What a Website Maintenance Plan Should Include

Website maintenance is one of the easiest services to sell badly. The work is invisible when it goes well, which means an invoice for doing nothing looks identical to an invoice for doing the job.

So the question to ask of any plan is not what it includes. It is what proof arrives each month that it happened.

The floor: what any plan must cover

Updates, applied and verified

Core platform, theme, and plugin updates. The important word is verified — an automatic updater that applies a plugin update and breaks the checkout at 2am has made things worse. Updates should be applied on a staging copy, checked, then pushed.

Backups that have been restored

Daily backups, stored somewhere other than the same server, with a documented restore test at least annually. A backup nobody has restored is a hypothesis.

This is the item most often technically present and practically useless. Ask when the last test restore was. If nobody can answer, it has never been done.

An untested backup is not a backup. It is a folder you are hoping about.

Uptime monitoring with a person attached

Checks every few minutes and an alert when the site goes down. The alert has to reach somebody who will act on it — monitoring that emails a shared inbox nobody watches is theatre.

Security basics

Malware scanning, a firewall, login rate limiting, and SSL certificate renewal monitoring. An expired certificate throws a full-page browser warning and is one of the few failures that will stop nearly every visitor cold.

What separates a real plan from a token one

A monthly report you can read

What was updated, what broke and got fixed, uptime percentage, page speed trend, traffic and conversions. One page. If the monthly report is an automated PDF nobody at the agency looked at before sending, it is a receipt, not a report.

Included content changes

A sensible allowance — an hour or two a month — for the small changes every business needs. New staff member, updated hours, a price change, a seasonal banner. Plans that bill separately for every ten-minute edit produce sites that go stale, because owners stop asking.

Performance work, ongoing

Sites slow down as content accumulates. A plan that only applies updates is watching the site degrade. Quarterly image audits, script review, and database cleanup should be in scope.

Somebody who answers

When the site goes down on a Friday afternoon, the response time on the plan is the whole product. A four-hour response for a shop taking orders online is a different service from a next-business-day response, and both are legitimate — they are just not the same price.

The questions to ask before signing

1. What exactly is in the monthly report? Show me last month’s for another client, redacted.
2. When was the last test restore from backup?
3. Is staging used for updates, or do they go straight to production?
4. How many content changes are included, and what happens at the limit?
5. What is the response time when the site is down, and outside business hours?
6. If we cancel, what do we take with us?

What it is reasonable to pay

A brochure site with updates, backups, monitoring, and a short report is a modest monthly number. A site that takes orders, with a four-hour response and real content allowance, costs meaningfully more and should.

The plan to be suspicious of is the cheap one that includes everything, because it is almost certainly automated end to end with nobody looking. Automation is fine for applying updates. It is not fine as the entire service.

This is the shape of the maintenance work described in the Green Acres partnership — monthly reports, iterative SEO and speed work, and a named person rather than a cron job.