Website Maintenance Services: What a Plan Should Include

Updated September 2026 · Written and maintained by the Progression Agency strategy team

Website maintenance is bought on price and judged on a bad day, which is why most plans disappoint. The visible items — updates, backups, uptime monitoring — are similar across every provider. What differs is what happens when the site is actually compromised, when a backup has to be restored, or when an update breaks a page: whether that is included, billed separately, or outside the scope entirely. This page sets out what a plan should contain, what to ask before signing, and how to check the answers.

A marketing plan for a construction business

What the plan has to account for that a consumer plan does not.

A marketing plan for construction has to be built around procurement cycles and prequalification rather than around campaigns. For commercial work, the buyer is a developer, general contractor or facilities director; the decision runs through a bid process; and the marketing that matters is being on the invited list, which is won through relationships, trade press presence and demonstrable relevant projects.

Construction marketing plans that work therefore allocate most of the effort to three things: a project portfolio documented properly with photography, scope and outcomes; presence in the trade publications and associations the buyers actually read; and a prequalification pack that is current. Advertising has a role for residential and for recruitment, and almost none for commercial bid work.

The one channel that consistently underperforms expectations here is paid search, because the searches happen at the specification stage rather than the buying stage.

What do website maintenance services actually cover?

Software updates, backups, uptime and security monitoring, small content changes, performance checks and platform version management. Every provider lists roughly that, which is why the list does not help you choose.

The differences appear on a bad day. Two plans with identical inclusions can diverge completely on whether malware cleanup is covered, whether a restore is included or billed as an incident, and whether an update that breaks a page is fixed at no charge or quoted as new work.

Updates are the routine core

Content platforms, themes and plugins release updates constantly, and outdated software is the most common route into a compromised site. Applying them is genuinely the base of the service, and doing it safely is what separates providers.

Broken link repair and small fixes

Links rot as other sites move and delete pages, and forms stop working silently after updates or plugin changes. A monthly check for both is inexpensive, rarely done, and catches the kind of failure nobody reports because nobody notices it themselves.

What maintenance is not

It is not development, not design, not content, and not marketing. A plan that appears to include all four for a small monthly fee has defined those words very narrowly, and the boundary is where the disputes happen.

Why do updates need to be tested on staging first?

Because an update can break a live page, and applying updates directly to production means discovering that in front of customers rather than on a copy.

A staging site is a duplicate where updates are applied and checked before anything touches the live one. It is the single clearest difference between a maintenance service and an automated updater, and a large share of cheap plans do not have one.

Ask the question directly

‘Do you apply updates on a staging copy first, and where does that staging site live?’ A provider with a real process answers immediately. One that updates production directly will usually say the updates are ‘monitored’, which is not the same thing.

Check the site after updating, not just that the update applied

An update can succeed technically and break a layout, a form or a checkout step. The check that matters is whether the pages people actually use still work, and that means opening them rather than reading a success message.

What should a plan include, and what is usually missing?

Included in almost all: updates, backups, monitoring. Frequently missing: staging, tested restores, malware cleanup, out-of-hours response and a defined change allowance.

The second list is where the money actually is. Those items cost the provider real time when they happen, which is exactly why cheap plans exclude them, and why the exclusion is rarely prominent.

An untested backup is a belief, not a backup

Backups fail silently: partial captures, missing databases, corrupted archives, retention shorter than the problem. The only way to know one works is to restore it, and the question to ask a provider is when they last actually did that — not whether they take backups.

Malware cleanup is the expensive moment

A compromised site needs removal, verification, hardening and frequently reindexing after being flagged. Plans that exclude it present the bill at the point you have least leverage and most urgency, which is worth establishing while you still have both.

Define the change allowance in hours or tasks

‘Small changes included’ is the vaguest term in this category and the one that sours relationships. A stated number — two hours a month, or four tasks — tells both sides when a request becomes a quoted project, before anybody is annoyed.

What does website maintenance cost?

Commonly thirty to eighty dollars a month for automated basic plans, one hundred to four hundred for a standard managed plan, and four hundred to fifteen hundred where the site is complex or business-critical.

The fifth row deserves checking before buying anything. Managed hosting increasingly includes backups, core updates and basic security, which means a cheap external plan may be duplicating what you already pay for. Reading your hosting plan takes ten minutes.

What the price actually reflects

Response time and coverage on a bad day, more than the checklist. Two providers doing identical monthly work can differ fourfold in price because one answers within an hour at midnight and covers a compromise, and the other replies on Tuesday and quotes for it.

How do website maintenance packages differ from each other?

Most providers sell three or four website maintenance packages — typically a basic, a standard package and an enterprise package — and the tiers usually differ on response time and coverage rather than on the monthly task list.

Reading two package tables side by side is misleading because the task rows are almost identical. The rows that actually differ are frequency, response commitment, whether staging is included, and how much included change time you get. Those four are worth extracting from any package sheet before comparing prices.

WordPress maintenance is the most common case

Most maintenance plans on the market are WordPress maintenance plans, because the platform runs a large share of business websites and its plugin ecosystem generates the constant update load that makes a plan worth buying. The questions are the same on any platform; the update volume is simply higher here.

Platform-specific things worth asking about

On WordPress: which plugins are licensed to you rather than the agency, whether the PHP version is actively managed, and whether the plan covers the page builder. On hosted platforms such as Shopify or Squarespace, much of the update work is done by the vendor, and a maintenance plan should be priced accordingly rather than charging for work it is not doing.

What are the benefits, honestly stated?

