What Should a Website Maintenance Plan Actually Include?

Not all website maintenance plans are the same, and the price difference between a thorough plan and a thin one that just updates plugins on autopilot isn’t always obvious from a service list alone. Here’s what a proper plan should actually cover, and the questions worth asking if you’re comparing options.

Core Updates, Tested Before They Go Live

WordPress core, plugin and theme updates should happen regularly, but just as importantly, they should be tested somewhere other than your live website first, ideally in a staging copy of the site, before being applied to the version your clients actually see. Updates applied blindly, straight to a live site with no testing, are how a routine update ends up breaking something, the kind of avoidable failure that turns into the emergency repair work we cover in Website Maintenance vs Emergency WordPress Repairs.

Backups, Actually Verified to Work

Backups need to run on a genuine, regular schedule (daily is standard for an actively used business website), and they need to be stored somewhere other than only on the same server as the live site, so a server-level problem doesn’t take out the backups along with the original. A backup that’s never been tested by actually restoring from it is a backup you can’t be fully confident in. Ask whether backups are periodically verified, not just scheduled.

Security Monitoring

This should include malware scanning on an ongoing basis, monitoring for suspicious login attempts, and a firewall or equivalent protection layer. Security is one of the areas where “we’ll deal with it if something happens” is a considerably more expensive approach than ongoing prevention, for the reasons covered in What Happens When You Stop Maintaining a WordPress Website?

Performance Monitoring

A proper plan should track site speed over time, not just at the point the site launched, and address performance issues (image optimisation, caching configuration, database clean-up) as they emerge rather than letting them accumulate for years.

Uptime Monitoring

You should know if your website goes down, ideally before a client tells you it’s down. Uptime monitoring alerts you (and your maintenance provider) the moment a site becomes unreachable, so the response can start immediately rather than after however long it takes for someone to notice.

Reporting You Can Actually Understand

A monthly summary of what’s been done, updates applied, backups completed, any issues found and resolved – gives you visibility into what you’re paying for, rather than a maintenance plan that operates silently in the background with no record of activity. It’s the same principle that should apply to an SEO retainer once you’re already ranking well and deciding what continued investment is actually buying you, covered in Should You Keep Paying for SEO Once You’re Ranking? Reporting like this is a standard part of our own ongoing maintenance service.

What a Thin Plan Tends to Leave Out

The most common gaps we see in cheaper or bundled maintenance offerings are: no staging environment for testing updates before they go live, backups that exist but have never been tested by actually restoring from them, and no real security monitoring beyond a basic plugin running on default settings. These gaps don’t show up until something goes wrong, which is exactly when they matter most.

What to Ask Before Signing Up for Any Maintenance Plan

Ask specifically whether updates are tested before going live, where backups are stored and how often they’re verified, what security monitoring actually covers, and what the reporting looks like. If the answers are vague, or the plan is priced so low it seems unlikely to cover genuine testing and verification, that’s worth treating as a signal the plan is thinner than it appears.

If you’d like to see exactly what our own maintenance plan covers, and how it’s priced against what’s described above, ask us directly – we’re happy to walk through it line by line rather than leave it as a generic feature list.