A client called us on a Tuesday because their contact form had stopped sending. Not broken visually — it submitted, showed the thank-you message, behaved exactly as it should. The emails just weren’t arriving. When we checked the logs, the last successful delivery was eleven weeks earlier. Their hosting company had tightened outbound mail rules in a routine update, and nothing on the site announced the change.
Eleven weeks of inquiries, gone. At an average of six leads a week and a close rate they’d put at one in five, that’s roughly thirteen jobs they never knew existed. The site never went down. Uptime monitoring reported 100%. Every dashboard said everything was fine.
This is what website maintenance is actually for. Not the version numbers, not the green checkmarks in a monthly PDF — the quiet failures that cost money for months before anyone notices. Below is an honest account of what maintenance covers, what it costs in 2026, and how to tell a real plan from an automated one.
What website maintenance services actually include
The term covers a wide range, which is exactly why quotes vary so wildly. At the low end, “maintenance” means a script that applies plugin updates at 2 a.m. and emails you a summary. At the high end, it means someone owns the outcome of your website: that it loads fast, converts, stays out of trouble, and gets better each quarter.
A plan worth paying for covers five areas. If a proposal is missing one of these, ask why before you sign.
- Updates applied safely — core, theme, and plugin updates tested on a staging copy before they touch the live site, with a rollback path if something breaks.
- Security — hardening, malware scanning, login protection, and a defined response if the site is compromised.
- Backups that have been restored — offsite, automated, and tested. A backup nobody has restored is a hypothesis, not a safety net.
- Performance and uptime — Core Web Vitals tracked over time, not just a one-off score, plus monitoring that catches slow pages, not only dead ones.
- Functional checks — forms actually delivering, checkout actually completing, payment and shipping integrations still talking to each other.
That last one is where most plans quietly fall short, and it’s the one that cost our client thirteen jobs.
What breaks when nobody is watching
Websites don’t decay evenly. Some problems announce themselves loudly; the expensive ones don’t.
Security: the risk is automated, not personal
Small business owners often assume they’re too small to target. That assumption misreads how attacks work. Nobody chose your site. A bot scanned a range of IP addresses, found a plugin running a version with a published vulnerability, and tried the matching exploit — the same way it does to a hundred thousand other sites that hour.
The window matters more than the odds. Once a vulnerability is disclosed publicly, exploit attempts typically begin within days, sometimes hours. A site updated monthly can sit exposed for weeks. That’s the entire argument for prompt patching, and it’s why “we update quarterly” is not a maintenance plan.
Cleanup costs more than prevention, every time. Beyond the technical work, a hacked site can get flagged by Google Safe Browsing, blacklisted by email providers, and drop out of search results — consequences that outlast the fix by months.
Performance decays gradually, then all at once
A site launches fast. Then someone adds a chat widget, a tracking pixel, a popup tool, a reviews plugin. Each one seems small. Two years later the homepage pulls 4 MB and takes six seconds on a phone, and nobody can point to the change that did it, because no single change did.
Google measures this through Core Web Vitals, and page experience influences rankings. More directly, it influences revenue: every additional second of load time costs conversions, and mobile visitors on slower connections feel it first. Tracking those numbers monthly turns a slow slide into something you can catch at month three instead of year two.
Revenue leaks that look like nothing
These are the ones that hurt, because the site keeps looking healthy while it stops working:
- A contact form that submits successfully but delivers nowhere, usually after a host tightens mail rules or an SPF record drifts.
- A payment gateway whose API version was deprecated, failing only on certain card types.
- An SSL certificate that lapses on a subdomain and greets visitors with a browser warning.
- A shipping plugin that stopped returning live rates and silently fell back to a flat fee that loses money on every heavy order.
- Analytics that stopped recording after a tag manager change, so you’re making decisions on three-month-old data.
Uptime monitoring catches none of these. The server responds with a 200 the entire time. Only someone deliberately testing the path a customer takes will find them — which is why functional testing belongs in a maintenance plan, not just a launch checklist.
SEO erosion
Search visibility degrades through accumulation. A redesign drops a page without a redirect. A plugin update changes URL structure. An image CDN starts serving broken thumbnails. A staging site gets indexed because someone forgot to block it. None of these is dramatic on its own; together they explain most of the “our traffic has been slowly declining and we don’t know why” conversations we have.
