TL;DR: A website maintenance plan is a monthly service that keeps your site updated, backed up, monitored and secure. A good one covers WordPress core, theme and plugin updates, daily off-site backups, security scanning, uptime monitoring and a real person to email when something breaks. UK plans typically run from £20 to £80 a month. RTWD’s Website Care Plan is £39 a month.
What is a website maintenance plan?
A website maintenance plan is a monthly service where someone looks after the working parts of your website so you do not have to. It covers the jobs that have to happen whether or not you have time for them: updating the software your site runs on, taking backups and storing them somewhere else, watching for security problems, checking the site is still online, and fixing things when they go wrong.
The plainest way to put it is this. Your website is not a leaflet. A leaflet, once printed, stays printed. A website is a piece of software sitting on a computer in a data centre, connected to the internet, running code written by dozens of different people. Software needs looking after. Left alone for a year, a website does not stay still. It drifts.
Most small business owners I speak to have never been told this. They were sold a website, it was lovely, and nobody mentioned that it would need anything afterwards. Then eighteen months later something stops working and there is nobody to ring.
What should be included in a website maintenance plan?
This is where plans differ wildly, and where it pays to read what you are actually buying. A maintenance plan should cover six things. If a plan you are looking at is missing one of these, ask why.
- Software updates. WordPress core, your theme, and every plugin. Weekly is sensible. This is the single most important item on the list, for reasons I will come to.
- Off-site backups, taken daily. Both the files and the database. Off-site matters: a backup stored on the same server as the website is not much use when the problem is the server.
- Security scanning and a firewall. Something watching for known vulnerabilities and blocking the obvious attempts.
- Uptime monitoring. An automated check that pings your site around the clock and raises an alarm when it stops answering. Without it, the first person to notice your site is down is usually a customer.
- Support from a person. Somewhere to send an email when something looks wrong, and a human who replies.
- A report you can actually read. Once a month, in plain English: what was updated, what was blocked, whether the backups ran.
What a maintenance plan is generally not is a design service. Redesigns, new pages, new features and content writing normally sit outside it, or are counted separately. That is reasonable. It is worth knowing up front so you are not disappointed later.
Why do the updates matter so much?
Because this is the part people skip, and it is the part that causes the most damage.
Patchstack, who track security problems across the WordPress ecosystem, found 11,334 new vulnerabilities reported in 2025, a 42% increase on the year before. Of those, 91% were in plugins and 9% in themes. WordPress core itself had six, all low priority.
Read that breakdown again, because it is genuinely reassuring. WordPress itself is not the weak point. The weak point is the collection of add-ons bolted onto it: the contact form, the booking widget, the gallery, the SEO plugin, the cookie banner. A typical small business site runs fifteen to twenty five of these, each written by a different developer, each updated on its own schedule, each a small piece of someone else’s code that you are trusting.
The same report notes that 46% of those vulnerabilities had no fix from the developer by the time the problem was made public. That is the part that argues for having someone paying attention rather than just having automatic updates switched on. Sometimes the right move is to replace a plugin whose author has stopped maintaining it, and no automated system will make that call for you.
Meanwhile the UK government’s own Cyber Security Breaches Survey 2025 found that just 32% of businesses have a policy to apply software security updates within 14 days. Two thirds do not. Not through carelessness. Through not having anyone whose job it is.
What does a website maintenance plan cost in the UK?
Prices sit in fairly predictable bands, and what moves the number is how much human attention is bundled in rather than the technical work itself. The automated parts cost roughly the same whoever does them.
| Monthly price | What you generally get |
|---|---|
| £10 to £20 | Automated updates and backups, little or no human oversight, support by ticket queue if at all. Often a plugin doing the work with nobody watching it. |
| £25 to £50 | The full list above, checked by a person, with email support and a monthly report. Where most small business sites belong. |
| £60 to £120 | The above plus content edits included, faster response commitments, staging sites, performance work. |
| £150 and up | Agency retainers. Usually bundles marketing, SEO or design time alongside maintenance. |
RTWD’s Website Care Plan is £39 a month. That covers weekly WordPress core, theme and plugin updates, daily vulnerability monitoring, a security scan and server-side firewall, daily off-site backups of files and database, 24/7 uptime monitoring, monthly reports, and support by phone and email during working hours.
If your website is part of a Pay Monthly plan, maintenance is already in there. You do not need both. It is worth saying plainly, because maintenance is the thing people search for separately and then buy twice.
Do you actually need one?
Not necessarily, and I would rather say so than sell you something you do not need.
If your site is a single static page with no forms, no bookings and no plugins, hosted somewhere that handles its own updates, you can probably leave it alone for long stretches. Some sites genuinely are leaflets.
You are much closer to needing a plan if any of these are true. Your site takes enquiries or bookings. It runs WordPress with a handful of plugins. It handles personal data, which for a therapist means every enquiry form you have. Or you would not know how to tell whether it had been updated, and would not know where to start if it broke.
That last one is the honest test. The question is not whether you are technical. It is what happens on the Tuesday morning your site shows a white screen twenty minutes before a client is due to look at it.
What a maintenance plan will not fix
It will not make you findable. Maintenance keeps a site working; it does not make it rank. If nobody is enquiring through a site that is technically in perfect health, the problem is somewhere else, usually in what the pages say and who they are aimed at. I have written separately about why a well-built site can still get no enquiries.
