Website maintenance plans: updates, backups and monitoring

What a website maintenance plan includes#

We shape the engagement around the actual brief. The proposal identifies which of these deliverables are included, who supplies the inputs and how each one is accepted.

• Uptime, SSL certificate, domain expiry and form delivery monitoring with alerts
• Dependency, CMS and plugin updates, tested on a staging copy before production
• Off-site backups with scheduled restore tests
• Security headers, vulnerability scans and an access review
• Small content and design changes within the plan's hours
• Monthly report: Core Web Vitals, search, inquiries and work done

When a maintenance plan makes sense#

Choose a maintenance plan when the site already does its job and the risk is that it stops without anyone noticing: an expired certificate, a form that no longer sends, a plugin update that breaks checkout. If the structure, content or platform is the problem, start with a website redesign or a website migration and maintain the result. If the site is stable but brings too few inquiries, conversion rate optimization is the better use of the budget.

How a plan starts: audit, baseline, then a monthly rhythm#

Every plan starts with an initial audit, also for sites another team built. We list the hosting, DNS, domain registrar, certificates, CMS, plugins or code dependencies, integrations and forms, and who holds each account. We take a full backup and restore it in a separate environment to prove it works, and we record a baseline of Core Web Vitals, search performance and inquiries. The audit ends with the urgent fixes, the plan's scope and a quote.

After that, each month follows the same rhythm. Monitoring runs all the time and alerts reach a named person on each side. Updates are grouped, tested on a staging copy and released with a rollback point. Change requests arrive through one channel, are estimated before work starts and are logged against the plan's hours. At the end of the month you get a report of what changed, what we found and what we recommend next. Response times for incidents and requests are written into the plan you sign.

What does a maintenance plan check and fix?#

A plan watches the parts of a website that fail without warning and fixes them before visitors or search engines notice. These checks run every month, adjusted to the platform:

The monthly report puts the numbers next to the work. Google's Search Central documentation defines good Core Web Vitals as Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds and Cumulative Layout Shift under 0.1, and web.dev recommends reading them at the 75th percentile of page loads, split by mobile and desktop. The report shows those values from real visits, search clicks and impressions, inquiries received, and every update, incident and change made in the month.

• Uptime of the home page and the pages that bring inquiries, checked from outside your hosting
• SSL certificate expiry and automatic renewal on every domain and subdomain the site uses
• Domain registration expiry and DNS records, including the ones email delivery depends on
• Form delivery: a scheduled test submission confirms inquiries still reach the inbox or CRM
• Performance after each release, so a heavy image or script is caught the same week
• Updates to code dependencies, CMS core, plugins and themes, tested before production
• Backups stored away from the server, with a restore tested on a schedule
• Security headers, vulnerability scans and a review of who has admin access
• Small content and design changes: text, images, a new page from an existing template, links and redirects

Plan tiers by scope: Monitor, Maintain, Evolve#

Plans differ in what they cover, how many change hours they include and how fast we respond. The names below describe scope only. Each plan is quoted after the initial audit, because the same tier costs different amounts on a static Astro site and on a WordPress store with dozens of plugins.

Response times, support hours, included change hours and whether unused hours carry over are written into each plan. Work beyond the plan, such as a new section or an integration, is estimated and approved before it starts.

Why certificates and plugins need closer watching now#

Certificate lifetimes are getting shorter on a published schedule. Under the CA/Browser Forum Baseline Requirements, the maximum validity of public TLS certificates is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. At 47 days, renewing by hand stops being practical, and an automated renewal that fails quietly shows visitors a browser security warning instead of your site. We monitor expiry on every hostname, not only the main domain.

WordPress needs the closest watch. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024, and found 91% of them in plugins and 9% in themes. A WordPress plan therefore starts by removing plugins the site does not need, then tracks security advisories for the ones that remain and tests updates on a copy before they reach production.

Can you take over a site another team built?#

Yes, after the initial audit. On a site built by someone else, the audit answers what is there, who controls it and what is fragile: plugins nobody updates, a theme edited directly so it can no longer be updated, logins only a former freelancer has, backups that were never restored, forms that send to an inbox nobody reads. Some findings need a one-off fix before monthly maintenance makes sense, and we quote that separately.

Ownership stays with you. Hosting, domain, DNS, CMS, analytics and email-sending accounts should be in your company's name, with Dardo invited as a user. If they are not, moving them is the first task, so that ending a plan never means losing access to your own website.

Questions before you choose#