Website Maintenance Explained
What does website maintenance actually cover?
a plain-English breakdown of what you should expect
Most agencies use the phrase "website maintenance" to mean something different from the next agency. Some include security and updates. Some include backups. Some include nothing at all. Here is the full picture of what real website maintenance covers, what it costs, and how to evaluate whether your current arrangement is actually doing the work.
In One Sentence
What website maintenance actually means
Website maintenance is the ongoing work that keeps your website secure, fast, current, and functional after launch. It covers seven distinct areas. Security patching. Performance monitoring. Software updates. Backups. Uptime and error monitoring. Content updates. Monthly reporting. Real maintenance covers all seven. Anything less is selective coverage that leaves real gaps your business will eventually feel.
The reason most owners do not know what to expect is that the term has been diluted by agencies that bundle one or two of these areas and sell the result as "maintenance." If your current provider's monthly invoice says "maintenance" but the only thing you can point to is a plugin update, you are paying for a fraction of the work.
This article walks through each of the seven areas, what should be happening, and the questions you can ask your current agency to verify whether the work is actually getting done.
The Seven Areas
What real website maintenance includes
Each of the seven areas below should appear in some form on every monthly maintenance report. If your current provider's reports do not mention these, that is the gap.
1. Security
Real security work includes weekly malware scans, login hardening, two-factor authentication for admin accounts, web application firewall rules, plugin vulnerability monitoring, and immediate patch deployment when a critical disclosure lands. The question to ask your provider: how would you know if a hacker tried to brute-force my admin login last week? If they cannot answer, you have no real security coverage.
2. Performance
Performance work means monthly Core Web Vitals review, image optimization, cache configuration, content delivery network setup, and quarterly hosting review to make sure you are paying for the right resources. The question to ask: what is my current largest contentful paint, and how has it changed in the last six months? Real coverage produces actual numbers.
3. Updates
Updates means weekly review of available WordPress core, plugin, and theme updates, testing in a staging environment for non-trivial updates, scheduled deployment to production with a rollback plan ready, and immediate emergency patches when a critical security release lands. The question to ask: when was the last time you applied a plugin update directly to my live site without testing first? If the answer is "all the time," you are one bad update away from an outage.
4. Backups
Backups means daily automated backups stored in encrypted off-site storage, weekly restore tests on a staging environment to confirm the backups actually work, 30-day rolling retention so you can roll back further than just yesterday, and an immediate snapshot before any major update. The question to ask: when was the last time you actually restored my site from backup as a test? If the answer is "we never tested it," you have backups in name only.
5. Monitoring
Monitoring means 24/7 uptime tracking with multi-region checks, error logging with weekly review, SSL certificate expiry alerts, contact form submission validation, and Google Search Console crawl error monitoring. The question to ask: if my site went down at 3 AM, when would you know? Acceptable answers are within minutes (real monitoring) or within an hour (passable). Anything worse and you are flying blind.
6. Content updates
Content update hours included with the plan let you make routine changes to your site without paying per-update. New service. Updated pricing. Team member joins or leaves. Blog post needs publishing. The question to ask: how many content update hours are included in my plan, and do unused hours roll over? Both answers should be specific numbers, not "we will work with you."
7. Monthly reporting
Reporting means a written monthly report covering uptime percentage, average page load time, security events handled, updates applied, content changes made, search ranking changes for tracked keywords, and recommendations for the month ahead. The question to ask: can you show me the last three monthly reports my plan produced? If they cannot or the reports are generic templates, the work might not be happening.
Seven areas. Each measurable. Each verifiable with a specific question. Real maintenance is a routine, not a vague service. The Modern Pixel approach to all seven is documented in our website care method.
What It Should Cost
Typical price ranges for honest website maintenance
Honest website maintenance for a small business website typically costs between $99 and $400 per month depending on site complexity, content volume, and the service tier. The wide range reflects what is actually included.
