What website maintenance includes (and what it should cost)

Website maintenance is the routine work that keeps a site safe, working and up to date after launch: software updates, tested backups, security and uptime monitoring, renewals, form and link checks, performance reviews and small content changes. How much you need depends on the platform. WordPress needs the most hands-on care, Squarespace and Wix handle the software for you, and static sites built with tools like Next.js need occasional dependency updates. Published care plans we found range from $9 a month for basic automated updates to several hundred dollars a month for plans with unlimited edits and fast response.

Below is what the work includes, how it changes by platform, what published plans charge, and a checklist you can use.

What maintenance includes

Software updates

On WordPress, this means the core software, plugins and themes. On a custom or static site, it means the code packages (dependencies) the site is built on. Updates fix bugs and close security holes, so skipping them is risky. Updating safely means taking a backup first, testing on a staging site when possible, and checking key pages afterward. This is part of patch management.

Backups and restore tests

Backups should run automatically, be stored off the server and keep enough history to roll back past a problem you did not notice right away. The 3-2-1 backup rule is a good standard. Most important: test a restore. Many owners find out their backups were broken on the day they need them. Our post on ransomware and backups for small businesses explains why off-site copies matter.

Security monitoring

This covers malware scans, login protection, a firewall where available, and alerts for suspicious changes. It also means removing old user accounts and plugins you no longer use. See our website security checklist.

Uptime monitoring

An uptime monitor checks your site every few minutes and alerts you when it goes down. Without one, you often learn about an outage from a customer.

SSL and domain renewals

An expired domain or SSL certificate can take your whole site offline. Most hosts and builders renew SSL automatically, but the clock is getting shorter. DigiCert notes that the industry limit for public SSL certificates dropped from 398 days to 200 days on March 15, 2026, and will reach 47 days by 2029. That makes automatic renewal close to required. Check that your domain is set to auto-renew, the card on file is current, and the renewal notices go to an inbox someone reads.

Performance checks

Sites slow down over time as images, plugins and tracking scripts pile up. A quarterly check of Core Web Vitals and page weight catches this early. Our guide to improving website speed covers the tools.

Broken links and forms testing

Forms are where leads come from, and they break quietly when an email setting, spam filter or integration changes. Submit every important form at least monthly and confirm the message arrives. Run a broken link scan at the same time.

Content updates

Hours, staff, prices, photos, service areas and offers go stale. Stale content costs trust and can hurt local search. Many care plans include a set number of small edits each month.

Analytics and Search Console review

Once a month, look at traffic, leads and Google Search Console for indexing errors, security warnings and pages that are losing clicks. This is where you spot problems that are not visible on the page itself.

Accessibility checks

New content can introduce problems like missing alt text, poor color contrast or unlabeled form fields. An automated scan plus a quick keyboard test each quarter helps keep the site usable.

How maintenance differs by platform

WordPress needs the most. It has the most moving parts: core, themes, plugins, PHP versions and the hosting server. Each plugin is software written by a different team, and an out-of-date plugin is a common way sites get hacked. Good managed WordPress hosting handles some of this, like server updates and daily backups, but usually not plugin testing or content. Our WordPress security hardening guide covers the setup side.

Squarespace and Wix handle the software. You do not install updates or manage servers. But you still own your content, SEO settings, forms, connected apps, team logins, domain and billing. A Squarespace or Wix site can still lose leads to a broken form or fall behind in search with outdated pages.

Static and Next.js sites are low-risk but not maintenance-free. There is no database or admin login on the live server to attack, which removes a lot of risk. But the code depends on open-source packages that need updates, hosting accounts need security, and forms usually run through a separate service that needs testing.

DIY vs care plan vs retainer

DIY works if you have a little time each month and follow a checklist. It costs the least in cash and the most in attention. The risk is that updates and restore tests get skipped.

A care plan is a fixed monthly fee for a set list of tasks: updates, backups, monitoring, reports and usually some edit time. It suits most small businesses with a WordPress site.

A retainer buys a block of developer or marketing hours each month. It makes sense when you are always adding pages, running campaigns or building features, on top of routine upkeep.

What published care plans cost

Prices vary a lot, so here are examples of published pricing from three providers' public plan pages as of November 2026. These are WordPress plans; we list them to show the range, not as recommendations.

The pattern is the same across providers. Basic tiers automate updates, backups and monitoring. Middle tiers add edit time, security cleanup and faster support. Top tiers add speed work, ecommerce care, staging tests and faster response. When comparing, look at what happens when something breaks, not just the monthly price. If you are still budgeting the whole project, see how much a website costs.

What to ask a maintenance provider

1. How do you update? Do you test on staging first, and what happens if an update breaks something?
2. Where are backups stored, how long are they kept, and when did you last test a restore?
3. What does "monitoring" include? Uptime only, or malware and file changes too? Who gets the alert?
4. Is hack cleanup included, or billed separately?
5. How many edits are included, and what counts as an edit?
6. What is your response time for an emergency versus a routine request?
7. What reports do I get? Monthly reports should list updates made, backups, uptime and any issues.
8. Who owns the accounts? Your domain, hosting and analytics should be in your name, with the provider added as a user.

Maintenance checklist

Want someone to handle this for you, or a second opinion on what you are paying now? Talk to us and we will tell you what your site actually needs.