Website maintenance plan: what to include for client sites

A website maintenance plan is a recurring agreement in which you keep a client's site updated, backed up, secure and online, check that nothing important broke, and report on it every month. A good one lists each task, how often it happens, how fast you respond when something fails, and what sits outside it.

This guide is for agencies and freelancers who build sites and want a maintenance offer they can sell to every client without rewriting it each time. It deals with the site as a whole. An SEO retainer, where you work on rankings and content, is a separate agreement and easier to price on its own.

Updates to core, plugins and themes

Updates take most of the hours, so write down both the frequency and the method. Weekly or monthly rounds are common. A safe routine is: take a backup, apply the updates on a staging copy if the site has one, check the key templates, then update production.

On WordPress you can switch on automatic updates plugin by plugin from the Plugins screen. That is reasonable for small, well maintained plugins and risky for page builders or WooCommerce extensions, so say in the plan which ones you update by hand.

Updates are also where SEO breaks without anyone noticing. An SEO plugin update can change how titles are generated, a theme update can drop the H1 from a template. Our WordPress update SEO checklist lists what to look at after each round.

Backups and restore tests

State how often backups run, where they are stored and how long they are kept. Daily backups stored away from the hosting server are a sensible baseline for most business sites; a shop taking orders all day may need more.

Then add the line most plans forget: a restore test, for example once a quarter on a staging copy. A backup nobody has ever restored is an assumption.

Security basics

Keep this section concrete. Remove admin accounts of people who have left, require strong passwords and two-factor authentication for admins, apply security patches quickly, and run malware scans if the host doesn't. If you rely on a firewall or a security plugin, name it. Cleaning up after a hack is usually quoted separately, because its size can't be known in advance.

Monitoring the client never sees

This is the part nobody notices until it fails. List the signals you watch:

• uptime and server errors
• SSL certificate expiry
• domain expiry
• robots.txt and the XML sitemap
• title, meta description, H1, canonical and noindex on the pages
• GA4, Google Tag Manager and other marketing tags, plus the cookie banner

Domain renewals deserve their own line, because the domain is often registered in the client's name with a card that expired years ago. Domain expiry monitoring explains how to keep track of it.

Response times and plan tiers

Separate acknowledging an incident from fixing it, and define your working hours. As an example only: critical issues (site down, checkout broken, whole site on noindex) acknowledged within a few working hours, everything else the next working day.

When you build tiers, keep monitoring and backups identical in all of them. What changes between tiers is the update frequency, the development time included, the response time and the depth of the report. The cheapest plan still protects the site; the higher ones buy time and attention.

What the plan leaves out

Write the exclusions down: new features and redesigns, content writing, SEO work and link building, hosting and email administration unless you provide them, third-party licences, and repairs after changes someone else made without telling you. Each of these can become a quoted add-on.

The monthly report

A short note is enough: updates applied, backups confirmed, incidents and how they were handled, and upcoming renewals for SSL, domain and licences. Website monitoring client reports covers a format clients actually read.

Deltio can cover the monitoring part of the plan: an uptime check every 10 minutes, SSL alerts 30 days and 1 day before expiry, domain expiry, daily sitemap snapshots, robots.txt, SEO and marketing tags on every URL, and the cookie banner, with alerts by email or Slack. It doesn't apply updates or take backups. Starter is £24 a month, or £20 billed annually, with a 14-day free trial.