A website maintenance plan is a monthly service that keeps a live site secure, backed up, fast and up to date. Somebody else handles the updates, watches for breakage, and fixes small things before they become expensive things.
That is the whole definition. Everything past this paragraph is detail.
Now the part nobody selling maintenance plans wants to say out loud: a lot of people are paying for a plan they do not need. I will tell you how to spot whether you are one of them by the end of this post. I would rather lose the $99 than take it from someone who gets nothing back.
(My accountant disagrees with this business philosophy. My accountant also drives a nicer car than me, so make of that what you will.)
The short version
A maintenance plan covers four jobs: updates, backups, security, and small fixes. Prices for a small business site run $99 to $399 a month. You need one if your site earns money or bookings. You probably do not need one if it is a brochure site you touch twice a year.
What a maintenance plan actually is
Your website is not a statue. It is more like a car that is being driven while you service it.
WordPress, your theme, and every plugin receive updates. Sometimes those updates conflict with each other. Sometimes a plugin is abandoned and becomes a way in for someone with bad intentions. Sometimes your host changes something and your forms quietly stop sending email.
A maintenance plan is someone watching for all of that, on a schedule, without you having to think about it.
Most of the plans you will find online are sold by software companies. That is worth knowing. They are selling you a tool and calling it a service. The tool does not answer the phone when your contact form breaks the day before a launch.
What should actually be in the plan
Here is the checklist I would want if I were buying. If a provider cannot explain what is on their list, that is your answer.
| Task | How often | Why it matters |
|---|---|---|
| Core, theme and plugin updates | Monthly | Closes known security holes and fixes bugs |
| Full site backup, stored off-server | Weekly minimum | The only thing that saves you after a bad update |
| Backup restore tested | Quarterly | An untested backup is a rumour, not a backup |
| Security and malware scanning | Continuous | Catches an infection before Google blacklists you |
| Uptime monitoring | Continuous | You find out the site is down before your customers do |
| Performance check | Monthly | Sites slow down gradually and nobody notices |
| Broken link and form check | Monthly | Silent failures cost enquiries |
| Database cleanup | Monthly | Keeps the site quick and the backups small |
| Content and plugin audit | Quarterly | Removes what you are no longer using |
Nine out of ten "maintenance" plans I have seen stop at the first three rows. Updates, backup, scan, done. That is automated housekeeping, not maintenance.
What happens when the site goes down at 9pm
This is the part that separates a plan from a plugin, and it is the question almost nobody asks before signing up.
Ask any provider this: the site is down, it is Friday night, what actually happens?
There are three honest answers.
"We monitor it and we'll know." That is not an answer. Knowing your site is down is not the same as fixing it.
"Open a ticket and we'll get to it Monday." Perfectly reasonable for a brochure site. Completely useless if your site takes bookings.
"Here's the number, here's the response window, here's who answers." That is a maintenance plan.
Whichever answer you get, get it in writing. And get the response window in hours, not adjectives. "Fast" is not a number. "Under four hours during business hours, next morning outside them" is a number.
One more thing worth doing before you need it. Find out where your site is hosted, and whether you have access to that account. I have taken over sites where the previous developer held the hosting login and the owner had never seen it. When something breaks at that point, you are not waiting for maintenance. You are waiting for a negotiation.
The parts most plans leave out
Three things rarely appear on a maintenance checklist, and all three cause real problems.
Accessibility. If your site has forms, menus and images, it has accessibility requirements. A contrast change or a form rebuild can quietly break keyboard navigation. Nobody notices, because the people who would notice have already left your site. A decent plan checks the basics — alt text, focus states, heading order — after any significant update. If yours does not, ask why.
Compliance. If you collect email addresses in the EU, or take payments at all, your privacy policy and cookie setup need to stay accurate as your site changes. New plugins have a habit of dropping their own cookies without telling you. That is a legal problem, not a technical one, and it does not announce itself.
Staging. Testing an update on a live site means your customers are the test. A proper setup lets an update be applied somewhere private first, checked, then pushed live. Plenty of cheap hosts charge extra for staging, which is why it is rarely included.
None of these are exotic. They are just unglamorous, and unglamorous work is the first thing to get cut from a cheap plan.
The tools doing the actual work
You are not buying tools. You are buying someone who knows which ones to use and checks that they ran. Still, it helps to know what should be running behind the scenes, because it makes vague answers easier to spot.
Uptime monitoring. A service that pings your site every minute from several locations and alerts someone when it stops responding. This is how you find out your site is down before a customer emails you. If a provider cannot name theirs, they do not have one.
Backup. Files and database, stored somewhere that is not your web server. The 3-2-1 principle is the standard: three copies, two different media, one off-site. In practice, one good off-site backup that you have actually restored from beats three you have never tested.
Security scanning. Malware detection and file integrity monitoring. This watches for changed files, which is how most infections announce themselves. A scan that runs weekly is fine. A scan that runs never is why sites get blacklisted.
Performance monitoring. Somewhere that tracks load time over months, not once at launch. Sites slow down gradually as content and plugins accumulate, and gradual problems never trigger an alert.
Staging. A private copy of your site where updates get tested first. This is the difference between "we updated your site" and "we updated your site and checked it still works before you saw it."
Here is the test worth running. Ask your provider what alerted them last month. Every provider who is genuinely monitoring has at least one story — a plugin that broke something, a disk that filled up, a certificate that was about to expire. A provider with no stories is not watching.
(I have plenty of stories. My favourite is the SSL certificate that expired on a Sunday because the auto-renewal had silently stopped working in March. Nobody noticed for four hours. The client noticed in one, which is how I found out. That is what monitoring is for, and also what humility is for.)
