Website maintenance plans: what you actually need (and when you don’t)
Most articles about website maintenance plans are written to sell you one. This isn’t. It’s the honest version: what actually goes wrong on a small business site when nobody’s looking after it, what a proper plan should include, and when paying for one is a waste of money.
We build and maintain WordPress sites for a living, so most of the examples here are WordPress. The principles apply to any CMS, but if you’re on Wix, Squarespace or Shopify the picture is different, and we’ll get to that.
What actually happens to a WordPress site left alone
A brochure site can sit untouched for six months and look fine on the front end. The problems are underneath, and they compound quietly. Here’s the honest list, in the order things tend to go wrong.
Plugin drift
The average WordPress site runs 20 to 30 plugins. Every one of them ships updates, sometimes weekly. Skip them for six months and you get three things happening at once: security patches you didn’t apply, incompatibilities between plugins that have moved on at different rates, and features you rely on breaking when the developer pushes a major version. The site doesn’t warn you politely. You find out because a contact form stops sending, or the checkout throws a 500, or WooCommerce won’t calculate shipping any more.
Worse is when a plugin gets abandoned. The developer walks away, WordPress flags it as “not tested with the latest version”, and you’re left running code that hasn’t been touched in two years while everything around it moves on. That’s how sites get compromised.
PHP version compatibility
Your host will bump the PHP version every year or two. It has to, because older versions stop getting security support. If your theme or plugins were written against PHP 7.4 and your host upgrades to 8.3, you can end up with a white screen of death and no obvious cause. This one bites businesses that haven’t touched their site in years, because the code was written before the current PHP even existed.
Security drift
WordPress core, themes and plugins are the most-attacked stack on the web because of sheer volume. Automated bots are hitting your login page right now. On an unmaintained site the risks that actually matter are: admin accounts still using weak passwords, no two-factor authentication, an outdated plugin with a known exploit listed publicly on WPScan, and file permissions that were set loosely on install and never tightened.
The nightmare scenario isn’t defacement. It’s when your site gets used to send spam or serve malware, Google flags it in Search Console, and your rankings vanish for weeks while you clean it up.
Broken forms nobody notices
This one is quiet and expensive. Your contact form uses PHP’s mail function, or SMTP through a plugin, or a third-party service. Any of those can fail: DNS changes at your host, an SPF record that no longer matches, a Google Workspace account whose app password expired, a form plugin update that changed how submissions are stored. The form still looks fine to the visitor. It says “Thanks, we’ll be in touch.” But the email never arrives, and you don’t know until a customer rings up asking why you ignored them.
We’ve taken over sites where months of enquiries had gone missing. A £15 a month plan would have caught it inside a week.
Database bloat
WordPress stores post revisions, transients, spam comments, and orphan meta rows in the database. Left alone for a year or two on a busy site, the database grows several times bigger than it needs to be. That slows every page load, makes backups larger and slower, and eventually starts costing you money in hosting. It’s easy to clean if someone’s looking after it. It’s a slog if nobody is.
Backups nobody has ever tested
Almost every host offers backups. Almost nobody restores from them until the day they need to, and that’s the day they discover the backup runs weekly and it’s Friday, or it captured the corrupted database along with everything else, or the restore process needs a support ticket that takes 48 hours.
A backup you haven’t tested is a hope, not a plan. A real maintenance routine restores a backup to a staging environment at least once, because that’s the only way you know it works.
Core Web Vitals decay
Google measures real user performance (LCP, INP, CLS) and it factors into rankings. Sites that scored well at launch quietly get slower over time: the marketing team adds a new tracking script, someone uploads product photos straight off the phone at 4MB each, an animation plugin gets installed and never removed. None of these are dramatic on their own. Together they’re the difference between a fast site and a slow one, and you won’t see the shift unless someone’s watching.
What a proper maintenance plan should actually cover
Skip the ones that just promise “peace of mind”. Look for a plan that lists specifics. Ours covers:
- Weekly WordPress core, theme and plugin updates, applied on a staging copy first when the update is significant, so a bad release doesn’t take the live site down.
- Off-site daily backups, retained for at least 30 days, with a documented restore process that gets tested.
- A managed host or hardened server, with firewall rules, malware scanning, and an SSL certificate that renews itself.
- Uptime monitoring that pings the site every minute or two and alerts if it goes down, so we hear about a problem before you do.
