Short answer: Monthly website maintenance normally covers software and security updates, backups that are tested, uptime monitoring, bug fixes, small content changes and a short report. It does not normally cover new features, a redesign, new copy, marketing, or hosting and licence fees. Anything bigger than a small change should get its own quote.
"Maintenance" is a word that fits on an invoice very easily and tells you very little. One agreement means somebody clicks "update" once a month. Another means somebody is watching the site, fixing what breaks and answering when you write. Both go by the same name, and the difference only shows up on the day something goes wrong.
This article goes through what a monthly agreement normally covers, what it normally doesn't, and how to tell which kind you're being offered.
What does monthly website maintenance include?
Updates
A website is built on other people's software: a content management system, plugins or packages, the language it runs on, the server underneath. All of it gets new versions, and many of those versions fix security holes. CISA, the US cybersecurity agency, puts the reason plainly: criminals look for flaws in outdated software, and updates are how the flaws get closed.
Updating is the easy part. The work is checking that the site still behaves afterwards. WordPress's own documentation tells you to back up before you update, check that your plugins and themes are compatible with the new version, and visit the site afterwards to make sure everything works. A maintenance agreement is, in large part, somebody doing that every time, including the times it's inconvenient.
Backups you can restore
Most hosting includes some form of backup. Fewer people have tried restoring from one. A backup that has never been restored is a hope. Maintenance should include regular backups kept somewhere other than the server itself, and a restore test now and then to prove they work.
Monitoring
Something should be checking that the site is up, that the security certificate hasn't expired, that forms still deliver and, on a shop, that checkout still completes. The alternative is hearing about it from a customer, or not hearing about it at all.
Fixes
Things break without anyone touching them. A browser update changes how something renders. A payment provider changes its interface. A plugin author abandons a plugin. Fixing these so the site keeps doing what it already did is maintenance.
Small changes
Swapping a photo, changing opening hours, adding a team member, publishing a page built from an existing template. Most agreements include some amount of this each month. The amount should be written down, in hours or in a description of what counts as small.
A report
A short note each month: what was updated, what was fixed, what was noticed and what's coming. It doesn't need to be long. It needs to exist, because otherwise you can't tell maintenance from nothing happening.
What does maintenance not include?
These are reasonable things to want. They just aren't maintenance, and an agreement that claims to include them all for a flat monthly fee is either expensive or optimistic.
- New features. A booking system, a customer area, a new integration. That is a project with its own scope.
- A redesign. New layout, new look, new structure.
- New content. Writing articles, taking photos, translating pages. Putting finished content on the site is usually included. Creating it usually isn't.
- Marketing and ongoing SEO. Campaigns, link building, regular new content. Keeping the technical basics healthy is maintenance. Growing traffic is a different job.
- Hosting, domains and licences. These are third-party costs. Some agreements pass them through, some leave them with you. Either way the accounts should be in your name.
- Recovery from something outside the agreement. If someone else edits the code and breaks it, or the site was already compromised before the agreement started, cleaning up is usually quoted separately.
- Round-the-clock cover. Unless it says so. Most agreements for small businesses work in business hours with a stated response time.
How fast should someone respond?
It depends on what the site does for you. A brochure site being down for an afternoon is annoying. A shop being down for an afternoon is lost orders. The agreement should say how you report a problem, what counts as urgent, how quickly someone replies and when they work. If none of that is written down, the honest answer is "when we get to it".
Notice the difference between a response time and a fix time. A promise to reply within a few hours is realistic. A promise to fix anything within a few hours is not, because nobody knows what the problem is yet.
Do you need a maintenance agreement at all?
Not always.
A small static site with no content management system, no plugins and no logins has very little to update. A yearly check may be enough. If you have a developer on staff who really does the updates, you already have maintenance. And some hosted platforms update themselves, which removes part of the work, though not the checking, the fixes or the small changes.
You probably do need one if the site takes payments or stores customer data, if it runs on a system with plugins or packages that need regular updates, if nobody on your team knows how it works, or if it being down for a day would cost you real money.
Questions to ask before you sign
- What exactly is updated, and how often?
- Are updates tested somewhere before they go on the live site?
- Where are the backups kept, and when was one last restored?
- What is monitored, and who gets the alert?
- How many hours or small changes are included each month, and do unused ones carry over?
- How do I report a problem, and how quickly will someone reply?
- What counts as a bigger change, and how is it quoted?
- Whose name are the hosting, domain and other accounts in?
- How do I leave, and what do I get when I do?
The last one matters more than it looks. A good agreement is easy to end: you get the logins, the documentation and a list of what's running where. If leaving is made hard, that tells you something about the rest.
Sources
- WordPress.org documentation, Updating WordPress, on backing up first, checking plugin and theme compatibility, and checking the site after an update.
- CISA, Update software, on why updates matter for security.
Our support agreements are written the way this article describes. What's covered, how you report a problem and how quickly we respond are agreed in writing, and bigger changes get their own quote so the monthly agreement doesn't quietly grow. The support and maintenance page has the details, or you can book a free call and tell us what you have running.