Journal · Essentials
What does website maintenance include? (and what it shouldn’t)
What does website maintenance include? A plain-English weekly, monthly and yearly list for UK WordPress sites, plus what a maintenance plan shouldn't include.
Short answer
Website maintenance includes updating WordPress, plugins and your theme, then checking the site still works; keeping backups somewhere separate; scanning for security problems; keeping the padlock (SSL) and server software current; watching that the site stays up; and testing forms and key pages regularly. Some jobs are weekly, some monthly, some yearly. Website maintenance shouldn’t include promises of rankings or enquiries, open-ended “unlimited” changes, or big new jobs that weren’t priced first.
The best website maintenance is the kind nobody notices. When it’s done well, nothing happens. The site loads, the form sends, the padlock stays in the browser bar.
That’s exactly why it’s hard to know what you’re paying for, or whether you need it at all. So here’s the list in plain English: what a WordPress site needs every week, every month and every year, and what a website maintenance plan shouldn’t quietly include or promise.
If you’re comparing plans, read this alongside what a WordPress care plan includes. If cost is your next question, see what website maintenance costs in the UK.
Key takeaways
- Website maintenance is the regular work that keeps a website safe, working and up to date, split into weekly, monthly and yearly jobs.
- Weekly website maintenance covers updates with a check afterwards, separate backups, security scanning and monitoring that the site stays up.
- Monthly website maintenance catches quiet problems, such as a contact form that stopped sending, broken links or warnings in Google Search Console.
- Yearly website maintenance covers renewals and reality checks: the domain, hosting, the SSL certificate, supported PHP versions and out-of-date words.
- A website maintenance plan should never promise rankings or enquiries, and should price new pages or redesigns before any work starts.
In this guide
- What does website maintenance include every week?
- What should you check every month?
- What needs doing once a year?
- What shouldn’t website maintenance include?
- Do you need website maintenance, or can you do it yourself?
- Frequently asked questions
- Sources and references
What does website maintenance include every week?
Weekly website maintenance includes four jobs that protect the site: updating WordPress, plugins and your theme with a check afterwards, keeping backups somewhere separate, scanning for security problems, and monitoring that the site stays online. Skipping them rarely causes trouble straight away, which is exactly why they get skipped until something goes wrong.
1. Updates, then a check
WordPress itself, your plugins (the add-ons that give your site extra features) and your theme (the design) all get updates. Many fix security holes. WordPress’s security guidance says older versions “are not maintained with security updates” (WordPress Developer Resources). Updating is half the job; the other half is checking that your key pages, menus and forms still work.
2. Backups, kept somewhere else
A backup is a full copy of your site you can go back to. WordPress’s own guidance recommends keeping several recent backups, stored in different places (WordPress Developer Resources). A backup kept only on the same server as the site isn’t much help if that server has a problem.
3. Security scanning
Your site’s files checked for anything that shouldn’t be there, such as malicious code, and cleaned up if something is found.
4. Watching that the site is up
Uptime monitoring checks your site regularly, all day, and raises the alarm if it stops responding. Without it, you usually find out your site was down when a client tells you.
What should you check every month?
Every month, check that the site still does its job: test your forms and booking links, look at key pages on a phone, look for broken links, glance at Google Search Console, and remove plugins and logins you no longer use. These checks catch quiet problems before your clients do, and most take only minutes.
The monthly list
- Test your forms and booking links. Send a test enquiry from your phone and check it arrives. Here’s the 2-minute contact form test.
- Look at your key pages on a phone. Homepage, services, contact. Does anything look broken or out of date?
- Check for broken links. Links to pages that no longer exist, or to old social profiles.
- Glance at Google Search Console. Google’s free tool tells you if it has found problems with your pages. Here’s what to look for if your website isn’t showing on Google.
- Remove what you don’t use. Plugins that are switched off but still installed, and old user logins from a past assistant or web person, are doors you don’t need.
- Write a short note. If someone else does your maintenance, you should get a short monthly note saying what was done.
Not every warning is a problem
Search Console sometimes sends alarming emails. Check which page the warning names before anyone starts “fixing” things. Sometimes the right answer is to change nothing.
What needs doing once a year?
Once a year, check the renewals and the details: your domain and hosting renewal dates, that the padlock (SSL certificate) is renewing automatically, that your server software is still supported, and that your prices, dates and policy pages are current. Missing a renewal can take your website and your email offline together.
The yearly list
- Domain renewal. Your web address is rented, usually by the year. If it lapses, your website and often your email stop working. Know the date and who it renews with.
- Hosting renewal. Same again for the server your site lives on.
- The padlock. Many SSL certificates now renew automatically. Let’s Encrypt, a widely used free provider, issues certificates that last 90 days (Let’s Encrypt), so automatic renewal matters. Confirm it’s switched on.
- Server software. WordPress runs on software called PHP. Each version gets security fixes until a published date, then stops (PHP.net). Your host or maintenance provider should keep you on a supported version.
- Your words. Prices, dates, team members, the copyright year in your footer, and your privacy and cookie pages. Not technical, but visitors notice.
The whole schedule in one table
Here’s every job, how often it happens, and what tends to happen if it’s skipped.
| Job | How often | If it’s skipped |
|---|---|---|
| Updates, then a check | Weekly | Security holes stay open; broken pages go unnoticed |
| Backups kept separately | Daily or weekly | No clean copy to go back to |
| Security scanning | Ongoing | Malicious code can sit unnoticed |
| Uptime monitoring | Ongoing | You hear about downtime from clients |
| Form and booking link tests | Monthly | Enquiries can be lost without anyone knowing |
| Search Console and broken links | Monthly | Google problems build up quietly |
| Domain and hosting renewals | Yearly | Website and email can go offline |
| SSL and PHP checks | Yearly | Browser warnings; no security fixes |
| Words, prices and policies | Yearly | Visitors see out-of-date details |
What shouldn’t website maintenance include?