- PHP and MySQL version tracking, so we know when your stack is due to move and can test everything on the new version before the host forces it.
- Form and transactional email checks, so the enquiry route from your website to your inbox actually works, month in and month out.
- Small content edits included, because if you have to log a ticket every time you change a phone number you’ll stop asking, and the site will drift.
- A named human to email or ring, with a response time in writing.
That last one is the one people undervalue. When something breaks you don’t want a chatbot. You want a person who knows your site.
When a maintenance plan is honestly overkill
We’ve told plenty of businesses they don’t need one. If any of this is you, save your money:
You have a very small brochure site on a hosted platform. If you’re on Squarespace, Wix, or Shopify, the platform handles most of what a WordPress maintenance plan buys you. Core updates, security, SSL, backups: all included. What you’re paying for is monthly fiddling and someone to ring, and if the site rarely changes, you may not need it.
You have an in-house developer or a technical co-founder. If someone on the team already runs WordPress updates on a Tuesday morning and knows how to restore a backup, an external plan is duplication. Better to spend the budget on something the internal person can’t do, like SEO or paid ads.
The site is genuinely static and gets no traffic. If you built a one-page site three years ago that gets 40 visits a month and generates no enquiries, a full care plan is not proportionate. Basic managed hosting with automatic core updates is probably enough, plus a manual review once a year.
You’re about to redesign anyway. If you know you’re rebuilding the site in the next three to six months, paying for deep maintenance on the old one rarely makes sense. Keep it patched with the essentials and put the money into the rebuild.
What we do differently
Codesky runs website maintenance plans for around a hundred small businesses across Lincolnshire and further afield. A few things we’ve learned that shape how we do it:
We test plugin updates on a staging copy before touching your live site if the update is a major version, or if it’s a plugin we’ve seen misbehave in the past. It’s slower. It saves getting a call on a Friday night.
We check contact form delivery on a schedule, not just when someone reports it. Silent failures are the most expensive kind, and once you’ve had one you never trust a form again.
We keep the plans small and readable. You get a monthly report that says what we updated, what we noticed, and what needs your attention. If we did nothing that month because nothing needed doing, we say that.
You can read what we include on our website maintenance page. If you want managed hosting and maintenance bundled, our managed hosting plans do that.
Sensible next steps
If your site is more than six months old and you’re not sure when it was last updated, do these three things this week:
- Log into WordPress and look at the updates screen. If there are more than a handful of plugins waiting, you’re overdue.
- Send a test enquiry through your own contact form using an outside email address. Did it arrive?
- Ask your host how their backups work and how long a restore takes. If they can’t give you a straight answer, that’s a problem.
None of that requires an agency. If the answers are all fine, you’re probably in better shape than most small businesses. If any of them worry you, that’s when a maintenance plan starts to pay for itself.
FAQs
How much does a website maintenance plan cost for a small business? Small business plans typically run from around £30 to £150 a month depending on what’s included and how big the site is. Bare-minimum plugin updates and backups sit at the low end. Plans that include hosting, content edits and priority support are higher. If you’re being quoted £10 a month, ask exactly what’s being done for it.
Do I need a maintenance plan if my site is on Wix or Squarespace? Usually not. Those platforms handle core updates, hosting, SSL and backups themselves. You’d only pay someone monthly if you want ongoing content changes, SEO work, or design tweaks. That’s not the same thing as a maintenance plan.
What’s the difference between hosting and a maintenance plan? Hosting is where your website lives (the server). Maintenance is the ongoing work of keeping the site itself healthy. Some agencies bundle them together, and for small businesses that’s often cleaner, because when something breaks you don’t have to work out whose problem it is.
Can I do WordPress maintenance myself? Yes, if you’re comfortable in the WordPress dashboard, you understand what a plugin does before you update it, and you have a proper backup routine. Give yourself two hours a month. The reason people pay for a plan isn’t that it’s hard, it’s that it’s easy to forget until the day it breaks.
How often should a WordPress site be updated? Plugins and themes get security releases regularly, so weekly is a sensible cadence. WordPress core has smaller point releases every few weeks and major releases three times a year. Sitting on updates for months is where problems start.
Will you support a site you didn’t build? Most agencies will, ours included, but expect an initial audit charge. Taking on someone else’s site without checking what’s in it is how you inherit their problems.
