What Should a Website Maintenance Plan Include?

Most business websites are built, launched and then left alone until something breaks. A plugin update takes the contact form down, the SSL certificate lapses and browsers start showing a security warning, or the site slows to a crawl and nobody notices until a customer mentions it. A website maintenance plan exists to stop those things happening. This guide sets out what a good plan should include, what it should not charge you for, and the questions to ask before you sign one. It is written for Australian business owners and marketing managers, not developers.

What website maintenance means

Website maintenance is the regular work that keeps a site secure, working and up to date after launch. It covers the software the site runs on, the hosting underneath it, the content on top of it, and the checks that tell you when something has gone wrong. On a WordPress or WooCommerce site that means core, theme and plugin updates. On a Shopify store most of the platform is maintained for you, but apps, theme code, tracking and content still need looking after. On a custom-built site it means the framework, the server and the libraries the code depends on.

A maintenance plan turns that work into a routine with a named person responsible for it, a set response time when something breaks, and a report that shows what was done.

What a website maintenance plan should include

These are the items to look for, grouped the way most plans are written. A small brochure site may not need every one; an online store or a site that takes bookings usually does.

Software updates, tested before they go live

Updates to the content management system, theme and plugins should be applied regularly, but never blindly. A good plan tests updates on a copy of the site (a staging site) first, checks the pages that matter, such as the home page, contact form, checkout and booking flow, and only then applies them to the live site. Ask how often updates are applied, whether they are tested first, and what happens if an update breaks something.

Backups you can restore from

Daily backups of the files and the database, kept off the hosting server, with at least a few weeks of history. The test of a backup is whether it can be restored, so ask when a restore was last tested and how long it takes. An online store should be backed up more often than a brochure site, because orders change the database all day.

Security monitoring and patching

Security covers firewall rules, malware scanning, login protection such as two-factor authentication, removal of old admin accounts, and fast patching when a plugin or theme has a known vulnerability. If the site collects personal information through forms, accounts or orders, ask how a breach would be detected and who would tell you. If the Privacy Act covers your business, the Notifiable Data Breaches scheme sets out when a breach must be reported, and your maintenance provider should be part of that plan.

Uptime monitoring

An automated check that visits the site every few minutes and alerts someone when it goes down. The plan should say who gets the alert, how quickly they respond, and whether you are told. Many site owners only learn their site was down from a customer.

SSL certificate and domain renewals

The SSL certificate (the padlock in the browser) and the domain name both expire. A lapsed certificate shows visitors a warning page; a lapsed .com.au domain can take the site and email offline. A plan should track both dates and renew before they lapse, or at least warn you in time.

Speed and Core Web Vitals checks

Sites slow down over time as images, plugins and tracking scripts are added. A plan should include a regular speed check against Google’s Core Web Vitals, with fixes for the common causes: oversized images, unused plugins, too many scripts and slow hosting. Our guide to technical SEO and Core Web Vitals explains what those measures mean.

Broken links, forms and tracking

A monthly check that internal links work, contact and quote forms deliver to the right inbox, and analytics and conversion tracking still fire. Forms that silently stop sending are one of the most common and most expensive website faults, because nobody knows enquiries are being lost.

Content edits

Most plans include a set amount of time each month for small changes: updating opening hours, swapping a team photo, adding a new service page or a blog post. Check what counts as a small change, whether unused time carries over, and how quickly edits are done.

Accessibility and legal pages

Sites drift away from accessibility standards as content is added. A periodic check against WCAG, the standard Australian organisations commonly work to, catches missing image descriptions, poor contrast and forms that cannot be used with a keyboard. The privacy policy and terms should also be reviewed when the site starts collecting new kinds of information.

A monthly report

A short report that says what was updated, what was fixed, any security events, uptime for the month, speed results and the content changes made. If a plan cannot tell you what it did, you cannot tell whether it is worth keeping.

What should not be in the price

Watch for plans that bundle things you do not need or that you already pay for elsewhere. Hosting is sometimes included and sometimes separate; make sure you are not paying for it twice. Large changes, such as a new section of the site or a redesign, are projects rather than maintenance and should be quoted separately. And a plan should not lock you in: you should own the domain, the hosting account and the admin logins, and be able to leave with them.

WordPress, WooCommerce, Shopify or custom: what changes

Platform	Who maintains the platform	What still needs a maintenance plan
WordPress	You, or your provider	Core, theme and plugin updates, security, backups, hosting, speed
WooCommerce	You, or your provider	All of the above, plus checkout testing, payment and shipping plugins, order backups
Shopify	Shopify	Apps, theme code, tracking, content, speed and accessibility
Custom-built	Your developer	Framework and library updates, server patching, backups, monitoring

How to tell if your site needs a plan now

Run these five checks today. If two or more fail, the site needs regular attention.

Log in to the admin area. Are there updates waiting, and has anything been updated in the last month?
Submit your own contact form. Does the email arrive, and in the right inbox?
Check the padlock in the browser and the domain expiry date with your registrar.
Run the home page through Google PageSpeed Insights on mobile.
Ask whoever looks after the site when the last backup was restored as a test.

Want this as a one-page checklist? Everything a maintenance plan should cover on one A4 page, with tick boxes, five checks to run today and what you should own. Use it to compare quotes.

Download the checklist (PDF)

A worked example

This is a hypothetical, not a client. Take a Melbourne physiotherapy clinic with a WordPress site, an online booking plugin and a blog. Nobody has logged in for eight months. Thirty plugin updates are waiting, the booking plugin has a known security issue, and the contact form has been sending enquiries to a former receptionist’s inbox since she left.

A sensible plan for this clinic starts with a one-off clean-up: test and apply the waiting updates on a staging copy, remove unused plugins, fix the form, set up off-site backups and uptime monitoring. After that, monthly maintenance covers tested updates, a form and booking check, a speed check, an hour or two of content edits and a one-page report. The clinic owns its hosting and logins throughout.

Questions to ask a website maintenance provider

How often are updates applied, and are they tested on a staging site first?
Where are backups stored, how long are they kept, and when was a restore last tested?
Who gets the alert when the site goes down, and how fast do they respond?
What counts as a content edit, and how many hours a month are included?
What is in the monthly report?
Do I own the domain, hosting and admin accounts, and can I leave at any time?

High10 provides website maintenance and support for Australian businesses on WordPress, WooCommerce, Shopify and custom sites. Every plan is quoted in writing after a short look at the site, and you keep ownership of every account.

Frequently asked questions

What does website maintenance include?

Tested software updates, off-site backups, security monitoring, uptime alerts, SSL and domain renewals, speed checks, form and tracking checks, small content edits and a monthly report. Online stores also need checkout and payment testing.

How often should a website be maintained?

Security and uptime should be monitored all the time. Updates, backups checks, form tests and speed checks are usually monthly, with urgent security patches applied as soon as they are released.

Do Shopify stores need website maintenance?

Less than WordPress, because Shopify maintains the platform itself. Apps, theme code, tracking, speed, accessibility and content still need regular attention, especially after new apps are installed.

Can I maintain my own website?

Yes, if someone in the business has the time and confidence to test updates, check backups and respond when the site goes down. Many businesses start that way and hand it over when the site becomes important to sales or bookings.

Is hosting included in a website maintenance plan?

Sometimes. Check whether the plan includes hosting or assumes you already have it, so you do not pay for hosting twice. Either way, the hosting account should be in your business’s name.