What Does Website Maintenance Actually Include?

Website maintenance is one of those phrases that gets used freely in proposals and conversations without anyone being particularly specific about what it means. A developer offers a maintenance package. A business owner accepts it without being entirely sure what they are paying for. A year later, something goes wrong, and it turns out the maintenance did not cover what everyone assumed it did.

This article is about fixing that ambiguity. What website maintenance actually includes, what it does not include unless specifically agreed, what happens to websites that are not maintained, and how to decide whether to handle it yourself or pay someone to do it.

The article focuses primarily on WordPress sites since that is the platform most business websites run on, but the principles apply across platforms.

Why Websites Need Ongoing Maintenance

A website is not like a printed brochure. It exists in a technical environment that changes constantly. The software it runs on is updated. Security vulnerabilities are discovered and patched. Browser rendering engines evolve. Search engine requirements shift. Hosting environments are updated. Each of these changes creates the potential for something on the site to behave differently from how it did when it was built.

A site that is not maintained does not stay the same. It degrades. Slowly at first, then more noticeably. Pages that used to load in two seconds start taking five. Plugins that used to work quietly start throwing errors. A vulnerability that was patched in the current version of a plugin remains open on a site still running the old version. The site looks the same in the browser, but underneath it is accumulating problems that will eventually become visible, expensive, or both.

What Maintenance Actually Covers

Software updates

The most time-critical maintenance task. WordPress core, themes and plugins all receive updates that include security patches, bug fixes and compatibility improvements. On a typical WordPress site, there are updates to apply somewhere on the site most weeks.

Applying updates is not simply clicking the update button and walking away. A responsible maintenance routine involves checking that updates are available, staging them on a test environment where possible for more complex sites, applying them to the live site, and confirming the site is functioning correctly afterwards. Plugins occasionally conflict with each other or with a theme after an update, and catching that quickly is part of the job.

Security monitoring

Active monitoring for signs of compromise, unusual activity, malware or unauthorised changes to files. A security plugin like Wordfence provides automated scanning and alerts, but those alerts need someone to read and respond to them. Security monitoring also includes checking whether the site appears on any Google or third-party blocklists, which can happen after a compromise and which affects both search visibility and visitor trust.

Backups

Automated backups should run on a schedule appropriate to how frequently the site changes. Weekly for a relatively static site, daily for a site that is updated regularly. Backups should be stored off-site, checked periodically to confirm they are completing successfully, and tested by actually performing a restoration at least once a year. A backup that has never been tested is a backup of unknown reliability.

Performance monitoring

Checking that the site continues to load quickly and that Core Web Vitals scores are not degrading over time. New plugins, updated themes, additional content and third-party scripts can all affect performance. A maintenance routine that includes periodic performance checks catches these issues before they become significant enough to affect search rankings or user experience.

Uptime monitoring

Automated checking that the site is accessible. If the site goes down, the business owner should know about it promptly, not hours later when a client mentions they could not reach the site. Free tools like UptimeRobot or Better Uptime check the site every few minutes and send an alert by email or SMS when it becomes unavailable.

Broken link checking

Links to external pages break over time as those pages are moved, deleted or changed. Internal links break when pages are restructured or deleted on the site itself. A maintenance routine should include periodic broken link checking to identify and fix these before visitors or crawlers encounter them. Screaming Frog’s free tier, the W3C Link Checker or a plugin like Broken Link Checker all handle this.

SSL certificate renewal

SSL certificates expire and need to be renewed. Most hosting providers manage this automatically through Let’s Encrypt, but it is worth confirming that automatic renewal is configured and working. A lapsed SSL certificate causes browsers to display a security warning to every visitor, which is damaging to trust and to search visibility.

Content updates

Keeping the content on the site current. Contact details, pricing, team members, service descriptions, portfolio work. This is sometimes included in a maintenance package as a defined number of hours of content changes per month, and sometimes treated as a separate arrangement. It is worth being explicit about whether content updates are included and at what scope.

Database maintenance

Periodic cleaning of the WordPress database to remove accumulated post revisions, spam comments, expired transients and other redundant data. This keeps the database lean and queries fast. Plugins like WP-Optimize handle this automatically on a schedule.

What Maintenance Does Not Always Include

The following things are sometimes assumed to be part of maintenance but are frequently not included in standard packages. Checking explicitly whether they are covered prevents surprises.

• New features or functionality: maintenance covers keeping what exists working, not building new things
• Significant content additions: adding new pages, new case studies or new product listings may be a separate charge beyond a small monthly content allowance
• Design changes: updating the visual appearance of the site falls outside standard maintenance
• SEO work: maintenance may include technical checks relevant to SEO, but active keyword research, content strategy and link building are typically separate
• Third-party integrations: maintaining or troubleshooting integrations with CRMs, booking systems or payment processors may require additional work beyond standard maintenance
• Emergency response: some maintenance packages include a response time commitment for critical issues; others do not

What Happens When Maintenance Is Neglected

The consequences of neglecting website maintenance tend to accumulate quietly until something forces attention. The progression typically looks something like this.

