transaction.

If your provider quotes the same plan regardless of which of those three you are, ask which rows change. The answer tells you whether they looked at your site or at a price list.

How to Read a Quote With This List

Two things the table cannot tell you are how often each row should run and whose job it is. Those have pages of their own: a frequency for every part of a site and who should be accountable for each group of tasks.

Take any quote and mark each row of the table above as included, excluded or unclear. The unclear ones are the interesting ones, and there are four questions that resolve almost all of them.

• Where do backups go, how often, and when did you last test a restore?
• Do you check the site visually after updating, and do you test the contact form?
• Do security patches wait for the monthly cycle, or go on immediately?
• What does the monthly report actually contain?

Our own answers to those four are on the plans page, and the work process page shows the order the tasks run in each month.

Frequently Asked Questions

Where to Start

Do not start by buying a plan. Start by finding out what is currently true about your site: whether it is backed up somewhere other than the server, whether it is being monitored, and whether its forms still work.

If you would rather have somebody establish that for you, ask us to look at your site. We will tell you what is in place and what is not, and you can take the list to any provider, including us.