A website maintenance plan is an ongoing agreement covering software updates, backups, security checks, performance monitoring, and agreed content or technical support. The right plan depends on what your site does: a brochure site needs less oversight than an ecommerce, membership, lead-generation, or custom-functionality website.
Use this guide to compare scope, match care to business risk, understand pricing drivers, prepare a provider handover, and recognize when maintenance is no longer enough.
What a Website Maintenance Plan Actually Is
A website maintenance plan is scheduled care for an existing website. It keeps the platform, software, content, security controls, backups, and important user journeys in workable condition after launch.
Typical work includes CMS, theme, plugin, framework, or dependency updates; backup checks; security reviews; performance monitoring; form testing; agreed content changes; and issue identification. The exact combination belongs in the service agreement, including its limits, frequency, response expectations, and exclusions.
Maintenance, hosting, support, and development are different
| Service | What it normally covers | Question to ask |
|---|---|---|
| Maintenance | Recurring updates, backups, security checks, performance reviews, testing, and agreed content work. | Which tasks happen on what schedule? |
| Hosting | The server or platform where website files, databases, and related services run. | Who owns the account, and what resources are included? |
| Technical support | Troubleshooting, small fixes, questions, and approved changes. | Are hours, response times, and exclusions documented? |
| Security response | Investigation and recovery after a suspected hack or serious vulnerability. | Is emergency recovery included or billed separately? |
| New development | New features, integrations, portals, redesigns, migrations, or major code changes. | What triggers a separate project estimate? |
A plan can include routine security updates without covering recovery from a compromised site. It can include small text edits without including a new service section, redesigned checkout, or custom integration.
How much should hosting cost?
There is no useful universal hosting price. Cost depends on the platform, server resources, traffic, storage, backups, email, security controls, service level, and whether the provider manages the environment.
Compare hosting separately from maintenance. Ask whether the quote includes backups, restore assistance, SSL management, server updates, email, staging, migrations, monitoring, and technical support. Domain renewals and premium software licenses may sit outside both services.
Planned maintenance can briefly slow a website or cause a short outage. Alberta.ca notes that routine maintenance may involve short outages or slow response times. Planned maintenance windows should be part of the operating agreement.
Match the Plan to Your Website Type and Business Risk
The right maintenance level depends on how often the site changes, how many systems it connects to, how sensitive its data is, and what happens if a form, login, or checkout stops working.
| Website type | Maintenance focus | Increase coverage when |
|---|---|---|
| Brochure or informational | Updates, backups, security, broken links, content corrections, accessibility, and contact forms. | The site publishes frequently or drives enquiries. |
| Lead generation | Forms, phone links, email delivery, analytics events, landing pages, and conversion paths. | Missed enquiries directly affect sales or advertising sends traffic. |
| Ecommerce | Updates, backups, checkout, payments, shipping, transactional email, performance, and order-flow checks. | The store has frequent orders, integrations, or revenue-critical downtime. |
| Membership or portal | Updates, backups, permissions, login, privacy-sensitive workflows, messages, and database health. | Users depend on subscriptions, private content, or complex roles. |
| Custom functionality | Application monitoring, deployments, databases, integrations, security, and documentation. | The site includes dashboards, booking, listings, or internal workflows. |
WordPress versus custom website maintenance
WordPress maintenance usually includes core, theme, plugin, database, backup, compatibility, security, and speed work. WordPress owners should prioritize WordPress maintenance that reflects the site’s actual plugins, customizations, and integrations.
Custom or other CMS websites may require framework updates, application-code deployments, database management, API monitoring, server configuration, and testing of bespoke workflows. A generic plugin-update plan will not cover a custom booking system or member dashboard.
Accessibility belongs in maintenance too. New pages, forms, images, and interface changes can introduce barriers. Alberta.ca describes designing pages to be as accessible as possible for people using screen readers. Accessibility checks should accompany planned content or interface changes.
What to Put in the Plan and What to Exclude
A useful agreement defines deliverables, frequency, limits, ownership, and escalation. Avoid accepting “website updates” or “ongoing support” without a precise explanation.
Illustrative plan levels
The following tiers are comparison examples, not plans or prices offered by Global iTech Systems. A provider should adjust them to the platform, integrations, traffic, and business risk of your website.
| Coverage level | Illustrative coverage | Limits and response expectations | Typical exclusions |
|---|---|---|---|
| Basic care | Monthly software review, scheduled backups, basic security checks, uptime review, and one short report. | Planned work during business hours; content edits limited by hours or requests. | Emergency recovery, major conflicts, redesigns, hosting, and new features. |
| Managed business site | Regular updates, backup verification, staging or rollback process, forms and priority-page testing, performance review, and small content changes. | Defined monthly support allowance and a stated response target for urgent faults. | Malware forensics, extensive copywriting, migrations, premium licenses, and development projects. |
| Revenue-critical site | More frequent monitoring, update testing, checkout or login checks, integration review, recovery planning, and business-facing reporting. | Explicit incident escalation, priority response, recovery responsibilities, and limits for emergency work. | Unapproved architecture changes, third-party outages, new workflows, and work beyond the agreed allowance. |
Use the matrix to compare proposals line by line. A plan with more bullet points is not necessarily stronger if it does not state who performs each task, how results are tested, how long backups are retained, or what happens after the included limit is reached.
