Website maintenance plan: what it should include and how to compare offers

What a website maintenance plan is and what it replaces

A website is not a leaflet that stays as printed. It is software that runs on a server, and software has versions, settings and parts written by other people. A website maintenance plan is the agreement that someone looks after those parts on a schedule, instead of the owner remembering to do it when something already looks wrong.

The official WordPress documentation puts the basic rule in one line: you should always update WordPress to the latest version, and the admin screens tell you when a new one is out. That line hides a small job that repeats every few weeks, for the core, for each plugin and for each theme. Multiply it by a site that also needs a copy of its data, a check that it opens and an edit now and then, and you have the content of a plan.

Updates for the core, the plugins and the theme

According to the WordPress documentation, minor and security releases can be applied automatically in the background on most sites, while a major feature release still needs a person to click the update button. That split matters for a plan. Someone has to decide when the major release goes in, look at the site afterwards and say what happens if it breaks.

The WordPress hardening guide adds two points that are easy to skip. Older versions no longer receive security updates, and a plugin you are not using should be deleted from the system, not just switched off. Both are routine tasks, and both are exactly what a busy owner postpones. The cybersecurity guidance of the US agency CISA says the same thing in general terms: enable automatic updates whenever possible and replace software that is no longer supported.

Updates also fail sometimes. The WordPress documentation describes a stuck update that leaves a failed-update message on the site and asks you to delete a file called .maintenance over FTP. A good plan names who handles this and whether a backup is taken before each upgrade.

Backups: what is saved, how often and where the copies live

The WordPress backup guide is clear that a copy of the files is not enough. The database holds the posts, pages and settings, and it is stored separately, so a full backup needs both. The guide suggests backing up the database first, then the files, and keeping the two together as one set, because a restore uses both.

On frequency, the same guide leaves the choice to the owner and gives a rule of thumb: about once a week for a small site with few changes, daily for a site that changes often. It also says to back up before every upgrade or move. If a shop takes orders all day, a weekly copy means losing up to a week of them, and that sentence is worth reading twice before you accept a plan.

Where the copies sit matters as much as how often they are made. The guide recommends keeping several recent backups in different places, for example on the hosting server, in cloud storage and on a local computer, and making a manual backup now and then to confirm that the automatic one works. CISA recommends backups that run automatically and continuously and are protected with encryption and offline copies. A plan that only says backups are included has not yet said anything.

Uptime monitoring and what an outage does to search

Monitoring means a program that requests your pages every few minutes and tells a person when they do not answer. Without it, the owner learns about an outage from a customer, a missed order or a phone call from a friend. The value of the service is not the dashboard but the alert: who receives it, at what hours and what that person does next.

Search engines notice outages too. Google documents that 5xx server errors and 429 responses make its crawlers slow down, that it ignores any content it receives with a 5xx status, and that URLs which keep returning server errors are eventually dropped from the index. Once the server answers normally again, Google gradually raises the crawl rate. A short outage is a nuisance; a long or repeated one has a cost in search that is slow to repair.

Security checks that belong in a plan

The WordPress hardening guide lists habits that a plan can own: strong passwords made with a generator, two-step authentication, no obvious usernames such as admin, and plugins and themes taken only from trusted sources. It also explains why: a hacker who reaches the administrator account can install malicious scripts that put the whole server at risk.

CISA, in its Cyber Essentials guidance, puts multi-factor authentication among its first steps and asks for a tested plan for incidents and recovery. For a small site this becomes a short list of regular jobs. Review who has an account, remove accounts that nobody uses, check that the certificate for the secure connection is valid, and know where the last good backup is. The WordPress documentation notes that HTTPS works once a certificate is installed on the server, so the certificate is part of the server setup that somebody must watch.

No plan can promise that a site will never be attacked, and a seller who promises it is selling a feeling. What a plan can promise is a routine: the parts are current, the accounts are tidy, the copies exist and a person is looking.

Small edits: what counts as maintenance and what is a new project

Most sites need small changes every month: new opening hours, a price, a photo, a corrected phone number, a banner for a sale. These are quick if one person handles them, and slow if every edit becomes a new quote. Many plans therefore include a limited number of small edits, and the limit is the thing to read.

The line between an edit and a project should be written down. Changing a sentence or swapping an image is maintenance. A new page template, a booking system or a redesign of the home page is development and is priced as such. If the plan says small edits without defining small, ask for an example in hours or in requests, and ask how long a request waits in the queue.

How to compare plans: questions that separate a real plan from a price list

Put the offers side by side and ask the same questions of each. What exactly is updated, and is a backup taken before it? Where are the backups stored, and has anyone ever restored one? Who receives the uptime alert, and when is that person reachable? What is excluded: hosting fees, the domain, content writing, recovery after an attack?

Then look at ownership and exit. The hosting, the domain and the administrator accounts should be in your name, and the provider should be given access, not hold the only key. Ask what happens when you cancel: do you get the files, the backups and the passwords back, and how much notice is required?

Last, ask what you will see each month. A short note saying what was updated, what was checked and what was edited costs the provider little and tells you whether the work is real. A plan that is cheap and silent leaves you guessing; a plan that is a little dearer and reports leaves you free to run the business.

What to prepare, and how the Website care plan works

Before you order any plan, gather the facts a provider needs: the address of the site, the platform it runs on, where it is hosted, who holds the domain and the list of people who can log in. Write down what matters most: the contact form, the shop, the booking page. Decide who may approve changes and how you want to hear about problems, by email or by message.

VITON13 Studio offers this as the Website care plan. It covers updates and security, backups, uptime monitoring and small edits each month. Before you pay, the studio sends a short health check of your site, so you can see what it found and judge the work first. The plan is billed monthly and starts from $13/mo, and you cancel with 30 days' notice.

If you would rather do it yourself, the checklist below is a fair start, and the WordPress and CISA pages named in this story are good places to learn. If you would rather hand it over, describe your site and see the free health check before any payment.