What Does Website Maintenance Actually Include?

Website maintenance covers updates, backups, security, uptime monitoring, performance checks and a defined amount of content editing. For a small business site that is typically £40–£150 a month; for e-commerce or anything with real functionality, £150–£500.

The question behind the question is usually "is this worth it, or is it a subscription for doing nothing?" Fair question. Here is what actually happens, and what happens when it does not.

What a maintenance plan should include

Core, theme and plugin updates. WordPress releases security patches regularly. Plugins update constantly. Applying them is straightforward; applying them safely is the actual work, because updates occasionally break things. That means updating on a staging copy, checking the site still works, then pushing live — not clicking "update all" on a Friday afternoon and hoping.

Backups, off-site, tested. Daily for e-commerce, weekly for a brochure site. Stored somewhere other than the same server, because a backup on the machine that failed is not a backup. And restored occasionally to prove they work — an untested backup is a guess.

Security monitoring. Malware scanning, login protection, firewall rules, file integrity checks. Most attacks on small sites are automated and indiscriminate. Nobody targeted you; a script found an out-of-date plugin.

Uptime monitoring. Checks every few minutes and alerts someone. Ideally that someone is not you at 2am.

Performance checks. Core Web Vitals drift as content is added. A quarterly look catches the slow decay before it becomes a rebuild.

Broken link and form checks. Forms break silently, and you find out weeks later when you notice the enquiries stopped. This alone justifies a lot of plans.

A content allowance. Usually one to three hours a month for text changes, new pages, image swaps. Use it or lose it, generally.

Someone who answers. Genuinely part of what you are buying: a defined response time when something is wrong, rather than emailing a freelancer and waiting.

What is usually not included

Redesigns. New functionality. SEO campaigns. Content writing beyond simple edits. Recovering from a hack, which is often billed separately and is expensive. Hosting, sometimes bundled and sometimes not — check which.

Read the response time carefully too. "Next business day" and "within four hours" are very different products, and for an e-commerce site the difference is measured in lost orders.

What actually goes wrong without it

Getting hacked. Overwhelmingly through an out-of-date plugin. The usual outcome is not dramatic — no defacement, just spam pages quietly injected into your site, which Google finds and flags. By the time you notice, you have lost rankings, and cleaning it costs £300–£1,500 plus weeks of recovery. Prevention is one plugin update.

Breaking on a PHP upgrade. Hosts upgrade PHP periodically. Sites running abandoned plugins break, sometimes entirely. Fixing it under pressure, on a site nobody has touched in two years, is a bad afternoon.

Silent form failure. A plugin update, a changed mailbox password, an expired API key. The form says "thank you" and the email goes nowhere. We are called about this several times a year and the enquiries lost are unrecoverable.

Slow decay. Nobody notices a site getting 5% slower each quarter until it fails Core Web Vitals and the rankings have already gone.

Is it worth it?

Depends honestly on two things: what the site is worth to you, and whether you will do it yourself.

If your site generates enquiries or sales, maintenance is cheap insurance. One prevented hack or one caught broken form pays for a year.

If your site is a brochure that nobody visits, a £150/month plan is hard to justify. Something minimal — updates and backups — is enough.

If you are technical and disciplined, you can absolutely do this yourself. Updates on staging, off-site backups, a security plugin, an uptime monitor. Perhaps an hour a month. The word doing the work in that sentence is disciplined: almost everyone starts and stops, and the stopping is invisible until it is expensive.

Questions to ask a provider

• Are updates tested on staging first, or applied straight to the live site?
• Where are backups stored, how long are they kept, and when did you last restore one?
• What is your response time, and is that business hours or actual hours?
• How many hours of content changes are included, and do they roll over?
• What happens if the site is hacked — is recovery included or billed?
• Is hosting included?
• Do I get a report, and how often?

That third question separates real plans from automated ones. Anyone can install an update plugin. Answering the phone at 6pm on a Thursday is the service.

The minimum, if you do nothing else

Even with no plan at all: automatic off-site backups, updates applied at least monthly, and a test of your own contact form every quarter. That covers the three failures that account for most of the genuinely expensive problems.

Set a calendar reminder. It is fifteen minutes, four times a year, and it will save you a rebuild.

---

Our care plans cover updates, backups, security and content edits, handled by the team who built the site. See what is included.