Guide. Last reviewed 3 November 2026
Website maintenance and updates: what a plan includes
Website maintenance and updates cover the regular work that keeps a site secure and working. That means software updates, backups, security checks, monitoring, fixes and a report. This checklist sets out each task by how often it runs and what to ask a provider.
What does website maintenance and updates include?
A plan should cover six areas. Check that each one is named in the plan you are offered.
- Updates. Core software, plugins, themes and the server software they run on.
- Backups. Files and database, stored away from the site, with restores tested.
- Security. Account protection, access control and attention to alerts.
- Monitoring. Whether the site is up, how fast it loads and whether forms and key pages work.
- Fixes. Who repairs what breaks, and how fast they respond.
- Reporting. A regular note of what was done and what needs your decision.
The right amount depends on the site. A brochure site with a few pages needs less than an online shop that takes payments. For the money side, read our website maintenance cost guide.
Checklist
Checklist by frequency
Tick each task off against your plan. The rhythm column is our suggestion, not a standard. The last column shows where a rule comes from.
| Task | Suggested rhythm | Where it comes from |
|---|---|---|
| Automatic backup of files and database | Daily | NCSC: back up everything the business needs, including your website. WordPress: back up your files and database |
| Uptime alerts and a check that key pages load | Daily, automated | Our suggestion |
| Apply core, plugin and theme updates, after a backup | Weekly | WordPress: keep core, plugins and themes up to date and back up before upgrading |
| Confirm backups completed and are usable | Weekly | WordPress: verify the backups are there and usable |
| Review security alerts and failed logins | Weekly | Our suggestion |
| Test a restore from backup | Monthly | NCSC: know how to restore. NCSC ransomware guidance: regularly test and monitor the health of backup data |
| Review user accounts and remove unused ones | Monthly | Our suggestion |
| Remove unused plugins and themes | Monthly | WordPress hardening guide: remove plugins you are not using |
| Confirm two step verification on admin and hosting accounts | Monthly | NCSC: turn on two step verification for important accounts |
| Check page speed and Core Web Vitals | Monthly | web.dev: Core Web Vitals are measured at the 75th percentile of page loads |
| Test forms, checkout and other key pages | Monthly | Our suggestion |
| Send the maintenance report and agree actions | Monthly | Our suggestion |
| Review hosting, domain and certificate renewals, and the plan itself | Yearly | Our suggestion |
Adjust the rhythm to the site. A shop may need daily backups and weekly restore tests. A small brochure site may need less.
Security and backups
Updates
The NCSC says the best way to protect against viruses is to keep all your devices up to date. Updates fix bugs that criminals could use. The same logic applies to a website’s software.
WordPress says you should always keep up to date with the latest version, because older versions are not maintained with security updates. It also says to keep plugins current, and notes that WordPress has had automatic updates since version 3.7.
WordPress also says minor core updates, such as maintenance and security releases, are on by default for existing installations. It describes disabling them as strongly discouraged.
Backups
The NCSC says to back up everything your business needs to operate, including your website. It suggests keeping two backups, one online and one on a storage device, in case one is lost, stolen or fails.
It also says you need to know how to restore the data and to check that the backup holds your important files. The NCSC adds that its backup principles are effective in practice only if system owners regularly test and monitor the health of the backup data.
Before an upgrade, WordPress says to back up your files and database and to verify the backups are usable. It warns that a rollback is near impossible without one.
Accounts and access
The NCSC calls two step verification one of the most effective ways to protect online accounts when passwords are still in use. It says to use a strong password that you do not use for any other account.
WordPress says the dashboard file editor can be turned off. It advises locking file permissions down as far as possible and says to delete plugins you do not use. It says its article is not the ultimate quick fix for security.
Speed
Google’s web.dev describes Core Web Vitals as three measures of loading, interactivity and visual stability. A page passes only if it meets all three targets at the 75th percentile of page loads.
What is usually extra?
Plans differ, so ask what sits outside the monthly fee. These are the usual points to check.
- Hosting, domain and certificate costs.
- Premium plugin and theme licences.
- Content edits and new pages.
- New features and design changes.
- Recovery after a hack, if the plan covers prevention only.
- Search engine work and accessibility audits.
Questions to ask a provider
- Which of the six areas does the plan cover, in writing?
- How often do backups run, where are they stored and when did you last test a restore?
- Do you update everything, including premium plugins, and do you test before you update live?
- Which accounts do you need access to, and do you use two step verification?
- What do you monitor and how fast do you respond to an alert?
- What counts as a fix inside the plan and what is extra?
- What report do I receive, and how often?
- Who owns the accounts, the backups and the content if I leave?
Planning a rebuild or a move? Our website redesign cost guide and SEO migration checklist cover what to protect.
Sources
Every figure or rule on this page comes from a public page we opened and read. Last reviewed 3 November 2026.
- NCSC: Backing up your data, for what to back up, where to store it and how to restore.
- NCSC: Ransomware resistant backups, for regular testing and monitoring of backup data.
- NCSC: Protecting your devices, for keeping software up to date.
- NCSC: Secure your important online accounts, for two step verification and unique passwords.
- WordPress developer resources: Hardening WordPress, for updates, strong passwords, file permissions, the file editor and unused plugins.
- WordPress developer resources: Updating WordPress, for backing up before upgrades and default minor updates.
- web.dev: Web Vitals, for the three Core Web Vitals and the 75th percentile.
This guide is general information. It does not replace advice on your own site.
FAQ
Maintenance plan questions
Which tasks belong on a website maintenance checklist?
A good plan covers updates, backups, security, monitoring, fixes and reporting. Ask for each area to be named in writing.
Which maintenance tasks need doing every week?
Each week, check for updates and apply them after a backup, confirm the backups completed and review security alerts. WordPress applies minor core security updates by default on most sites, but plugins and themes need attention too. Our suggested rhythm is in the checklist above.
Do I need backups if my host does them?
Yes. The NCSC suggests keeping two backups, one online and one on a storage device, in case one fails. Also check that you can restore from them, and that the backup includes the database.
Is security monitoring part of maintenance?
It should be, but plans differ. Ask what is monitored, what triggers an alert and who acts on it. The NCSC advice on updates, backups and two step verification is a sensible baseline.
What is not covered by a plan?
That depends on the plan. Hosting, premium licences, content changes, new features and recovery after a hack are the usual points to check.
What does a plan cost?
It depends on the size and complexity of the site and how much support you want. Our website maintenance cost guide explains the pricing models. Zemash pricing depends on scope, so book a 15 minute call or email contact@zemash.com.
Related service
Website maintenance from Zemash
Read about our website maintenance service.
Pricing depends on scope. Book a 15 minute call or email contact@zemash.com.
To compare costs first, read our website maintenance cost guide.
Last reviewed 3 November 2026. Written by Zemash Ltd.
Want your site checked against this list?
Book a 15 minute call and we will talk through what your site needs.