What a website maintenance plan should include

Why maintenance is a service, not a favour

A website is software running on infrastructure connected to the public internet at all times. Its platform, its components and the environment around it change continually, and a website that is not maintained deteriorates in ways that are invisible until they are costly: an expired certificate that turns visitors away, a contact form that has silently stopped delivering, a security update never applied, a backup that was never tested. A maintenance plan exists to prevent these failures through routine, and to make a named party responsible for the website's continued operation.

The phrase covers a wide range of offerings, from a monthly plugin update performed by a freelancer to a fully managed service with monitoring, reporting and a defined response time. The purpose of this article is to set out what a responsible plan includes, so that a business can assess what it is being offered.

Managed hosting

The plan should include the hosting environment itself, operated by the provider rather than delegated to a third party the client must manage. Managed hosting means the provider is responsible for the server or platform configuration, its security patches, its capacity and its performance. Where hosting is excluded from a plan, responsibility for the most fundamental layer of the website remains undefined, and incidents at that layer fall between the parties.

Monitoring

Three things should be monitored continuously: uptime, so that an outage is known to the provider before it is reported by a customer; the SSL certificate and domain registration, both of which expire on schedules that are easily overlooked; and security, meaning the platform's known vulnerabilities and any unexpected change to the site's files. The frequency of monitoring should be stated: daily checks are adequate for a presentation website; a site that generates enquiries or revenue warrants continuous monitoring.

Backups

A backup is only useful if it can be restored. A responsible plan states how often backups are taken, where they are stored, how long they are retained, and how restoration is verified. Weekly backups are sufficient for a site whose content changes rarely; daily backups for a site that changes regularly; multiple backups per day for an e-commerce or booking platform where an hour of lost transactions is material. The plan should confirm that restoration has been tested, not merely that backups exist.

Updates

Platforms, themes and components release updates continuously, many of which address security vulnerabilities. Updates must be applied promptly, but an update applied without testing can itself break a website. A responsible plan applies updates on a schedule and, for sites that depend on their functionality, tests them in a staging environment before release. The plan should state which approach it takes.

Verification of forms and critical flows

The most common silent failure on a business website is a form that stops delivering. A mail provider changes a policy, a spam filter is adjusted, an integration is updated, and enquiries disappear without any error visible to the business. A maintenance plan should include a periodic check that forms and other critical flows, such as bookings or checkout, complete correctly end to end. For revenue-critical flows, that check should be daily.

Support and response time

A plan should name the channel through which support is requested and the time within which a request will be acknowledged and investigation will begin. This first-response time is distinct from a resolution time, which cannot responsibly be guaranteed for an unknown issue. Plans typically include an allocation of hours each month for routine changes such as text and image updates, minor fixes and tracking adjustments; the plan should state what the allocation covers and what falls outside it.

Reporting

A monthly report is the evidence that the plan is being delivered. It should cover uptime, backups taken and verified, updates applied, security events, performance measurements and the work completed under the included hours, and it should be written for the person responsible for the business rather than for a technical specialist. A plan without reporting asks the client to take its delivery on trust.

Terms worth reading

Before committing to a plan, a business should confirm the minimum term, the notice period, whether unused hours carry over, how work outside the plan is charged, and, most importantly, what happens on departure. The website, its source code, its content and its accounts should remain the property of the business, and the plan should make clear that they can be transferred without obstruction.

A checklist

In summary, a responsible plan states in writing: who operates the hosting; what is monitored and how often; how frequently backups are taken, where they are kept and whether restoration has been tested; how updates are applied and whether they are tested first; how forms and critical flows are verified; the channel and first-response time for support; what the included hours cover; what the monthly report contains; the minimum term and notice period; and what is transferred on departure. A plan that cannot answer these questions is not a maintenance plan but an intention.

Selecting the right level

The appropriate level of maintenance follows from the role the website plays. A presentation website that exists to be found and to provide contact details needs a modest plan with reliable basics. A website that generates enquiries needs closer monitoring and faster response, because a failure has a direct cost. A website central to operations, or an e-commerce platform, needs continuous monitoring, staged updates and daily verification. Our own Website Care plans are structured along exactly these lines.