A website is not a poster you print once. It is software running on a server, connected to plugins, themes, forms, payment tools and the wider internet, and every one of those parts keeps changing. Website maintenance is the routine work that keeps all of it safe, fast and working while you get on with your business.
Below is a plain-English checklist of what a good maintenance plan covers, what it usually does not, and how to tell what you are actually getting.
1. Software updates
Whether your site runs on WordPress, WooCommerce, Laravel or something custom, the software underneath is updated by its makers to fix bugs, close security holes and stay compatible with new browsers and PHP versions. Maintenance means applying those updates on a schedule and, just as important, checking the site afterwards, because an update can break a layout, a checkout or a form.
A careful process looks like this: take a backup, apply the updates (testing on a copy first for busy sites), check the key pages and forms, and fix anything that changed.
2. Security monitoring and hardening
Most hacked websites are not targeted personally. Automated tools scan the internet for known weaknesses, such as an outdated plugin or a weak admin password, and exploit whatever they find. Good maintenance closes those doors before they are found:
- a firewall that blocks known attack patterns and bad bots
- regular malware scans of files and the database
- strong, unique admin logins, with two-factor authentication where possible
- removal of old admin accounts and unused plugins
- an SSL certificate that renews on time
3. Backups, and proof they can be restored
A backup you have never restored is a hope, not a plan. Ask where backups are kept (they should live away from your web server, so a server failure or a hack cannot take them too), how often they run and how long they are kept. The step most sites skip is the test restore: proving, on a regular basis, that a backup can actually bring the site back.
4. Uptime monitoring
If your site goes down at 2 a.m., someone should find out before your customers do. Uptime monitoring checks the site every few minutes and alerts a person the moment it stops responding. What matters is what happens next: who is told, how fast they respond, and whether the problem is fixed and logged.
5. Speed and performance checks
Slow pages lose visitors and tend to rank worse. Routine work includes checking the speed of your key pages, cleaning up the database, compressing images and looking at Core Web Vitals, Google's measure of how a page feels to use.
6. Broken links, forms and key pages
Links rot, forms stop sending email and checkouts fail quietly. A monthly check of your important pages, contact forms, buttons and links catches the small problems that cost you enquiries without ever raising an alarm.
7. Search and tracking basics
Basic technical SEO health belongs in maintenance: your sitemap still works, the pages you want found are indexable, Search Console reports no new errors and your analytics tags still fire. It is not the same as an SEO campaign, but it stops silent damage.
8. A report you can read
You should not have to take maintenance on trust. A useful monthly report says what was done, what was found and blocked, how the site performed and what needs your decision, written for a business owner rather than a developer.
9. Time for the changes you ask for
Every site needs small edits: a new team member, updated opening hours, a new product page, a banner for a sale. Many plans include a pool of hands-on hours each month for these requests, so you have someone to ask without opening a new project every time.
What maintenance usually does not include
Redesigns, new features, custom development, content writing, paid advertising and full SEO or accessibility remediation are normally separate projects. A good provider tells you this up front and quotes such work before starting it.
How the pieces fit together
| Piece | What it prevents | What you notice when it is missing |
|---|---|---|
| Updates | Known weaknesses staying open | A hack, or a site that breaks on the next big update |
| Security | Malware and bad bots getting in | Browser warnings, redirects, spam pages |
| Backups | Permanent loss after any failure | A bad day that turns into a lost week |
| Monitoring | Problems that run unnoticed | A customer tells you the site is down |
| Speed checks | Pages slowly getting heavier | Visitors leaving before the page loads |
| Reports | Not knowing what was done | No record when something goes wrong |
| Hands-on hours | Small changes waiting for a quote | Out-of-date prices, hours and offers |
What it looks like by type of site
- A brochure site needs the basics done steadily and a few small edits.
- A content site adds regular speed checks and room for frequent posts.
- A store adds careful updates, a tested checkout and daily backups.
- A booking or membership site adds regular tests of the forms and logins it depends on.
A sample month
Week one: updates are applied and the site is checked. Week two: you send a handful of changes and they are done. Week three: the security scan, uptime and backup reports are reviewed. Week four: a restore is tested and the monthly report arrives, listing everything that was done. Most of it happens without you, and you can read it in ten minutes.
Five questions to ask any provider
- Where are my backups stored, and when did you last test a restore?
- Who is alerted if my site goes down, and how quickly do they respond?
- Who has access to my site, and how are logins shared and stored?
- Do I get a report every month, and can I see a sample?
- What happens if I need more work than my plan includes, and what happens if I cancel?
Not sure what you are covered for today?
Our free coverage check takes two minutes and shows which of these basics are covered on your site and which gap to fix first. If you would rather have someone handle all of it, the WebXSentry plans start at $99 a month, month to month, with a 30-day money-back guarantee.
