Pixelish logo in white

What Website Maintenance Services Actually Cover

Website maintenance services cover six things in almost every case: updates, backups, security, uptime monitoring, renewals, and some agreed amount of support or small changes. That list is not where plans differ. Every provider publishes more or less the same one, which is exactly why two quotes can look identical on paper and be worth very different amounts. The difference is in the strength of each item, and the words on the page do not tell you which version you are getting.

Cost is a separate question and we have answered it properly in what website maintenance costs in the UK. This post is about scope: what is in the plan, what is not, and how to tell two of them apart.

What is actually in a website maintenance plan

Strip away the marketing and a maintenance plan contains seven recurring jobs. Here they are in plain English.

Updates. The software your site runs on releases new versions constantly. Somebody applies them. On WordPress that means core, theme and plugins, and the detail of that is its own subject covered in our full guide to running a WordPress site.

Backups. A copy of your site and its database, taken on a schedule and kept somewhere that is not the same server as the site.

Security. Scanning for known vulnerabilities and malicious files, hardening the login, and having a plan for the day something gets through. The NCSC’s Cyber Essentials scheme treats security update management as one of its five basic controls, which tells you where it sits in the pecking order.

Uptime monitoring. Something checks the site is responding and tells somebody when it is not.

Renewals. Domain, certificate, any paid licences. Handled before they lapse rather than after.

Compatibility. Servers move on. PHP versions fall out of security support on a published schedule, and a site left behind long enough stops working on modern hosting.

Support and small changes. Somewhere to send the email when a page needs a new phone number on it.

Most plans are sold as website maintenance and support. The support half is the part owners end up using most, and it is usually the vaguest part of the written offer.

The same word, two very different products

Every one of those seven items exists in a weak version and a strong version. Both get sold under the same word, frequently at a similar price.

This is roughly what each one looks like on both sides.

Line itemThe weak versionThe strong version
BackupsA nightly copy nobody has ever restoredRestores tested periodically, with a stated recovery point and a known restore time
UpdatesApplied automatically, nothing checks the resultApplied on a staging copy, key pages and forms checked afterwards, rolled back if wrong
MonitoringA ping every five minutes confirming the server answersSomebody notices the contact form stopped sending, or checkout started failing at step two
SecurityA plugin installed once at setupSomeone reads what it reports, and there is a written plan for a breach
SupportAn email address and no stated response timeA response time in hours, in defined working hours, with out-of-hours behaviour spelled out
Content changes“Minor edits” with no definitionA stated allowance, with a clear line on what counts as minor
ReportingA monthly PDF of graphsA note when something needed attention, and what was done about it

Two of those need expanding.

Backups fail quietly. The database gets excluded, the schedule breaks after a server move, the destination fills up. A backup job reporting success is only reporting that it ran, so none of that surfaces until the day somebody needs the site back. There is little point asking a provider whether they take backups, because everyone says yes. Ask when they last restored one, and how long it took.

Uptime monitoring is the most oversold item on the list. A ping tells you the server responded. It does not tell you the contact form stopped sending, that the payment gateway started declining cards, or that a plugin update quietly removed your phone number from the header. Failures like those can run for weeks with the uptime check reporting 100% throughout.

If you want to see how those two halves shake out in practice, our own care plans are written to say which version of each item you are getting.

Person checking a website across a monitor and a phone

What maintenance does not cover

This is where most of the friction in these relationships comes from, and it is almost always a scope misunderstanding rather than anyone behaving badly.

A maintenance plan keeps your website working. It does not extend it. The following normally sit outside:

  • New features. A booking system, a members area, a product filter. That is a build.
  • Redesigns. New layouts, new templates, a refreshed look. Also a build.
  • New pages. Adding a service page is creating something, not maintaining something.
  • SEO work. Keeping the site online is not the same as making it findable, and SEO is a separate piece of work with a different rhythm and different measures.
  • Content writing. Publishing what you send is maintenance. Deciding what it should say is not.
  • Third-party services. If your CRM changes its API or your payment provider has an outage, that is somebody else’s estate.

The grey zone sits between a fix and a change, and that is where most of the disagreements start. The rule we use is simple enough to borrow.

If it used to work and now it does not, it is a fix. If it never existed, it is a change. Most disagreements come apart on that one distinction. Worth asking a provider whether they agree with it before you sign rather than after.

What we would deliberately leave out

Some things get sold in maintenance plans mainly because they look like value on a page. We leave these out on purpose.