$99 to $149 per month usually covers basic security, plugin updates, basic backups, and minimal content update time. Suitable for smaller sites with low complexity. Often missing from this tier: real performance monitoring, restore-tested backups, and detailed monthly reporting.
$199 to $299 per month typically covers all seven areas with moderate content update hours included (usually 1 to 2 per month) and full monthly reporting. This is the tier most small businesses should target. The math works because preventing one outage during a sales week pays for the year.
$300 to $400+ per month usually adds priority support, more content hours, premium hosting included, and proactive optimization. Suitable for businesses where the website is the primary revenue channel.
Anything below $99 per month for "maintenance" typically means one of two things. The work is not actually happening (the agency is collecting subscription revenue without doing the work). Or the agency is losing money on the relationship and will quietly degrade service over time. Neither outcome ends well for you.
Red Flags
Three signs your current website maintenance is not actually happening
You can self-audit your current arrangement in five minutes by looking for three specific red flags.
1. You cannot find a recent monthly report. Real maintenance produces a written monthly report. Generic. Specific to your site. Sent to you each month. If you cannot find one in your inbox from the last 90 days, the agency is either not producing reports (which suggests the underlying work might also be slipping) or producing them and not sharing them (which is its own problem). Ask for the last three monthly reports. If you get vague responses, that is your answer.
2. The agency cannot tell you when your last backup was tested. Backups are useless if they have not been verified by an actual restore. Most providers have backups configured. Few have ever restored from one. Ask your provider: when was the most recent successful restore from backup, and what would the recovery time look like if my site were to go down right now? If the answer is hand-wavy, your backups are theoretical, not operational.
3. Plugin updates happen on your live site without testing. Many agencies update plugins by clicking the WordPress admin button directly on your live site. Sometimes this works. Sometimes it takes down your forms or breaks a layout. Ask your provider: do you test plugin updates on a staging environment before applying them to my live site, or do you click update directly on production? If they cannot describe a staging workflow, you are one bad update away from an outage.
None of these are deal-breakers on their own. All three together usually mean the maintenance subscription is mostly a recurring billing arrangement rather than active work.
Questions
Common questions about website maintenance
Do I really need monthly website maintenance?
If your website brings in leads, ranks for search terms, or represents your business publicly, yes. WordPress core, plugins, and themes release updates constantly. Browsers change. Hosts change. Bots scan for unpatched sites every day. Without monthly attention, the site you launched twelve months ago is not the site running today, and the difference will eventually cost you. The math works out: every month of routine attention costs less than the worst week of an outage you could have prevented.
What happens if I skip maintenance for a year?
One or more of the following. WordPress core falls behind, plugin vulnerabilities accumulate, and bots eventually find a way in. SSL certificate fails to auto-renew and your site shows scary browser warnings. Plugin compatibility drift causes your contact form to silently stop sending. Page speed degrades because nobody is watching Core Web Vitals. Search rankings slowly decline as Google notices the site is degrading. The damage compounds and the eventual fix is much bigger than monthly attention would have been.
Can I do website maintenance myself?
Yes for some of the work. Routine plugin updates and content updates are within reach for an owner willing to spend an hour per month on it. The harder work that most owners cannot self-enforce is restore-testing backups, reviewing security logs, monitoring uptime around the clock, and producing actual reports. If your time is worth more than the cost of a maintenance plan, hiring out is usually the better trade.
How do I switch maintenance providers without downtime?
The clean way: have the new provider audit your site first while the old plan stays active. Document the current state. Then transfer access (admin credentials, DNS control, hosting login) to the new provider on a planned date. The new provider verifies everything works, then notifies the old provider to stop billing. You should never be in a gap where neither provider is responsible.
Want to know if your current website maintenance is doing the work?
Book a discovery call. We will walk through the seven areas, ask the questions, and tell you honestly where your current arrangement is solid and where the gaps are. Sometimes the answer is your current provider is great. Sometimes it is not. Either way you will know.