Inclusions to look for
- CMS, framework, theme, plugin, or dependency updates.
- Testing of key pages, forms, logins, checkout, and integrations.
- Scheduled website and database backups, with retention and restoration duties stated.
- Security checks, alert handling, and documentation of unresolved risks.
- Performance monitoring and investigation of material slowdowns.
- Agreed content edits with limits on hours, requests, pages, or turnaround.
- Form, lead-delivery, transactional-email, and conversion-path testing.
- Basic SEO and indexability checks where included.
- Accessibility review for planned changes.
- A monthly report showing work, tests, issues, recommendations, and pending decisions.
Exclusions to clarify
- Hosting, server upgrades, domain renewals, and business email.
- Premium plugin, theme, framework, stock-media, or third-party licenses.
- Emergency malware removal, forensic work, or post-compromise restoration.
- Copywriting, photography, translation, and ongoing content production.
- Redesigns, migrations, re-platforming, accessibility remediation, and major SEO work.
- New integrations, custom features, dashboards, portals, and application development.
- Work beyond included hours, requests, pages, or response limits.
Ask how the provider handles a failed update, broken form, urgent outage, and out-of-scope request. The answer should identify the investigator, approval process, additional billing, and documentation.
How Often Should Website Maintenance Happen?
Many business websites benefit from monthly human review, but monthly care is not universal. Ecommerce stores, membership platforms, and high-risk applications may need automated monitoring and more frequent review.
| Frequency | Useful checks |
|---|---|
| Daily or continuous | Uptime, security, backup, error, or transaction alerts where risk warrants it. |
| Weekly | Backup status, security notices, failed jobs, monitoring alerts, and recent changes. |
| Monthly | Routine updates, key forms and links, performance signals, content, analytics anomalies, and reporting. |
| Quarterly | Accessibility, templates, conversion paths, SEO health, restoration readiness, accounts, and integrations. |
| Annually | Domains, licenses, hosting fit, ownership, disaster recovery, privacy workflows, and platform suitability. |
Monthly does not mean every task happens once a month. Backups, alerts, and security monitoring may run continuously. For a fuller routine, compare the website maintenance schedule.
How to Compare Maintenance Providers
Compare the work and risks covered, not the plan name or bullet count. Similar wording can hide major differences in testing, backup retention, response expectations, and exclusions.
DIY, occasional help, or a managed plan?
| Approach | Best fit | Questions to answer first |
|---|---|---|
| DIY maintenance | A simple, low-risk site with an owner who has technical confidence, scheduled time, reliable backups, and a safe testing process. | Can you test updates, restore a backup, troubleshoot conflicts, and monitor forms without delaying business work? |
| Occasional technical help | A stable site with infrequent changes where the owner can handle routine checks and bring in help for defined fixes or upgrades. | Who watches for failures between requests, and how quickly can help arrive during an outage? |
| Recurring managed plan | A lead-generation, ecommerce, membership, or custom site where downtime, failed forms, security issues, or delayed updates carry material business risk. | Does the provider document testing, restoration, response limits, ownership, reporting, and escalation? |
Choose DIY only when you can perform the work consistently, not simply because the site looks small. A five-page site that receives paid traffic or drives high-value enquiries may deserve more oversight than a larger site with little business activity.
- Which platforms, themes, plugins, frameworks, and integrations do you support?
- Are updates tested on staging before production?
- What is backed up, how long is it retained, and who can restore it?
- Are forms, checkout, login, search, booking, and transactional email tested?
- What counts as a content edit, and how many are included?
- What response applies to an outage, failed update, or security alert?
- Is emergency recovery included or separate?
- Who owns hosting, domains, licenses, code, and analytics?
- What does the monthly report show?
- How can you cancel or transfer the site?
What a useful monthly report contains
- Work completed: updates, backups, content, security, performance, and tests.
- Business checks: forms, leads, checkout, login, booking, or other priority journeys.
- Current status: backup results, monitoring findings, errors, and unresolved risks.
- Recommendations: prioritized actions, urgency, and scope.
- Next period: planned work, approvals, renewals, or project items.
“Updates completed” is weaker than “updates completed, contact form tested, backup verified, and one outdated integration flagged.” The second connects technical work with business purpose.