The monthly PDF report. Twelve pages saying uptime was 99.98% and fourteen plugins were updated. Owners tend to stop opening them after a couple of months, and fairly, because a list of completed tasks says very little about how the site is doing. We send a short note on the months when something needed attention instead.

A client dashboard. A login with dials on it usually gets visited twice and then forgotten, and it leaves you working out what the numbers mean. We would rather be the ones reading them.

Unlimited content edits. Either it is not really unlimited, or it is priced on the assumption you will never use it. We state an allowance instead.

Malware removal promises presented as insurance. Any competent provider is going to clean up an infected site they were being paid to protect. It does not need to be a headline feature.

Bolted-on “basic SEO monitoring”. A rank tracker running in the background is neither maintenance nor SEO, and the number it produces rarely leads to anybody doing anything.

Performance is the one place we would push the other way. Google’s Core Web Vitals documentation sets out what page experience is actually measured on, and a site gets slower gradually as pages and images accumulate. That is worth watching properly.

Three questions that tell two plans apart

You do not need to audit a provider. Three questions will usually do it, and they are quick enough to ask on the phone.

  1. When something breaks, is fixing it inside this plan or quoted separately? Plenty of plans cover noticing the problem and quote separately for solving it. That can be a fair arrangement, as long as you know it is what you bought.
  2. When did you last restore a backup, and how long did it take? A provider who does this regularly will answer immediately and give you a number. If they have to go away and check, they probably have not.
  3. What is your response time, in what hours, and what happens outside them? Support with no stated response time is impossible to plan around. “We aim to respond quickly” means very little on the Friday your checkout stops taking payments.

Then one optional fourth, if the plan includes changes: what counts as a small change, and does unused time roll over. The included-changes line is the one owners genuinely use, and it is usually the reason a site stays current instead of slowly ageing. We wrote separately about why small business websites quietly stop being updated, and it is almost never a decision anyone made.

Frequently asked questions

What do website maintenance services include? Updates to the site software, backups, security scanning, uptime monitoring, domain and certificate renewals, compatibility work as servers move on, and usually a small allowance of support or content changes. Every provider lists roughly the same items, so the useful comparison is how thoroughly each one is done rather than whether it appears.

What is the difference between website maintenance and website support? Maintenance is the scheduled work that happens whether you ask or not: updates, backups, scans, renewals. Support is what you get when you need something, which might be a fix, a question answered, or a small change. A plan that offers one and calls it both is worth querying.

Does website maintenance include adding new pages or features? Normally no. Maintenance keeps what exists working. Adding a page, a booking system or a new section is building something new and is usually quoted separately. Many plans include a small monthly allowance for edits to existing content, which is a different thing and worth confirming in writing.

Is SEO part of website maintenance? Not usually, and it should not be assumed. Maintenance keeps a site online, secure and fast, which supports search performance without being search work. Content, keyword targeting, internal linking and technical SEO improvements are a separate ongoing service with different measures and a different reporting rhythm.

Do I still need maintenance if my website hardly changes? Yes, and arguably more. A site nobody touches still runs software that ages, certificates that expire and a server that gets upgraded underneath it. The sites we are asked to rescue are rarely busy ones. They are the ones that worked fine and were left alone for two years.

How do I know if my current provider is actually doing anything? Ask for the last three months of update records and the date of the last backup restore test. A provider doing the work will produce both without fuss. If the answer is a dashboard screenshot or a generic monthly report, you have learned something useful.

What happens if my website gets hacked while on a maintenance plan? That depends entirely on the plan, so read it before you need it. Check whether clean-up is included or chargeable, how far back the backups go, what the recovery time is expected to be, and who tells your customers. A plan with no written answer to those is not covering the scenario it is sold on.

Comparing two quotes

The feature list will not separate two plans, because they all carry the same one. The three questions will, and it is worth noticing which answers come back with actual numbers in them.

If you would rather we just looked at what your site actually needs, you know where we are.

James Taylor
James Taylor
James Taylor is the founder of Pixelish, a Doncaster-based web design and WordPress development agency. He has 14+ years of experience building bespoke WordPress websites for small businesses across the UK.

Other articles from the blog

Pixelish logo in white 01302 315 156 4 Cavendish Court, South Parade, Doncaster, DN1 2DJ
Doncaster Chamber of Commerce logofederation of small businesses logo

© Copyright 2026, All Rights Reserved by Pixelish