Compare maintenance plan levels, understand the work behind pricing and choose support that matches your website's risk and complexity.
What a maintenance plan should cover
A website maintenance plan should describe the work that keeps the site updated, monitored and recoverable. Common inclusions are software updates, backup checks, uptime monitoring, basic security review, small fixes and a monthly report. The exact list matters more than the plan name.
Some sites need only routine care, while online stores and custom applications need deeper checks around checkout, integrations, data and release changes. A useful plan makes the difference clear and explains which work is included in the monthly fee and which needs a separate estimate.
- Updates and compatibility checks
- Backup monitoring and restore planning
- Security and availability checks
- Small content or technical fixes where agreed
- Reporting and support communication
What changes the price
Pricing depends on the number of sites, platform complexity, business criticality, update volume, support hours, required response time and whether the plan includes development capacity. A brochure site with few integrations has a different risk profile from a busy WooCommerce store or a large multi-site estate.
The lowest monthly price may exclude important work such as staging tests, restore checks, malware remediation or emergency response. Compare the actual tasks and limits, not only the headline price. Ask how overage work is approved and charged.
- Number and type of websites
- Custom code, plugins and third-party integrations
- Monitoring depth and reporting requirements
- Support window and response expectations
- Included development time and out-of-scope rates
A practical way to compare plan levels
A basic plan can cover routine updates, backups and availability checks. A standard plan may add staging tests, monthly technical review and small fixes. A more involved plan may include priority incident handling, custom application support, deeper security work and coordinated changes across many sites. These are examples of scope, not fixed price promises.
Ask each provider to map the plan to your actual website inventory. If you manage many sites, a per-site model may work for similar low-risk sites, while a tiered model can be clearer when some sites need much more attention. Complex work should be estimated from evidence.
- Essential: routine updates, backups and basic monitoring.
- Managed: staged updates, key-flow checks and monthly reporting.
- Priority: agreed response targets, deeper review and planned improvement work.
Response times and service levels
A response target describes when the provider begins acknowledging and triaging an issue. It does not guarantee that every problem will be resolved within that time. Resolution depends on severity, access, third-party services and whether a safe fix can be applied immediately.
Define severity levels using business impact. A checkout outage should not be treated like a small spacing issue. Agree the support hours, escalation route, client responsibilities and how after-hours work is handled. Avoid vague terms such as 'unlimited support' unless the boundaries are explicit.
- Separate response from resolution targets.
- Define urgent, high, normal and low priorities.
- State support hours and escalation contacts.
- Clarify what happens when the issue needs third-party support.
Backups, security and recovery
Backups should have a stated frequency, retention period, storage location and restore process. A successful backup job does not prove that a site can be recovered. Periodic restore tests and clear recovery ownership are essential, especially for stores and sites that receive frequent orders or enquiries.
Security work should include supported software, account review and a plan for suspected compromise. Malware cleanup, major upgrades and emergency recovery may be outside a routine maintenance fee, so define how those situations are scoped before they happen.
- Ask how often backups run and how long they are kept.
- Confirm whether restore tests are included.
- Check who can access backup storage.
- Define the process and cost for emergency recovery.
Questions to ask a provider
Ask for a sample report, a list of included tasks, the update process, the backup and restore approach, response targets and the method for approving extra work. Confirm who owns the hosting, domain, licences and source code. The provider should explain what they can monitor and what still depends on the client or a third party.
A reliable provider is transparent about limits. They should identify unsupported software, missing access or unresolved risks instead of claiming every site is fully protected by a standard checklist.
- What is checked after an update?
- How are failed updates handled?
- What evidence is included in monthly reports?
- Which tasks need a separate quote?
- How can the client leave and retain access to the site?
Choose support that matches the risk
The right plan gives the site enough attention without paying for services it does not need. Start with an inventory, identify critical journeys and agree the risks that matter most. Review the plan when traffic, integrations or business use changes.
If the site is unstable or poorly documented, begin with an audit and stabilisation phase before assuming routine maintenance is enough. A clear baseline helps both sides understand what is included and what improvement should look like.
- Match support to business impact and complexity.
- Resolve critical unknowns before choosing a long-term plan.
- Keep ownership and access clear.
- Review the plan at least when the site changes materially.