How often should you review the plan itself
A maintenance plan is not a gym membership. It should change as your site changes.
Go through it once a year, or whenever something significant shifts. Four questions:
- Is the plan still the right size? If you stopped publishing and your site is now a brochure, you may be overpaying by $200 a month.
- What actually got done last year? Ask for the list. A provider who cannot produce one is not maintaining anything, and a year is plenty of time to find out.
- Has anything been added that nobody uses? SEO reporting on a site with no SEO strategy is a line item, not a service.
- Is the response time still right? A site that now takes bookings needs a faster response than it did when it was a catalogue.
I review every client's plan with them once a year. Roughly a third of the time we reduce it. That is not a great business model and it is the correct one, because the alternative is a customer who eventually notices they have been paying for nothing.
What it costs, honestly
My own plans are $99, $199 and $399 a month. Here is what each one actually gets you.
| Plan | Price | What it covers |
|---|---|---|
| Basic Care | $99/mo | Updates, backups, security monitoring, uptime checks |
| Growth | $199/mo | All of Basic, plus content updates and SEO monitoring |
| Premium | $399/mo | All of Growth, plus unlimited edits and priority support |
Some context on those numbers. A single malware cleanup typically runs $350 to $800, depending on how deep it got and whether Google has already flagged the site. A site that has been blacklisted loses traffic while it is being cleaned, and getting the warning removed takes days.
So the arithmetic is not complicated. One serious incident costs more than a year of Basic Care.
That is not a sales pitch. It is just the maths, and you can do it yourself with a calculator and a bad afternoon.
Doing it yourself is genuinely reasonable
Here is where I talk myself out of money.
If your site is a five-page brochure that you update twice a year, you can maintain it yourself. The tasks are not difficult:
- Turn on automatic backups through your host, and confirm they actually run
- Turn on automatic updates for minor WordPress releases
- Log in once a month and update your plugins
- Check that your contact form still sends email
That is about 20 minutes a month. If you enjoy that sort of thing, do it. Genuinely.
The catch is consistency. Maintenance only works if it happens every month whether or not you feel like it. The failure mode I see most often is not ignorance. It is a busy owner who meant to get to it in March.
When you should not buy a maintenance plan
This is the section I would want to read if I were you.
Do not buy one if any of these are true:
- Your site does not earn anything. A portfolio you update twice a year does not justify $99 a month. Pay someone $250 twice a year instead.
- You are about to rebuild the site anyway. Maintaining a site that is being replaced in two months is paying to polish a doorknob on a house being demolished.
- You cannot get a straight answer on what is included. If the sales page says "peace of mind" and "comprehensive support" but will not list the tasks, walk away.
- The price is under $50 a month. At that price nobody is looking at your site. You are paying for automated plugins you could install yourself in an afternoon.
I have turned down maintenance work for all four reasons. I would rather have a customer who renews for three years than one who works out in month two that they are paying for nothing.
How to choose a provider
Four questions. Ask all of them before you pay anything.
What exactly is included, in a list? Vague answers mean a vague service.
Who does the work? If the answer is "our team" and the team is a ticket queue that routes to whichever contractor is free, you will never speak to the same person twice.
What happens when the site goes down at 9pm on a Friday? The answer should be specific. Not "we monitor it."
What is the notice period? Monthly plans should be monthly. A twelve-month lock-in on a $99 service is a red flag dressed as a discount.
One more thing worth checking. Ask whether they will show you the backups. A provider who can produce a recent backup file on request is a provider who is actually running them.
Frequently asked questions
What is a website maintenance plan? It is a recurring service that keeps a live website secure, backed up, fast and up to date. A provider handles core and plugin updates, backups, security monitoring and small content changes for a monthly fee, so problems get caught before they become outages.
How much should a website maintenance plan cost? For a small business site, expect $99 to $399 per month. My own plans are $99 for basic care, $199 for maintenance plus content and SEO monitoring, and $399 for unlimited edits and priority support. Anything under $50 a month is usually automated backups with nobody watching.
Do I really need a maintenance plan? If your site takes bookings, sells anything, or is how customers find you, yes. If it is a five-page brochure site you update twice a year, a cheaper ad-hoc arrangement is probably better value.
Can I just do website maintenance myself? You can, and for a simple site you should consider it. The problem is consistency, not difficulty. Maintenance only works if it happens every month.
What happens if I never maintain my website? Nothing, for a while. Then a plugin conflict takes the site down on a Saturday, or an outdated plugin gets exploited. The cleanup usually costs more than several years of maintenance.
How long does website maintenance take? For a typical small business site, routine monthly maintenance is under two hours of actual work. That is why it is easy to postpone.
Do you charge extra for content changes? Basic Care covers updates, backups and security but not content edits. Growth and Premium include content work, and Premium has unlimited edits. Extra pages are $75 each.
Where this fits
If you want the full picture on ongoing costs rather than the plan itself, I have written about what website maintenance actually costs, including the monthly and annual figures.
If your site needs building or rebuilding first, that is a different conversation. Start with hiring a WordPress developer or see the full pricing breakdown.
I am based in Lahore and work with clients worldwide, mostly small businesses in the US, UK and Australia. Ten years on WordPress, just over 100 sites built. I answer email myself, which is either reassuring or a warning sign depending on your view of scaling.
Further reading if you want to check my working: WordPress.org on security and Google's guidance on Core Web Vitals.
One last thing. If you take nothing else from this post, take this: find out where your backups go. If the answer is "the same server as the website," you do not have backups. You have a copy of the problem.
Go check. I will wait.