What a Website Maintenance Plan Should Actually Cover
Last updated:
What you are actually buying
Website maintenance means two different things: keeping the site working as its dependencies change, and making small changes on request. They are priced together and worth separating in your mind.
The first is non-optional for any site running software that receives security updates. The second is convenience.
What a plan should include
- Core, theme and plugin updates applied on a schedule, with a check afterwards that nothing broke
- Backups taken automatically, held off the server, with a restore tested at least annually
- Uptime monitoring that alerts a human, not a dashboard
- Certificate expiry monitoring, because it is entirely predictable and still takes sites down
- Security patching and a response commitment if something is exploited
- A defined allowance of small changes, with what counts as small written down
- A monthly report of what was done
Typical costs
| Site type | Monthly | What it covers |
|---|---|---|
| Small brochure site | £50–£150 | Updates, backups, monitoring |
| Business site with CMS | £150–£400 | The above plus a small change allowance |
| eCommerce | £300–£800 | The above plus payment and integration checks |
| Web application | 15–25% of build annually | Dependencies, security, defect fixes |
Signs you are paying for nothing
Ask for the last three monthly reports and the date of the last tested restore. If neither exists, you have a retainer for availability rather than a maintenance service — which may still be worth something, but you should know which you are buying.
- No report of what was done, ever
- Updates applied without any check that the site still works
- Backups that exist and have never been restored
- “Included changes” that always turn out to be extra
What is reasonable to expect included
Text and image changes, adding a page from an existing template, updating contact details, publishing a post. Not: new page templates, new functionality, redesigns or integration work.
Get the boundary written down with examples. Almost every maintenance dispute is about which side of that line a request sits on.
If you have no plan at all
The realistic risk is not that the site breaks tomorrow. It is that eighteen months of missed updates turn a routine task into a project, or that an exploited vulnerability turns it into an incident.
At minimum, arrange updates and verified backups. Everything else is refinement.
Frequently asked questions
Can we maintain it ourselves?
What happens if we skip maintenance?
Should maintenance include hosting?
Is a yearly plan better than monthly?
Not sure what your maintenance fee buys?
Ask for the last three reports and the date of the last tested restore. Happy to review what you are paying for.
Related services
What we build for problems like this one