A monthly crawl catches broken links, redirect chains, missing metadata, and accidental noindex tags while they’re still cheap to fix. If you want the full picture of what to watch, our SEO services page covers the technical audit side in more depth.
A realistic maintenance schedule
Not everything needs checking at the same interval. Here’s how the work actually distributes across a month and a year.
| Frequency | What gets done |
|---|---|
| Continuous | Uptime and SSL monitoring, malware scanning, firewall and login-attempt blocking, offsite backups |
| Weekly | Core, theme and plugin updates tested on staging; security patches applied out of cycle when severity demands it; backup integrity check |
| Monthly | Contact and checkout form testing, Core Web Vitals review, broken-link and redirect crawl, database optimization, spam cleanup, analytics sanity check, plain-language report |
| Quarterly | Full backup restore test, PHP and dependency version review, accessibility pass, competitor and search-position review, roadmap conversation |
| Annually | Domain and certificate renewals, licence audit, hosting plan right-sizing, design and content refresh review |
The quarterly restore test is the item most providers skip and the one we’d keep if we could only keep one. Backups fail silently all the time — a database export that truncates, a plugin that excludes the uploads folder, a storage account that filled up in March. You find out when you need it, which is the worst possible moment.
How much do website maintenance services cost?
Pricing tracks scope and response time more than site size. These are realistic 2026 market ranges in USD for a professionally managed site.
| Tier | Typical monthly | Suited to | What you get |
|---|---|---|---|
| Essential | $49–$99 | Brochure sites, local businesses | Updates, backups, security monitoring, uptime alerts, monthly report |
| Standard | $150–$350 | Lead-generating sites, small e-commerce | Everything above plus staging-tested updates, performance tracking, form and checkout testing, a content-edit allowance |
| Growth | $500–$1,200 | Revenue-critical stores and platforms | Everything above plus priority response, development hours, conversion and SEO work, quarterly strategy |
Below roughly $40 a month, you’re buying automation with a logo on it. That’s not automatically wrong — a small brochure site with no forms and no transactions may genuinely need little more. Just know what you’re buying, and don’t expect anyone to notice when your contact form stops delivering.
One thing to check carefully: whether emergency work is included or billed separately. A plan advertised at $99 with hack cleanup billed at $150/hour is a different product from one at $149 that covers remediation. Ask specifically.
Should you handle maintenance in-house?
Sometimes, yes. If someone on your team is genuinely comfortable with staging environments, reads plugin changelogs, and can restore a database backup under pressure, in-house works and saves money.
The failure mode isn’t capability, it’s attention. Maintenance is unglamorous work with no deadline attached, so it loses every scheduling contest against work that does have one. The pattern we see repeatedly: diligent for two months, sporadic by month four, forgotten by month seven, and a support ticket at month nine that starts with “the site is showing a white screen.”
Be honest about three things before deciding:
- Who owns it by name? “The marketing team” owns nothing. A named person with time allocated owns something.
- What happens at 9 p.m. on a Saturday? If your store takes weekend orders, an outage waits until Monday unless someone is on call.
- Can you roll back? If an update breaks checkout, the recovery path needs to exist before you need it — not be improvised during the incident.
A reasonable middle ground: keep content editing in-house, outsource the technical layer. Your team knows the business; a maintenance provider knows what a deprecated PHP function does to a checkout page.
How to choose a provider
Most maintenance pages describe the same bullet points. These questions separate them:
- “Do you test updates on staging first?” If updates go straight to production, you are the test environment.
- “When did you last restore one of my backups?” The right answer involves a date, not a description of the backup schedule.
- “What’s your response time, and is it in writing?” “We’ll get to it quickly” is not a commitment.
- “If the site is hacked, is cleanup included?” Find out now rather than mid-incident.
- “Who owns the hosting, domain, and code?” The answer should be you, with your own credentials.
- “What does the monthly report actually say?” Ask for a real example. A list of plugin version numbers tells you nothing about whether your business is working.
Warning signs
Walk away from providers who hold your hosting or domain in their own account, who can’t produce a sample report, who quote a suspiciously flat rate regardless of platform complexity, or who lock you into a year with no exit clause. Also be wary of anyone who won’t say plainly which parts of their service are automated — automation is fine and normal, hiding it isn’t.