Website maintenance shouldn’t quietly include big new jobs, promises about outcomes, vague amounts of editing time, or changes made without your knowledge. Maintenance keeps your existing site safe and working. New pages, redesigns and new features are separate jobs, and a good provider prices them first and waits for your yes.
Big jobs dressed up as maintenance
New pages, a redesign, a new booking system or new features are separate projects. A good provider tells you the price first, and nothing starts without your yes.
Promises about outcomes
Maintenance protects the site you have. It can’t promise rankings, a set number of enquiries or more income, and nobody can honestly promise those. If a maintenance plan does, ask how.
Vague time
If small edits are included, how much time is included, and does unused time roll over? Most honest plans count the time and don’t roll it over. Be careful with “unlimited”: nobody’s time is unlimited.
Changes you didn’t know about
Updates happen routinely, but changes to your words, design or settings shouldn’t happen without your knowledge. You should always know what was changed and why.
Do you need website maintenance, or can you do it yourself?
If your website matters to your business, someone needs to do the maintenance list. The real question is who. You can do it yourself if you’re comfortable in WordPress and will genuinely do it every week. Handing it to someone makes sense if you’d rather spend that time on clients, or if a broken form would really hurt.
Doing it yourself
It can work well. The cost is your time, plus any paid tools for backups or security. The risk is the week you’re too busy, and the evening spent searching for answers when an update breaks something.
Handing it to someone
Before you choose anyone, ask how often they do each item above and what happens if their update breaks something. Get the answers in writing.
How I do it at WonderlandSites
I look after WordPress websites for UK service businesses. On my hosting, every care plan covers the weekly basics above: weekly updates with a check of your key pages afterwards, daily backups kept separately, malware scanning, the padlock renewed automatically and PHP kept on a supported version. If an update I run breaks something, I fix it free. Bigger jobs are always quoted first. Every plan, with what’s included and what isn’t, is on my plans page.
What I found in my own monthly checks (October 2026)
Two real examples from wonderlandsites.com. First, a form test showed my contact form was saving every message without emailing me. I switched the site to send through a real mailbox and tested it again. Second, Search Console emailed to say pages were “not being indexed”. When I checked, the only address flagged was a WordPress background file that isn’t a page and is meant to stay out of search. No real page was affected, so I changed nothing. One check found a real problem; the other stopped me fixing something that wasn’t broken.
Your free Website Check
A plain-English report within 24 to 48 hours (Monday to Friday): an overall grade (A–F), what’s working, what isn’t, and your top 3 fixes in order. No login, no call, nothing changed on your site.
Frequently asked questions
What does a WordPress maintenance plan include?
A WordPress maintenance plan usually includes regular updates to WordPress, plugins and your theme, backups kept separately, security scanning, uptime monitoring and a monthly note. Better plans also check your pages and forms after updates, and say in writing who fixes things if an update breaks them, and how quickly.
How often should website maintenance be done?
Updates, backups and security checks should happen weekly or more often. Form tests, page checks and a look at Google Search Console suit a monthly rhythm. Domain, hosting, SSL, PHP and content checks can be done yearly. Update more often if a security fix is released for something you use.
Is website maintenance the same as a care plan?
Mostly, yes. “Maintenance plan”, “care plan” and “support plan” are often used for the same kind of service. Compare the written list of what’s included rather than the name, especially what’s checked after updates, how editing time works and what is always quoted as extra.
What happens if I don’t maintain my website?
Nothing may happen for months, which is why maintenance gets skipped. Over time, unpatched plugins become easier to attack, forms can stop sending without warning, and renewals can lapse. When something does go wrong, fixing it usually takes longer and costs more than the regular checks would have.
Does my web host maintain my website?
Usually not fully. Most hosts look after the server and your hosting account, and some take backups. Updating plugins, checking pages and forms, and fixing what breaks inside WordPress is usually up to you, unless your hosting plan says otherwise. Check your host’s terms to be sure.
Should I turn on automatic updates in WordPress?
Automatic updates can help, especially for small security releases. WordPress lets you switch them on plugin by plugin and theme by theme. The catch is that nobody checks your site afterwards unless someone is responsible for it, so pair automatic updates with a regular check of your key pages and forms.
How long should website backups be kept?
Keep backups long enough to go back several weeks, because some problems, like a hidden hack, aren’t noticed straight away. WordPress’s guidance suggests keeping several recent backups in different places. A simple pattern is daily backups for a week plus weekly backups for over a month.
Sources and references
- Hardening WordPress – WordPress Developer Resources.
- Backups – WordPress Developer Resources.
- Let’s Encrypt FAQ – Let’s Encrypt (certificate lifetimes).
- Supported PHP versions – PHP.net.
- Small organisations guide to cyber security – National Cyber Security Centre.
About the author
Alleo Gordon, founder of WonderlandSites. Studied Computing at London South Bank; IT technician at a sixth form college in Bethnal Green for 3 years; looking after websites since 2018. Read my story
Written with AI help, ideated, checked, and confirmed by Alleo.
Last reviewed 4 November 2026.
Keep reading
Whenever you’re ready, I’m here.
Tell me a little about where you are and where you’d like to be. I’ll reply personally.