Reduced likelihood of compromise, faster recovery when something breaks, a site that does not degrade quietly, and somebody accountable who is not you.

The last two rows matter because they are what businesses frequently expect a maintenance plan to fix. A perfectly maintained site with stale content and no inquiries is being maintained correctly and failing commercially, and no maintenance tier addresses that.

Accountability is a real part of the value

Beyond the technical work, a plan means somebody other than you is responsible when the site is down at nine on a Monday. For a business without technical staff that is frequently the largest part of what is being bought, and it is legitimate.

What can you do yourself for nothing?

Enable automatic core updates, use your host’s backups, add free uptime monitoring, run a monthly link check, and keep a record of who has access.

For a simple site with nothing transactional, that combination covers a meaningful share of what a cheap plan provides. The honest recommendation for a small brochure site with a technical owner is frequently to do this and skip the subscription.

Where doing it yourself stops working

When the site takes payments or bookings, when downtime costs money, when nobody internally will notice a problem, or when an update breaking something would take you a day to diagnose. At that point the subscription is buying response capability rather than tasks.

When does a site need modernizing rather than maintaining?

When the underlying build is the problem — an unsupported platform version, a theme no longer developed, or a structure that cannot be made fast. Maintenance keeps a site running; it cannot change what the site is.

There is a point at which maintaining an old build costs more than replacing it and delivers less. The signals are consistent: updates that break things repeatedly, a theme or framework whose developer has stopped shipping, an unsupported platform version, and performance that cannot be improved without structural change.

The last row again separates the two things people conflate. A modernized site can look current and still fail to generate inquiries, and rebuilding for that reason without changing what the pages say tends to produce an expensive disappointment.

Improved efficiency is a real maintenance benefit

Sites accumulate: unused plugins, orphaned scripts, oversized images, database tables from software removed two years ago. Clearing that produces measurably faster pages and a smaller attack surface, and it is one of the few improvements a maintenance plan can genuinely deliver month to month.

Enhanced security comes from removal as much as addition

Most hardening is subtraction — fewer plugins, fewer admin accounts, fewer exposed endpoints, fewer things running that nobody uses. Security products are frequently sold as additions, but the largest reduction in risk on an ordinary business site usually comes from deleting things.

Does maintenance improve conversion?

Indirectly and modestly. A faster site and working forms remove friction that was losing inquiries, and a form that has been silently failing is a genuine conversion problem a maintenance check catches. Beyond that, increased conversion comes from what the page says and offers, which is not maintenance work.

What should the working relationship look like?

Transparent communication about what was done and what was not, a stated approach rather than a task list, and somebody who understands the business well enough to flag what matters.

This is where most maintenance relationships actually fail. The technical work is largely commoditised; what differs is whether you hear about a problem before it becomes an outage, and whether the person on the other end knows that the booking form is the thing that must never break.

Transparency means naming what was skipped

A report saying everything is fine every month for a year is not transparency, it is automation. Useful reporting names what was deferred and why — an update held back because it breaks a plugin, a recommendation not acted on because it needs budget.

A results-driven approach means agreed priorities

The phrase is used loosely, but it has a usable meaning here: agree at the start what the site must never do — go down during business hours, break checkout, lose form submissions — and let that ordering decide what gets attention. Without it, everything is equally urgent and nothing is prioritized.

Experience shows in what a provider refuses to do

An experienced provider will decline to apply an update they know breaks a component, will say when a request is a project rather than a change, and will tell you when your host already covers what you are asking them to bill for. Willingness to say no is a reasonable proxy for competence.

How do you judge a provider before signing?

By what they exclude, how they answer the staging and restore questions, and what their response commitment actually says.

1. Do you apply updates on a staging copy before production, and where does it live?
2. When did you last actually restore a backup for a client, and how long did it take?
3. Is malware cleanup included, or billed separately?
4. What is your response time for a site being down, and is that different out of hours?
5. What exactly counts as an included small change, in hours or tasks?
6. Who holds hosting, domain and platform access — us or you?
7. What is explicitly excluded from the plan?
8. What happens to backups and access if we cancel?

The seventh question is the most efficient one on the list. A provider who can immediately name what is excluded has a clearly defined service; one who says ‘nothing really’ has either not thought about it or is describing a plan whose boundaries will be discovered during a dispute.

Access should be yours, with them granted

Hosting, domain registration and platform administration should sit in your accounts with the provider given access, not the reverse. Recovering a domain or a hosting account from a departed supplier is slow, occasionally impossible, and entirely avoidable.

Ask what happens on cancellation

Backups, access, any licenses purchased on your behalf and documentation should transfer on a stated date. Asking at the start costs nothing; asking at the end is a negotiation you are conducting from a weak position.

Does the provider need to be local?

For maintenance, no. The work is remote by nature, and the useful criteria are response time, coverage and competence rather than geography.

Local presence helps if you want somebody in the room for planning or training, and it makes no difference to whether an update was tested before it went live. A provider two time zones away who answers within an hour is better than one down the road who replies on Tuesday.

Time zones matter more than distance

What matters is whether somebody is awake and available when your site breaks. For a business whose customers are in one region, a provider with coverage across those hours is worth more than one in the same city with business-hours-only support.

What does a good monthly report look like?

Two paragraphs: what was updated, what was checked, anything that needed attention, and what is recommended next. Not a twenty-page automated export.

Long automated reports are generated because they look substantial and take no effort. A short written note showing somebody actually looked at the site is more informative and takes longer to produce, which is why it is rarer.

Frequently asked questions