What a Website Maintenance Plan Should Actually Include

25 August 2026 · 3 min read · by Osama Jamal

Website maintenance is one of those phrases that sounds specific and is not. Published 2026 pricing for care plans runs from roughly twenty five dollars a month to six hundred and beyond, and the reason the range is that wide is not greed. It is that the word covers eight separate jobs, and every provider bundles a different subset of them.

So the useful question is never how much. It is what, exactly. Here is the list we price against, and the list you should hold any quote up to.

1. Hosting and the server underneath

Some plans include hosting. Most do not, and simply manage the site on whatever you already have. Neither is wrong, but you need to know which, because a plan that excludes hosting is not cheaper, it is smaller.

Ask directly: is hosting inside this fee or billed separately? If separately, what does it cost and who holds the account?

2. Core, plugin and theme updates

The visible part of maintenance, and the part most people assume is the whole thing. What matters here is whether updates are automated or verified.

Automated updates run and hope. Verified updates run on a staging copy first, load the pages that matter, confirm the checkout or contact form still works, and only then go live. The second takes real time, which is why it costs more, and it is the difference between a plan and a cron job.

3. Backups, and proof they restore

Almost every plan claims backups. Very few test restores. A backup nobody has ever restored is a belief, not a safeguard, and the moment you discover it was corrupted is the worst possible moment.

• How often do backups run, and how long are they kept?
• Are they stored off the same server as the site? The WordPress backup documentation is clear that on-server copies are not backups.
• When was the last restore actually performed and verified?

If the third question gets a vague answer, that is your finding.

4. Security monitoring and hardening

Outdated plugins and themes remain the leading cause of WordPress breaches, well ahead of core flaws. A plan should cover vulnerability scanning against known advisories, a firewall or host level equivalent, login hardening, and two factor authentication on administrator accounts.

What it should also cover, and rarely does, is a periodic user role audit. Sites accumulate accounts: the old developer, the intern, the agency that ran one campaign. Each is a route in. You can read our cleanup process for a hacked WordPress site if you want to see what the alternative costs.

5. Uptime monitoring

Cheap to provide, so almost universally included. The question is what happens when it fires. Monitoring that emails you at three in the morning is a notification service. Monitoring where someone else investigates is maintenance.

6. Performance checks

Sites get slower on their own. Plugins accumulate, images get uploaded at full resolution, a third party script gets added for a campaign and never removed. A plan should include periodic Core Web Vitals review against real field data, not just a lab score from a testing tool.

7. Content edits

The line item that causes the most friction. Most plans include a small allowance: opening hours, a price change, a new team member. What counts as an edit versus a new project should be written down before you need it, not negotiated during.

8. Reporting, and someone to email

A monthly summary of what was updated, what was found and what was fixed. Not a forty page automated PDF nobody reads. Three paragraphs a human wrote is worth more.

And a named response time. Not a promise of availability, an actual number of working hours.

How to use this list

Take any quote you have been given and mark each of the eight either included, excluded or unclear. The unclear column is where the disputes come from six months later.

You will usually find that a very cheap plan covers items two, three and five in automated form and nothing else, and that an expensive one covers all eight with development hours on top. Both can be the right answer. What is never the right answer is not knowing which one you bought.

For what the numbers look like across the market, see our website maintenance cost breakdown, and the exact checklist we run on client sites.