It will not catch everything silently either. Some failures do not announce themselves. A contact form can stop delivering email while the page still shows a cheerful “thank you, your message has been sent”. Uptime monitoring will not spot that, because the site is up. It is worth sending yourself a test enquiry now and then, whoever looks after your site.
And a plan is not a substitute for owning your own website. Keep the domain in your name, know where the hosting is, and make sure you could take your site elsewhere if you wanted to.
A word on doing less
There is a version of maintenance that quietly becomes the problem. I did this to myself.
I built a dashboard to run my own business on, and then kept building it. Boards for work I no longer did. Sorting rules deciding where things went. Structure added because adding it was satisfying. Eventually I spent a day taking it apart rather than extending it: renamed or removed the boards I never opened, loosened the rules, and brought the whole thing back to a simple list. The tool had started to outrun the time I had to use it.
Websites go the same way. Nineteen plugins where six would do. A slider nobody scrolls. A booking system installed for an idea that never happened. Every one of those is another thing to update, another thing that can break, another small piece of someone else’s code you are trusting. The most useful maintenance work I do for clients is often deletion.
So if you are looking at a maintenance plan, do the cheap thing first. Open your plugin list and ask what each one is for. Anything you cannot answer for is a candidate for removal.
How to choose someone to look after your site
Four questions worth asking, and what a good answer sounds like.
- Where are the backups kept, and how quickly can you restore one? You want “off-site, daily” and a straight answer on timing. The National Cyber Security Centre makes the point that it is not enough to have a backup: you need to know how to restore it, and to have checked it contains what you think it does.
- Who actually replies when I email? With a solo person or a small outfit, you are talking to the person doing the work. With a larger agency, ask.
- What is not included? A clear exclusion list is a sign of someone being straight with you rather than hoping you will not ask.
- Can I leave, and what do I take with me? You should be able to walk away with your domain, your files and your database.
I look after just over fifty websites on RTWD hosting, and the pattern is consistent: the sites that cause problems are almost never the ones with the most complicated setups. They are the ones nobody has looked at in a year.
Frequently asked questions
What is a website maintenance plan?
A website maintenance plan is a monthly service that keeps a website’s technical side working. It normally includes updates to WordPress core, the theme and all plugins, daily off-site backups of files and database, security scanning, around-the-clock uptime monitoring, a monthly report, and access to a person for support. Prices in the UK usually run between £20 and £80 a month depending on how much human attention is included. The point of a plan is that these jobs happen on a schedule regardless of how busy you are, rather than being remembered after something has already broken. Maintenance normally excludes design changes, new pages and content writing, which are either charged separately or counted as a set allowance.
What should be included in a website maintenance plan?
Six things. Weekly updates to WordPress core, theme and plugins. Daily backups of both files and database, stored off-site rather than on the same server as the website. Security scanning and a firewall. Uptime monitoring that alerts someone when the site stops responding. Support from a person you can email. And a monthly report in plain English telling you what happened. If a plan is missing any of those, ask why before you buy. Be especially careful about where backups are stored, because a backup kept on the same server as the site is no help when the server is the thing that failed.
How much does website maintenance cost in the UK?
Most UK small business maintenance plans sit between £20 and £80 a month. Below about £20 you are usually buying automation with nobody watching it. Between roughly £25 and £50 you get the full technical list checked by a person, with email support and a monthly report, which is where most small business websites belong. Above £60 you start seeing content edits included, faster response commitments and staging sites. Agency retainers from £150 a month usually bundle marketing or design time alongside the maintenance. RTWD’s Website Care Plan is £39 a month, and maintenance is already included in the Pay Monthly website plans.
Can I just do website maintenance myself?
Yes, if you are willing to be consistent about it. The technical steps are not difficult: check for updates weekly, take a backup before you apply them, verify the site still works afterwards, and keep a copy of that backup somewhere other than the server. The difficulty is not skill, it is consistency over years. The UK government’s Cyber Security Breaches Survey 2025 found only 32% of businesses have a policy to apply security updates within 14 days. If you do run it yourself, the one habit that matters most is taking a backup before updating, and occasionally checking you can actually restore it.
What happens if I never update my website?
Usually nothing, for a while. Then one of several things. A plugin with a known security hole gets found by an automated scanner, and your site starts serving spam links or redirecting visitors somewhere else. Or your host upgrades the version of PHP the server runs and your outdated theme stops working, taking the site down. Or a plugin update you finally apply after two years conflicts with everything around it, because you have skipped thirty intermediate versions. The gradual version is more common than being hacked: things quietly stop working, forms stop sending, and nobody notices for weeks.
Does a maintenance plan help my Google rankings?
Only indirectly. Maintenance keeps a site fast, secure and available, and all three matter to Google, but keeping a site healthy will not make it rank for anything it was not already going to rank for. Rankings come from what your pages say, who they are aimed at, and whether they match what people actually search for. If your site is technically sound but getting no enquiries, the problem is almost always the content rather than the maintenance. Treat them as separate jobs: maintenance protects what you have, and SEO work is what grows it.
If you would rather not think about it
That is a reasonable position, and it is most of my clients. Looking after the technical side of a website is genuinely dull work, and it is the sort of dull work that only shows up when it has not been done.
The Website Care Plan is £39 a month and covers everything on the list above. If you are getting a new site built, maintenance comes as part of the Pay Monthly plans, so there is nothing extra to add.
If you are not sure what your site is currently running, or whether anyone is looking after it, feel free to get in touch and I will take a look and tell you honestly. No pressure, no pitch.
Have a Wonderfilled day.