Understand Website Maintenance Pricing
Website maintenance cost is shaped by scope. A simple site with few dependencies differs from a store with payment, shipping, inventory, email, analytics, and advertising integrations.
- Platform and size: CMS, custom code, pages, products, users, languages, and databases.
- Functionality: forms, payments, accounts, bookings, portals, search, and integrations.
- Content volume: edits, uploads, products, and landing pages.
- Business risk: the cost of missed leads, failed transactions, or downtime.
- Response expectations: planned support versus urgent or outside-hours response.
- Hosting and licenses: server resources, domains, email, and premium software.
- Starting condition: outdated or undocumented sites may need an initial audit or remediation.
Compare quotes with columns for task, frequency, included limit, testing method, report evidence, owner, exclusion, and additional-work rate. Record hosting, domains, licenses, emergency work, tax, and cancellation terms separately.
Recurring plans suit repeated work and predictable ownership. Hourly or project support may suit an occasional edit, one-time audit, or defined upgrade. A low monthly fee is not a bargain if essential tasks remain outside scope.
Prepare a Website Handover and Onboarding
A provider cannot maintain what it cannot access, understand, back up, or restore. Gather:
- Hosting, server, control-panel, deployment, domain, DNS, SSL, CDN, and email access.
- CMS administrator accounts and active-user list.
- Code repository, build instructions, deployment process, and environment details.
- Theme, plugin, framework, and premium-license information.
- Recent full backups and storage location.
- Analytics, Search Console, advertising, forms, payments, booking, and integration access.
- Staging environment or safe testing process.
- Known defects, incidents, campaigns, and priority pages.
- Ownership records for domains, hosting, code, content, licenses, and data.
Use separate accounts and least-privilege access where practical. The incoming provider should complete an initial health review before routine maintenance begins, checking outdated software, missing backups, broken forms, unsupported code, integrations, performance, accessibility, and recovery gaps.
When a Maintenance Plan Is Not Enough
| Symptom | Next action |
|---|---|
| Updates repeatedly fail. | Audit dependencies. Cleanup, upgrade, rebuild, or migration may be safer. |
| The site is outdated or difficult to navigate. | Plan a redesign covering content, journeys, accessibility, SEO, and migration. |
| Hosting or architecture causes persistent slowness. | Investigate hosting, code, database, media, and third-party bottlenecks. |
| The site may be hacked. | Use incident response for containment and recovery. |
| A payment, booking, form, or integration needs a new capability. | Scope development separately, including testing and deployment. |
| The site cannot support a new business model. | Evaluate a platform change, custom development, or web application. |
For a suspected compromise, a practical incident workflow is: detect and record the symptoms, restrict affected access, contain the affected site or feature, validate which backups are clean, restore to a controlled environment, test priority journeys, communicate the current status, and then remediate the entry point. Change exposed credentials, update vulnerable software, review access logs, and document what happened before returning normal operations.
Maintenance protects an existing system. It does not replace redesign, migration, security recovery, hosting changes, or new development. Related reading: Security system maintenance.
Choose a Partner That Can Support the Next Stage
WordPress owners should look for experience with core, themes, plugins, backups, security, and performance. Businesses with portals, dashboards, booking, lead capture, or custom workflows should also assess custom development capability.
Global iTech Systems provides WordPress development and a custom-coded website offering with capabilities listed for lead-capture pages, appointment booking, member portals, and dashboards. If you need an assessment, a new Calgary website, or a major upgrade, compare WordPress Website Design with the custom-coded website offering.
Frequently Asked Questions
Does a website need monthly maintenance?
Many business websites benefit from monthly human review, especially those using WordPress, forms, integrations, or frequent content changes. Automated backups, uptime checks, and security alerts may run more often.
How much should I pay someone to host my website?
There is no responsible universal figure. Hosting depends on platform, resources, traffic, backups, email, security, staging, support, and management. Request separate hosting and maintenance breakdowns.
Do WordPress websites need different maintenance?
Yes. WordPress requires attention to core, themes, plugins, databases, compatibility, backups, security, and speed. Custom sites may require framework updates, deployments, APIs, servers, and bespoke workflow testing.
What happens if an update breaks the site?
The provider should use backups and rollback procedures, test important functions, document the issue, and explain whether the fix is included. Ask about staging, retention, restoration, and conflict handling.
When should I choose redesign or development?
Choose a separate project for structural problems, repeated update failures, architecture-related performance issues, outdated journeys, compromise, or missing business capabilities.
What are the seven website-creation steps?
A practical sequence is planning, audience and requirements research, information architecture and content, design, development, testing, and launch. Post-launch maintenance keeps the site updated, secure, usable, measurable, and aligned with business needs.