Maintenance by platform
The work differs meaningfully depending on what your site runs on.
WordPress carries the most maintenance load, simply because it’s assembled from independently maintained parts. A typical site runs fifteen to thirty plugins from different authors on different release cycles, any of which can conflict. This is where staging testing earns its cost. Our WordPress development work often begins with reducing that surface area — replacing five overlapping plugins with one purpose-built one, which we cover under custom plugin development.
WooCommerce raises the stakes. Maintenance has to include transactional testing: place a real order, use a real card, confirm the confirmation email, check that stock decrements and the courier integration receives the order. A theme update that breaks checkout is an outage with a revenue number attached.
Shopify handles core and security itself, which removes a whole category of work. What remains is app sprawl — abandoned apps still injecting scripts, duplicated functionality, and theme customizations that break when a vendor updates. See Shopify theme development for how we approach that cleanup.
Custom applications need dependency and framework attention rather than plugin updates: security advisories against packages, framework LTS timelines, and PHP or Node version upgrades before the current one stops receiving security fixes.
What a good monthly report looks like
Most maintenance reports are written to look like work rather than to be read. Fourteen plugin version numbers and a green “all systems normal” banner tell a business owner nothing actionable.
A report worth receiving answers four questions in plain language: What changed this month? What did we find and fix? How is the site performing against last month? What should we do next, and why? Two paragraphs and a short table beats six pages of dashboard screenshots.
It should also say when nothing happened. “No security events, no errors, forms tested and delivering, load time steady at 1.4s” is a perfectly good month and worth stating clearly.
How we handle maintenance
We run maintenance the way we’d want it run on our own systems. Updates are applied to a staging copy first and only promoted once the pages that matter — checkout, forms, search, login — have been exercised by hand. Backups run offsite and are restored on a schedule, not just written. Every month we actually submit your contact form and confirm the email lands.
You keep ownership of everything: hosting account, domain registrar, source code, design files. If you ever leave, nothing needs to be extracted from us.
We work with clients globally and support San Antonio, TX businesses on Central Time, so questions get answered during your working day rather than overnight. If you’d like us to look at your current site first, we’ll run a free audit and tell you plainly what needs attention — including the parts you could reasonably handle yourself.
Request a website maintenance audit →
Frequently asked questions
How often should a website be updated?
Security patches should be applied within days of release, since public disclosure is what triggers automated exploit attempts. Routine plugin and theme updates work well on a weekly cycle applied to staging first. Major version upgrades — a new PHP release, a major framework version — deserve their own planned window rather than being folded into routine work.
What happens if I don’t maintain my website?
In the short term, usually nothing visible, which is what makes neglect easy. Over six to twelve months the pattern is predictable: performance degrades as plugins accumulate, a form or integration fails silently, search visibility slips through broken links and lost redirects, and the update backlog grows large enough that catching up becomes risky in itself. The compounding cost is that fixes get more expensive the longer they wait.
Is website maintenance worth it for a small business?
Compare it against a single lost customer. If your average job is worth a few hundred dollars, a maintenance plan pays for itself by catching one broken contact form. For sites that take no enquiries and no payments, a minimal plan covering updates, backups and security is genuinely sufficient — you don’t need to overbuy.
Does my host already handle this?
Hosts maintain the server: operating system, web server, PHP runtime, and their own backups. That stops at your application. Your plugins, theme, integrations, forms and content are yours to maintain. Managed WordPress hosts do more — often automatic core updates and daily backups — but they won’t notice that your checkout is rejecting one card type, because that isn’t their layer.
Can you maintain a site you didn’t build?
Yes, and most of what we maintain we didn’t build. We start with an audit covering security, performance, update backlog and anything actively broken, then give you a prioritised list before any ongoing work begins. Occasionally that audit concludes the honest answer is a rebuild rather than a retainer, and we’ll say so.
What’s included in a maintenance plan versus billed separately?
Routine work — updates, backups, monitoring, security, testing, reporting, and a small allowance of content edits — belongs in the monthly fee. New feature development, redesigns, and large content migrations are project work and should be quoted separately. Hack remediation varies by provider, which is exactly why it’s worth confirming in writing before you need it.
Related reading: an intermittent 403 caused by cache TTL, order emails silently failing, our WordPress development service, and what Shopify development actually costs.