Website maintenance is sold as a monthly fee with a vague list attached. Some of those plans are genuinely valuable and some are an automated update running unattended. The difference is not visible in the price, so here is what to ask about.
Updates, applied in an order
Applying every update the moment it appears is not maintenance, it is gambling with your live site. Applying none is worse.
A reasonable process: security updates applied quickly, everything else applied on a schedule, tested somewhere that is not production, with a known way back. Ask whether there is a staging environment. If updates go straight to live, you are the test.
Ask also what happens when an update breaks something. That is the actual service you are buying. Anyone can press update.
Backups you have restored
Almost every plan lists backups. Far fewer can tell you when a restore was last tested.
A backup that has never been restored is a belief, not a safeguard. Corrupted archives, missing databases, backups of a site that broke a week earlier, and backups stored on the same server that failed are all common enough to expect.
Ask three questions: how far back do they go, where are they stored relative to the site, and when was the last test restore. A plan with a documented answer to the third question is worth more than one with twice the retention.
Monitoring that means something
Uptime monitoring that pings the homepage every five minutes catches a server outage. It does not catch a broken contact form, an expired payment gateway credential, or a checkout that fails on the final step.
Better monitoring checks a real journey, not a page. Does the form submit? Does the login work? Is anything actually arriving?
Ask what is monitored, how you are told, and how quickly. An email at nine the next morning about an outage that began at seven the previous evening is a record, not an alert.
Security, specifically
“Security included” should decompose into things you can check: what is scanned, how often, whether login attempts are limited, whether administrative access is restricted, whether the certificate renewal is watched, and who has an account that could change everything.
That last one is the most neglected. Old accounts belonging to former staff and past agencies are a live risk sitting quietly in the user list, and reviewing them costs nothing.
Actual hours, or actual response
Two honest models exist. A block of hours each month for changes you request. Or no hours, but a commitment to respond within a stated time when something breaks.
Both are fine. What is not fine is a plan that implies both and commits to neither. Ask which one you are buying, and what happens to unused hours.
A report you can read
A monthly note saying what was updated, what was found, what was fixed, and what needs a decision. Two paragraphs is enough.
An automatically generated PDF full of green ticks is not a report. Its purpose is to justify the invoice rather than to inform you.
What a website maintenance plan does not include
Just as important. Does maintenance cover new features? Design changes? Content updates? Emergency work outside hours?
A clear boundary is better for both sides than a generous-sounding vagueness that turns into a disagreement the first time something substantial is needed.
Our maintenance and troubleshooting work is built around these points, including the restore testing, because that is the one that matters on the worst day.
Related reading
- A backup is not a backup until you have restored it — The failures that matter are not missing backups. A backup restore that has never been tested is a belief, not a safeguard. Find out before you need it.
- How to investigate an intermittent fault without guessing — Intermittent faults get fixed by accident and come back. A method for finding the real cause, and why changing several things at once never works.
- Public sector accessibility: what WCAG asks for in practice — Public sector accessibility is not an overlay you install. What the WCAG criteria require, the failures that recur most, and how to test without tools.