In the first few months without updates, the site continues to function normally. The risks are present but not yet visible. A plugin vulnerability might be sitting unpatched, but it has not been exploited yet.

Over the following months, plugin compatibility issues start to appear. A WordPress update changes something that an outdated plugin has not yet adapted to. A page that used to display correctly starts showing layout problems. A form stops sending submissions. A checkout process breaks. These problems are diagnosable and fixable, but they require developer time that could have been avoided.

At some point, if a security vulnerability in an unpatched plugin is discovered and exploited, the site is compromised. Spam links appear in the footer. Visitors are redirected to other sites. Google adds the site to its blocklist, and organic search traffic drops dramatically. Recovering from a serious security incident on a site with no recent backups is expensive and time-consuming. With good backups in place, it is a few hours of recovery work. Without them, it can mean rebuilding the site from scratch.

Performance degrades throughout this period as the database grows uncleaned, as plugin weight accumulates and as hosting environments age without attention.

DIY Maintenance Versus a Maintenance Provider

Managing maintenance yourself

Entirely feasible for a business owner who is comfortable with the WordPress admin area and disciplined about doing it consistently. The tasks themselves are not technically complex at the basic level. The risk is that in the day-to-day of running a business, maintenance falls down the priority list. A site that was going to be maintained every week ends up being looked at once a quarter, which is long enough for a serious vulnerability to be exploited.

If you manage your own maintenance, a simple recurring calendar reminder to check for and apply updates, confirm backups are running and scan for issues is enough to keep most small sites in good shape.

A maintenance retainer with a developer

The developer who built the site is well-placed to maintain it. However, this is worth agreeing explicitly as a separate arrangement rather than assuming it is included in the original build cost. A maintenance retainer typically covers monthly updates, security monitoring and backups, with an agreed number of hours for minor content changes or small fixes. Expect to pay between fifty and two hundred pounds per month depending on the scope and the developer.

A dedicated maintenance service

Services like WP Buffs, Maintainn and Valet specialise in WordPress maintenance and offer structured monthly plans that cover updates, security, backups and performance monitoring. These are typically well-organised and competitively priced, though they do not know your specific site as well as the developer who built it. Prices range from around thirty to one hundred and fifty pounds per month depending on the tier.

A Monthly Maintenance Checklist

☐  Check for and apply WordPress core updates

☐  Check for and apply theme updates

☐  Check for and apply plugin updates

☐  Confirm automated backups have run successfully

☐  Review security plugin alerts and scan results

☐  Check uptime monitoring logs for any downtime incidents

☐  Run a performance test and compare to previous baseline

☐  Check SSL certificate expiry date

☐  Review site error logs for recurring issues

☐  Check Google Search Console for crawl errors or manual actions

Quarterly Additions

☐  Run a broken link check and fix any identified

☐  Run a database optimisation

☐  Test backup restoration to confirm backups are functional

☐  Review and update any out-of-date content

☐  Review installed plugins and remove any no longer in use

Frequently Asked Questions

How much should website maintenance cost?

For a standard WordPress business site, a professional maintenance service typically costs between fifty and two hundred pounds per month depending on what is included and who provides it. DIY maintenance costs nothing in cash but requires time and discipline. The right answer depends on the value of the site to the business, the technical confidence of the site owner, and how much disruption a security incident or extended downtime would cause.

Can I just update my WordPress site when I remember?

You can, but the risk is that the gaps between updates are when vulnerabilities are most dangerous. A security vulnerability is typically most actively exploited in the days and weeks after it is publicly disclosed, before the majority of site owners have applied the patch. Waiting until you remember means waiting through exactly the highest-risk window. A simple weekly check takes very little time and significantly reduces that risk.

Does my hosting provider handle website maintenance?

Managed WordPress hosting providers typically handle WordPress core updates automatically and manage server-level security and backups. They do not manage plugin or theme updates, content changes, or site-specific issues. Shared hosting providers typically manage nothing at the WordPress level, only the server infrastructure. Always check exactly what your hosting includes rather than assuming.

What is the difference between website maintenance and website support?

Maintenance is the proactive, ongoing work that keeps a site running well: updates, backups, monitoring, performance checks. Support is the reactive work that happens when something goes wrong: fixing a broken page, resolving a plugin conflict, recovering from a hack. A good maintenance routine reduces the need for support. A site without maintenance generates much more support work. Many providers offer both as part of a combined retainer.

I have not maintained my WordPress site in over a year. Where do I start?

Start with a backup before doing anything else. Then update plugins one at a time rather than all at once, checking the site functions correctly after each one. This is slower than bulk updating but makes it much easier to identify which update caused a problem if one appears. Then update themes and finally WordPress core. Run a security scan after everything is updated. If the site has been running unupdated for a long time, a security audit is worth commissioning to confirm it has not been quietly compromised.

Need Someone to Handle Your Website Maintenance?

Whether you need a one-off catch-up for a neglected site or an ongoing maintenance arrangement, get in touch for a straightforward conversation about what your site needs and what that would involve.