In this guide · 8 sections
Short answer
A good maintenance plan covers updates tested before they go live, off-site backups with a test restore, uptime and SSL monitoring, security scanning, a short monthly report and a set number of hours for small changes, with a written response time. Ask for proof of each, especially a restored backup.
What website maintenance should include
Maintenance means the routine work that keeps a website secure, working and recoverable. For most small business sites, that means WordPress, Shopify, Wix or a custom build. The checklist below applies to all of them, though platforms like Shopify and Wix handle core updates themselves.
| Area | What a good plan does | Proof to ask for |
|---|---|---|
| Updates | Core, theme and plugins updated monthly or faster for security fixes, tested first | Update log with versions and dates |
| Backups | Daily automatic backups stored off the server, kept for 30 days or more | Backup list and a restore test |
| Monitoring | Uptime, SSL certificate and domain expiry checked automatically | Alert history or status page |
| Security | Malware scan, firewall, login protection, admin users reviewed | Scan results and user list |
| Changes | A set number of hours for small edits each month | Ticket or email log |
| Reporting | A short monthly summary in plain English | The report itself |
| Response | Written response time for outages and urgent fixes | Contract or plan page |
If you want to compare what these plans cost, our website maintenance cost guide covers price ranges. This page focuses on whether the work is real.
Updates: tested, not just clicked
WordPress's own hardening guide puts keeping WordPress, themes and plugins up to date at the top of its list. Outdated plugins are one of the most common ways small business sites get hacked.
The risk on the other side is breakage. A plugin update can clash with your theme and take the site down. A good provider avoids both problems by taking a backup immediately before updating, testing major updates on a staging copy, and checking key pages and forms afterwards. Ask how they handle an update that breaks something, and how fast they can roll back. If you have been burned before, our guide on what to do when a WordPress update breaks your site explains the recovery options.
Backups that actually restore
WordPress's backup documentation is clear that a typical site has two parts, the files and the database, and you need both to restore it. Many 'backup included' plans only snapshot one, or keep the backup on the same server as the site.
The only real proof is a test restore. Ask your provider to restore a recent backup to a staging site at least once a year and send you the link. It takes them under an hour if their backups work, and tells you everything you need to know if they do not.
Monitoring, security and reports
Uptime monitoring checks your site every few minutes and alerts someone when it goes down. Tools are cheap: UptimeRobot's pricing page lists a free plan with 50 monitors at a 5-minute interval, and a Solo plan from about US$9 a month (annual billing) with 60-second checks, as of October 2026. There is no reason a paid maintenance plan should not include it, plus SSL certificate and domain expiry alerts.
Security should go beyond 'we have a security plugin'. Look for a web application firewall, login protection with two-factor authentication for admins, removal of unused plugins and admin accounts, and regular malware scans. If your site has been compromised before, read our hacked website guide to understand what a clean-up involves.
The monthly report ties it together. It does not need to be long. One page listing what was updated (with versions), backup status, uptime for the month, security scan results and any changes made is enough to show work was done.
Questions to ask a website maintenance provider
Send these before you sign. Clear, specific answers are a good sign. Vague ones, like 'we handle everything', are not.
Questions before you sign
How to check your provider is doing the work
You can audit an existing plan yourself in about ten minutes, even without technical skills.
Log in and check update status
In WordPress, open Dashboard, then Updates. Plugins waiting for updates for weeks, or a warning about an outdated WordPress version, mean updates are not happening.
Ask for the latest backup file
Request a download link to last night's backup. If they cannot send one quickly, the backups may not exist.
Look at the admin user list
Under Users, check for old staff, former agencies or accounts you do not recognise with Administrator rights.
Check your SSL and domain dates
Click the padlock in your browser to see the certificate expiry, and check the domain renewal date at your registrar.
Compare last month's report with reality
If the report says plugins were updated on a date, check the plugin versions match. Reports that never change from month to month are a warning sign.
Put together, the signs are easy to read:
Signs of a good plan
- Monthly report with real versions and dates
- Backups you can download on request
- Alerts reach you or them within minutes
- Accounts and hosting in your name
Red flags
- Report is the same every month
- No answer on where backups are stored
- You find out about downtime from customers
- Provider owns the hosting and domain
Do it yourself or get help?
If your site is small and you are comfortable logging in monthly, you can run a basic routine yourself: free uptime monitoring, a backup plugin that saves to cloud storage, and a monthly update session after taking a backup.
If you would rather not, our care plans are built around the checklist on this page. Monitor (S$29 a month) watches uptime, SSL, domain expiry and email reputation. Care (S$129 a month) adds monthly updates, daily off-site backups and an hour of changes. Care Plus (S$349 a month) adds three hours of changes, faster replies and a quarterly security review. Every plan includes a monthly report, and you can cancel any time.
Frequently asked questions
A proper plan includes regular updates of the platform, theme and plugins, automatic off-site backups with occasional restore tests, uptime and SSL monitoring, security checks, a set amount of time for small content changes, a monthly report and a written response time for problems. Hosting may or may not be included, so check separately.
Check for updates at least monthly, and apply security fixes for WordPress core and plugins as soon as practical after release, ideally within days. Take a backup immediately before updating and check key pages and forms afterwards. Hosted platforms like Shopify and Wix update their core software for you, but apps and themes may still need attention.
Less than a WordPress site, because the platform handles hosting, core updates and security. You still need someone to watch apps and integrations, keep admin accounts tidy, check the domain and email records, and make content changes. A lighter monitoring plan is often enough for these platforms.
Ask for a test restore. Your provider should be able to restore a recent backup to a staging site and send you the link, showing both files and database came back correctly. You should also be able to download a backup yourself. A backup that has never been restored is an assumption, not a safety net.
Your business. The domain registration, hosting account and website admin login should all be in your company's name, with the maintenance provider given its own access. If the provider owns them and you part ways, getting your site back can take weeks. Check this before signing any maintenance plan.