A good website maintenance plan keeps your site secure, recoverable, fast, findable and usable every month, and proves it with a clear report. At minimum that means core, plugin and theme updates with security patching; off-site backups that are regularly test-restored; round-the-clock uptime monitoring; Core Web Vitals and SEO health checks; accessibility monitoring; a set allowance of content edits; and a plain-English monthly summary. If a plan only promises "updates and backups", it is covering the basics and leaving the rest to luck.

Below we break down each component, compare your three main options and list the red flags to watch for, whether your business is in the US, UK, Canada or Australia.

Why a website needs ongoing care

Websites are not finished products. They run on software that keeps changing, and on WordPress in particular, that software is mostly third-party plugins. The Patchstack State of WordPress Security in 2026 report found 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% rise on 2024. Some 91% were in plugins and 9% in themes, while WordPress core had only six, all low priority.

Speed matters too. Patchstack puts the weighted median time to first exploit at five hours, and says 46% of vulnerabilities had no developer fix in time for public disclosure. In other words, "I'll log in and update things when I get a minute" is no longer a security strategy. Google gives the same message in its guidance on preventing malware infection: keep a list of every piece of software and plugin your site uses, track versions, and stay current with updates and patches.

What a website maintenance plan should include

1. Core, plugin and theme updates with security patching

WordPress has offered per-plugin and per-theme auto-updates since version 5.5, and by default it runs them twice a day, according to the official WordPress documentation. That is useful, but the same page notes that auto-updates rely on WordPress cron tasks and may not run reliably on every server, and it advises making sure you can roll back before switching them on. A professional plan adds what automation can't: checking changelogs, updating on a staging copy first where it matters, testing key pages and forms afterwards, and applying virtual patches or firewall rules when a fix isn't available yet. It should also cover removing plugins you no longer use.

2. Backups with tested restores

The WordPress backup guide is clear that a complete backup needs both your files and your database. It suggests weekly backups for smaller sites and daily backups for busy ones, always backing up before an upgrade, keeping several recent copies and storing them in different places. Your plan should state the frequency, how long copies are kept, where they live (off your web server) and, crucially, how often a restore is actually tested. Ask when the last test restore happened.

3. Uptime and security monitoring

You should not find out your site is down from a customer. Look for automated uptime checks around the clock, alerts to a named person, malware scanning and login protection. Account access belongs here too: who holds admin, hosting, domain and DNS credentials, and is two-factor authentication on? Our business account lockout checklist covers the ownership side in detail.

4. Performance and Core Web Vitals

Google's Core Web Vitals guidance on web.dev sets the targets: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of visits on mobile and desktop. A new plugin, a heavy image or a chat widget can quietly push you over. A care plan should track these numbers monthly and fix regressions, not just run a speed test once at launch.

5. SEO health

Google's own Search Console guidance suggests checking your account about once a month, or after content changes. That is a natural fit for a monthly plan: reviewing indexing errors, manual actions, security issues, the Core Web Vitals report, sitemaps and structured data. Broken links, accidental "noindex" tags and redirect mistakes after edits are the everyday issues a good provider catches early.

6. Accessibility monitoring

Accessibility problems creep back every time content is added. The WebAIM Million 2026 study found detectable WCAG failures on 95.9% of the top one million home pages, up from 94.8% in 2025, with low-contrast text on 83.9% and missing image alt text on 53.1%. Regular automated scans plus periodic manual checks keep new issues from piling up. If you want this handled specifically, our website accessibility plans start with Monitor at US$99/month. For questions about legal obligations, please speak to a lawyer.

7. Content updates

Most small businesses need small, regular edits: new opening hours, a team photo, a price list, a seasonal banner. A clear monthly allowance (and what counts as "small") stops these from turning into separate quotes or sitting in an inbox for weeks.

8. Reporting

A monthly report should list what was updated, backups taken and tested, uptime, any security events, Core Web Vitals and Search Console findings, accessibility issues found and fixed, and recommendations. If you can't see the work, you can't judge the value.

DIY vs freelancer vs agency: how they compare

None of these is wrong by default. A tiny brochure site can be fine with careful DIY. But if your site brings in revenue, the cost of an outage or hack usually outweighs the cost of proper care.

Red flags in a website care plan

• "Unlimited" everything with no definition of what is included or how fast requests are handled.
• Backups stored only on the same server as your website.
• No restore testing, or vague answers when you ask about it.
• Blind auto-updates on the live site with no checks afterwards.
• No reports, or reports that are just a list of plugin names.
• The provider owns your accounts. Your domain, hosting and admin logins should be in your name.
• Long lock-in contracts with no clear exit or handover process.

Checklist: questions to ask a maintenance provider

• How often do you update core, plugins and themes, and do you test on staging first?
• What do you do when a vulnerability has no patch yet?
• How often are backups taken, where are they stored and how long are they kept?
• When did you last do a test restore, and can you show me?
• What do you monitor, and who gets alerted out of hours?
• Do you track Core Web Vitals and Search Console issues every month?
• Is accessibility monitoring included, and against which WCAG level?
• How many content edits are included each month?
• What does the monthly report contain? Can I see a sample?
• If I leave, what do I receive, and how quickly?

If your site is already slow, outdated or hard to edit, maintenance may only delay the inevitable. Our guide to the signs your website needs a redesign will help you decide. You can also see the full range of Xuru services, from rebuilds to ongoing care.

Frequently asked questions