What should website maintenance include?

• Automated backups stored away from the live server.
• Core, theme, and plugin updates tested and applied.
• Security, uptime, storage, and domain monitoring.
• Regular form, checkout, and critical-path tests.
• A documented restoration and escalation process.

Maintenance keeps the system healthy. Management keeps the website useful. That can include adding proof, updating services, improving calls to action, reviewing analytics, refreshing old content, and coordinating new campaign pages.

Know what is monitored, how quickly incidents are handled, which changes are included, how unused time works, and who pays for premium tools or emergency repairs. A vague care plan creates the same uncertainty it is supposed to remove.

Monitor uptime and security continuously. Review updates, backups, forms, storage, and performance on a defined schedule. Test critical transactions after relevant changes. Review users and permissions periodically, and remove access that is no longer needed.

Keep a short maintenance record. When something breaks, the team should know what changed, when the last successful backup ran, and how to return to a stable version.

Some plans cover only software care. Others include content time, design help, analytics, search monitoring, or priority response. Define the included hours or tasks, response targets, emergency terms, excluded work, premium licenses, and cancellation process.

A useful plan makes responsibility obvious. It should reduce business risk and decision friction, not create a subscription whose activity cannot be explained.

Create an inventory of the platform, theme, plugins, integrations, domains, certificates, analytics, forms, payment systems, and premium licenses. Record owners, renewal dates, update responsibility, and recovery access. Without an inventory, critical dependencies become visible only when they fail.

Define monitoring and review intervals. Uptime and security alerts may run continuously. Software updates, backups, storage, forms, and performance need a regular schedule. High-value transactions should be tested after relevant changes. Keep a staging environment or rollback method for updates that can affect customers.

Separate incident response from normal improvement. Document contact channels, response targets, restoration steps, and emergency costs. Then define which content, design, SEO, and conversion tasks belong to ongoing management. A plan should show the business exactly what happened and why.

• Where are backups stored and when were they tested?
• Who receives security and uptime alerts?
• Which transactions receive routine testing?
• What work is included in the monthly fee?
• How are credentials and documentation transferred?

Ask where backups are stored, how restoration is tested, whether updates are staged, what uptime and security tools are used, who receives alerts, and how incidents are escalated. Request the response target for a broken site and the separate target for a normal content request.

Confirm who owns premium licenses, whether unused time carries forward, how work is documented, and what happens after cancellation. Ask how the provider protects administrator credentials and whether the business retains recovery access.

A strong provider can explain the plan in plain language. Vague promises such as complete protection or unlimited updates hide limits the business will discover during a problem. Maintenance reduces risk. It cannot remove every risk, and it should never require surrendering ownership of the asset.

Require a simple activity record so the business can verify what was checked, changed, tested, and recommended during each service period.