What should a website maintenance plan include?

A good website maintenance plan covers five things: software updates, security, backups, uptime monitoring, and regular checks that your contact forms and booking tools still work. It should also give you a short report so you know what was done. If a plan doesn’t test the ways customers reach you, it’s missing the part that matters most to your revenue.

Below is a plain checklist you can use to compare plans, or to run maintenance yourself.

Why maintenance matters

Most small business websites are built, launched and then left alone. That works for a while. Then a plugin goes out of date, an update breaks the contact form, or the site slows down on phones. Nobody notices until a customer mentions it.

The cost isn’t the fix. It’s the calls and form fills you lost while the problem sat there. A website that’s down on a Saturday is a closed shop with the lights still on.

The checklist

1. Software updates

Your website runs on software: the platform itself (like WordPress), plus themes and plugins. Each gets updates, many of them for security.

A good plan should:

• Apply updates on a regular schedule
• Test the site after updates, especially forms, checkout and booking
• Roll back an update if it breaks something

The testing is the part people skip. Updating without checking is how contact forms quietly stop working.

2. Security monitoring

Small business sites get attacked because they’re easy targets, not because anyone is after you personally. Automated bots look for old software and weak passwords.

Look for:

• Malware scanning
• Login protection, like limiting failed attempts and two-factor login
• Alerts when files change unexpectedly
• A clear answer to “what happens if we get hacked?”

That last one matters. The answer should be: they clean the site, restore a safe backup, and close the gap that let it happen, as part of the plan.

3. Backups

Backups are your safety net. Ask three questions:

• How often? Daily is common for sites that change often. Weekly can be fine for simple sites.
• Where are they stored? Backups should live somewhere other than your web server.
• Have they been tested? A backup you can’t restore isn’t a backup.

4. Uptime monitoring

Uptime monitoring checks that your site is online, usually every few minutes, around the clock. If it goes down, someone gets an alert.

This is cheap and easy, and it means you hear about problems from your provider, not your customers.

5. Testing the ways customers reach you

This is the most important item and the one most plans leave out.

Once a month, someone should:

• Submit your contact form and confirm the email arrives
• Tap your phone number on a phone and check it dials
• Make a test booking, if you take bookings online
• Check any chat widget still connects to a person

If any of these break, you’re losing leads without knowing it.

6. Speed and health checks

Slow sites lose visitors, especially on phones. A plan should include regular checks of:

• Page speed on mobile
• Broken links
• SSL certificate (the padlock in the browser)
• Errors that search engines report, through Google Search Console

7. A short monthly report

You should get a short, plain summary each month: what was updated, what was fixed, whether anything went wrong, and what they recommend next. If you can’t read it in five minutes, it’s too long.

Maintenance by platform

The checklist is the same everywhere, but the work differs by platform:

Platform	Software updates	What still needs checking
WordPress	You or your provider apply them	Everything on this list, especially plugins and forms
Shopify	Handled by Shopify	Apps, checkout, product pages, speed
Squarespace, Wix, GoDaddy	Handled by the platform	Forms, bookings, connected tools, content, speed
Webflow	Handled by Webflow	Forms, integrations, content, speed
Custom build	Your developer	Everything, plus hosting and backups

Hosted builders do more for you, so their plans are usually lighter. But the most important check, whether customers can still reach you, never goes away.

What a plan usually doesn’t include

Be clear on this before you sign, so there are no surprise bills:

• New pages or redesigns
• Writing new content
• Marketing work like ads or SEO campaigns
• Big new features

Some plans include a set amount of small content changes each month. Ask what counts as “small.”

Questions to ask before you sign

1. Which platforms do you maintain? Make sure yours is on the list.
2. What happens if the site is hacked? Is the cleanup included?
3. How do you test after updates? Listen for forms, checkout and booking.
4. Where are backups stored, and how often?
5. Who owns the accounts? Your domain, hosting and website logins should be in your name.
6. What does the report look like? Ask to see a sample.
7. How fast do you respond to urgent problems? Get it in writing.

Doing it yourself

If you have someone on your team with a couple of hours a month, you can run this checklist yourself. Put it in the calendar on the same day each month. Keep a simple log of what was done.

The risk is that it slips when the business gets busy, and that’s usually when something breaks. If it keeps slipping, that’s the sign to hand it off.

What it costs

Maintenance is usually a fixed monthly fee. The price depends on the platform, how big the site is, and how much improvement work you want included. A simple brochure site costs less to look after than an online store with bookings and payments.

The better way to think about it: compare the monthly cost with one week of lost leads, or one emergency repair bill. For most businesses, the plan is cheaper.

The short version

A maintenance plan should keep your site updated, secure, backed up and online, and it should prove every month that customers can still reach you. Anything less is paying for software updates and hoping for the best.