A website maintenance plan covers the routine work that keeps a site secure, working and findable after launch: software updates, backups, security checks, uptime and form testing, content review and performance monitoring. Without it, small issues build up until something breaks, often at the worst moment. The plan should say what is done, how often, and who is responsible.
Why maintenance is not optional
Sites are not finished at launch. Software ages, plugins change, certificates expire and content goes stale. The WordPress developer documentation states you should always keep up to date with the latest version of WordPress because older versions no longer get security updates. It also advises keeping plugins updated and deleting any you are not using, and obtaining plugins and themes only from trusted sources (WordPress hardening documentation).
Even a static or lightly dynamic site has dependencies, hosting and domain arrangements to look after. Astro vs WordPress compares how the maintenance surface differs between architectures.
The task list
| Area | What to do | Suggested cadence |
|---|---|---|
| Updates | Apply core, plugin, theme and dependency updates after checking on staging | Weekly check; urgent security fixes sooner |
| Backups | Verify that backups ran, are stored off the server, and can be restored | Daily or weekly by site type; restore test twice a year |
| Security | Review user accounts, remove unused ones, check strong passwords and two-step sign-in | Monthly |
| Uptime | Monitor availability and SSL certificate expiry | Continuous alerts |
| Forms and key journeys | Submit test enquiries, test checkout or booking | Monthly |
| Performance | Review Core Web Vitals and page weight | Monthly to quarterly |
| SEO health | Check for crawl errors, broken links and indexing problems in Search Console | Monthly |
| Content | Review key pages for outdated facts, prices, staff and offers | Quarterly |
| Accessibility | Spot-check new content for headings, alt text, contrast and captions | With each content update |
| Domain and hosting | Confirm renewals, DNS and contact details | Quarterly |
These cadences are starting points. A shop needs closer attention than a brochure site.
Updates and security
The WordPress documentation notes that WordPress has offered automatic updates since version 3.7, but automatic updates do not replace testing. Apply changes to a staging copy where possible, check the main pages and forms, then update the live site. Use strong, hard-to-guess passwords, ideally from a password generator, and enable two-step authentication, as the same documentation advises.
Treat backups as part of maintenance, not a separate project. Website backups and disaster recovery planning explains what to copy, how long to keep it and how to rehearse a restore. A backup taken immediately before every update is a cheap safety net.
Performance and search health
Speed changes as you add images, scripts and plugins. Google’s guidance for site owners includes Core Web Vitals and Search Console reports as ways to monitor page experience and indexing. Core Web Vitals for business owners explains the metrics and the practical fixes. A monthly look at Search Console for new errors will catch broken pages before customers do.
Content and conversion
Maintenance includes making sure information is true. Check phone numbers, opening hours, service descriptions, prices and team details. Outdated claims can mislead customers. Review calls to action and forms: a form that silently fails is a lost lead you will never see.
What to ask a maintenance provider
- Which tasks are included, and which are charged as extra work?
- Where are backups stored, and when was a restore last tested?
- How are updates tested before they go live?
- What monitoring is in place, and who is alerted?
- How are urgent security issues handled out of hours?
- Who owns the accounts, domain and hosting? You should.
- What reporting will you receive, and how often?
Avoid plans that promise vague “peace of mind” without listing tasks. A clear task list is the sign of a plan you can hold someone to.
Do it yourself or outsource?
Doing it in-house works if someone has the skills, the access and the time to do it consistently. The risk is that maintenance is the first thing dropped when the team is busy. Outsourcing makes the work routine and documented, but you still need to understand what is covered. A hybrid approach, where an external team handles technical tasks and you own content updates, suits many small organisations.
Limitations
A maintenance plan reduces risk; it does not remove it. No provider can guarantee a site will never be compromised or go down. Good plans reduce the odds and shorten recovery, and be honest about what falls outside them, such as redevelopment work or third-party outages.
Where Radiance Impact fits
Radiance Impact’s Technology division offers website maintenance and care alongside business websites, landing pages and workflow automation. To talk about what a plan for your site would include, see /technology or contact the team through /contact.
Sources
- Hardening WordPress, WordPress Advanced Administration Handbook
- Backups, WordPress Advanced Administration Handbook
