Back to Blogs
Most small business websites don't break all at once. They slowly get worse. A plugin goes out of date, the PHP version on the server gets retired, the contact form stops sending, a backup that everyone assumed was running turns out to have stopped months ago. Nobody notices until a customer says "I filled in your form and never heard back."
That's why I offer clients a simple monthly maintenance plan after launch. Not every site needs one, and I'll say that later, but when a site brings in real enquiries, a small amount of regular care is much cheaper than a rushed repair. Here's what I think a monthly website maintenance plan should actually include, and what to ask before you pay for one.
Backups you have actually tested
Backups come first because every other task on this list is safer when there's a good copy to go back to. A real plan covers both parts of the site: the files (code, images, uploads) and the database (posts, products, enquiries, settings).
- Automatic and regular. Daily for sites that change often, weekly for sites that rarely change.
- Stored somewhere else. A backup that only lives on the same server disappears with the server. I keep at least one copy off the hosting account.
- Tested. Once in a while I restore a backup to a test copy and check it opens. A backup you've never restored is a hope, not a backup.
If a maintenance plan can't tell you where the backups are and when the last one was restored, it isn't really covering backups.
Updates done in the right order
Updates fix security holes and keep the site working on newer servers. They also break things now and then, which is why they shouldn't be done blindly.
For WordPress sites
Core, theme and plugin updates every month, after a backup, one group at a time. I read the changelog for anything big, like a major version of a page builder or a WooCommerce update, and test those on a copy first. Plugins that are abandoned or no longer needed get removed instead of updated.
For custom PHP sites
Custom sites have fewer moving parts, but they still need care. I check that the site runs on a supported PHP 8 version, update any libraries installed with Composer, and look at the error log for warnings that point to code that will stop working on the next PHP version. Hosting companies retire old PHP versions on their own schedule, and it's much better to be ready than to find the site broken one morning.
Checking that forms, buttons and checkout still work
This is the part most plans skip, and it matters most. A site can load perfectly and still be losing customers because the one thing that brings in money has stopped working.
Every month I click through the important actions myself, on a laptop and on a phone:
- Send a real test through each contact form and confirm it arrives in the inbox, not spam.
- Tap the phone number and WhatsApp button and check they open the right number.
- Try the booking or quote form if there is one.
- For shops, place a test order and check the confirmation emails go out.
- Check the main menu and footer links still go where they should.
Email delivery is a common silent failure. A change at the hosting company or an expired mail setting can send every enquiry to spam, so the form test needs to end in the actual inbox.
Security basics, not scare stories
I don't sell maintenance with fear. Most small sites are never targeted by anyone in particular. They get hit by automated bots trying old passwords and known holes, which is exactly what basic care prevents.
- Make sure SSL is valid and renewing, and the site always loads on https.
- Review admin users and remove anyone who no longer needs access, such as old staff or past developers.
- Use strong, unique passwords and two-factor login where the platform supports it.
- Check file permissions and that configuration files with passwords aren't in the public folder.
- Scan for files that were changed or added unexpectedly.
Uptime, speed and the domain
A simple uptime monitor checks the site every few minutes and alerts me if it goes down, so I usually know before the client does. Once a month I also run the main pages through PageSpeed Insights to catch slowdowns early, often caused by a large photo someone uploaded straight from a phone.
I also keep an eye on renewal dates. An expired domain or hosting plan takes the whole site and the business email down with it, and it happens more often than you'd think when the renewal card has expired. A plan should track the domain, hosting and SSL renewal dates and warn the owner in good time.
Search Console and a short report
Google Search Console shows problems you won't see by browsing the site: pages that dropped out of the index, broken links, mobile usability issues and security warnings. I check it monthly and fix anything new.
Then the client gets a short report in plain language. Nothing fancy, just what was updated, what was tested, anything that was fixed, and anything I recommend doing next. If the report is a page of graphs nobody understands, it isn't helping the owner make decisions.
Small content changes
Many of my plans include a small amount of time each month for content edits: new prices, opening hours, a team photo, a new service, a seasonal notice. Owners often put off these little changes because they don't want to pay for a separate job each time, and the site slowly goes out of date. Having a bit of time already included keeps the information correct.
What a monthly plan shouldn't include is new features or redesign work hidden inside a fixed fee. Those are separate projects with their own scope, and mixing them in just leads to arguments about what was covered.
Who actually needs a plan
Honestly, not every site needs a monthly plan. A simple static page that rarely changes, with no forms and no plugins, can often get by with a check every few months. Where a plan earns its cost is:
- WordPress or WooCommerce sites with many plugins.
- Sites with forms, bookings or payments that bring in real business.
- Custom sites with an admin panel and a database that changes every day.
- Owners who don't have the time or interest to look after the site themselves.
Questions to ask before you sign up
If you're comparing maintenance offers, these questions quickly show what you're really getting:
- Where are the backups stored, how often are they taken, and when were they last restored?
- Are updates tested before they go to the live site?
- Do you test the forms and checkout every month, and how?
- What happens if the site goes down, and how fast do you respond?
- How many minutes or hours of content changes are included?
- Will I get a written report each month?
- If I stop the plan, do I keep full access to the hosting, domain and code?
The last one matters a lot. The domain, hosting and admin logins should always be in the owner's name. Maintenance is a service you pay for, not a reason to be locked in.
A good plan is mostly quiet, regular work that nobody notices. That's the point. The site keeps loading, the forms keep sending, and when something does go wrong there's a recent backup and someone who already knows the site. If you'd like me to look at what your site needs, you can get in touch here.
