What Is Included in Website Maintenance? A Clear Checklist

Website maintenance usually includes software updates, security monitoring, regular off-site backups, uptime monitoring, performance checks, fixing broken pages and links, small content changes and a monthly report. A good plan also covers what happens when something goes wrong: who responds, how quickly and whether the fix is included.

The difference between plans is rarely the list of tasks; it is how often they happen, whether someone actually checks the results and what is excluded.

Why websites need maintenance

A website isn't finished when it launches. The software it runs on gets security updates, browsers change, plugins are abandoned, hosting fills up and content goes out of date. Left alone, a site gradually becomes slower, less secure and more likely to break after an automatic update.

The risk is real for small organisations. The UK's National Cyber Security Centre notes in its small business guidance that 1 in 2 small businesses suffer a cyber incident every year. Outdated website software is one of the most common ways in.

What website maintenance includes

Software updates

This is the core of maintenance. WordPress's own security guidance says to keep WordPress up to date because older versions are not maintained with security updates, to keep plugins updated and to delete plugins you no longer use. The same applies to any platform or framework.

Good maintenance doesn't just press "update all". It:

• tests updates on a staging copy first, or checks the site immediately afterwards
• reads release notes for major changes
• replaces abandoned plugins before they become a risk
• keeps the server's PHP or Node.js version supported

Backups

Backups are your insurance against hacks, failed updates and human error. WordPress recommends backing up regularly, including the database, with a set of regularly timed snapshots kept somewhere trusted.

Ask three questions about any backup service:

1. How often are backups taken, and how many are kept?
2. Are they stored away from the website's own server?
3. When were they last test-restored?

A backup that has never been restored is a hope, not a plan.

Security monitoring

This covers malware scanning, blocking repeated login attempts, two-factor authentication for admin users, removing unused accounts and watching for unexpected file changes. It should also include a clear process if the site is compromised: clean-up, closing the vulnerability and requesting removal of any Google warnings.

Uptime and performance

Uptime monitoring checks the site every few minutes and alerts someone when it's down, ideally before your customers notice. Performance checks look at page speed and Google's Core Web Vitals, where the targets are for the main content to load within 2.5 seconds and the page to respond to interactions in under 200 milliseconds. Slow pages lose visitors and can affect search visibility.

Fixes and small changes

Most plans include an allowance for small tasks: updating prices, adding a team member, changing opening hours, fixing a broken form. Check how much time is included each month, whether unused time rolls over, and the rate for larger work.

Reporting

A monthly report should show what was updated, backup and uptime status, security events, speed, and anything that needs a decision from you. If you never hear from your maintenance provider, you can't tell whether anything is being done.

What is usually not included

Read the exclusions carefully. Common ones:

• New features or pages, which are usually quoted separately.
• Redesigns and major content rewrites.
• Third-party costs such as premium plugin licences, hosting or domain fees.
• Clean-up after a hack if the site wasn't on the plan's security cover.
• Fixing problems caused by others editing the site or code.

How often should maintenance happen?

It depends on how complex and how busy the site is:

• Brochure sites with few plugins: weekly updates and checks, daily backups.
• E-commerce and booking sites: more frequent checks, daily or more frequent backups, and faster response times, because downtime costs sales directly.
• Custom web applications: updates aligned with the framework's release cycle, plus monitoring of errors and background jobs.

Do it yourself or use a maintenance plan?

If your website generates leads or revenue, the question is less "can I do this myself?" and more "what does a day of downtime or a hack cost me?".

Signs your current maintenance isn't working

If you already pay for maintenance, these are signs it isn't being done properly:

• The admin area shows pending updates that have been waiting for weeks.
• You've never received a report, or reports only say "all good" with no detail.
• Nobody can tell you when a backup was last restored.
• You find out about downtime from customers, not from your provider.
• Small changes take weeks, or every request becomes a new quote.
• Google Search Console shows errors or security issues nobody has mentioned.

Any one of these is worth raising. Several together usually mean you are paying for a promise rather than a service.

Questions to ask a maintenance provider

1. What exactly is updated, and how do you test updates?
2. How often are backups taken, where are they stored and when were they last restored?
3. What is your response time if the site goes down or is hacked?
4. Is hack clean-up included?
5. How much time for changes is included each month?
6. What will the monthly report show?
7. Do I keep full access to my site, hosting and backups?

Frequently asked questions

If you'd rather someone else handled updates, backups, security and small changes, with a clear monthly report, see our managed maintenance plans. For sites that need extra protection, our cybersecurity and backups service adds monitoring and incident response.