A website maintenance plan is a written list of the jobs that keep your site safe, fast and accurate, how often each one happens, and the name of the person responsible for it. To create one, list the tasks (updates, backups, security checks, speed tests, broken links, content reviews), give each a schedule from weekly to yearly, assign an owner, and write down where the logins and backups live. One page is enough. The plan only fails when nobody's name is on it.
Here's what goes in it, a schedule you can copy, and how to decide whether to run it yourself.
Why it needs to be written down
Websites don't break all at once. A plugin falls a few versions behind, a form quietly stops sending, a page about a service you dropped two years ago keeps ranking, and the security certificate lapses on a Friday afternoon while the one person who knew the hosting login is on vacation. Each one is easy to fix. Together, unnoticed for months, they're how a working site turns into a liability.
Security is the part with real teeth, especially on WordPress. Patchstack's State of WordPress Security report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before, and 91% of them were in plugins. The same report found that about half of high-impact vulnerabilities were exploited within 24 hours. Updates can't wait.
A schedule you can copy
| How often | Task | What you're checking |
|---|---|---|
| Weekly | Software and plugin updates | Core, theme and plugins are current; anything unused is deleted |
| Weekly | Backups | The latest backup ran and is stored off the server |
| Weekly | Form test | Submit the contact and quote forms and confirm the email arrives |
| Monthly | Search Console review | New indexing errors, security warnings, drops in clicks |
| Monthly | Speed check | Homepage and top service pages on the mobile setting |
| Monthly | Broken links | Internal links, the phone number and the directions link all work |
| Quarterly | Backup restore test | Restore a copy to a test site and confirm it actually works |
| Quarterly | Content review | Services, areas, team, certifications and photos are current |
| Yearly | Renewals and access | Domain, hosting and certificate renewal dates; who has admin logins |
Tools that cost nothing
Two free tools from Google cover most of the monthly checks, and between them they'll catch the problems a busy owner is least likely to notice from the front end of the site, such as pages that have dropped out of Google's index, a security warning on a page nobody visits, or a mobile load time that has crept up a little every month since the last redesign. Google Search Console shows pages Google can't index, security issues it has found on your site, and which searches bring people in. PageSpeed Insights tests any page and, on the mobile setting, shows how fast it loads for real visitors.
For a single outside view of the site, our Free AI Visibility Check looks at your website, your mobile speed, whether you come up in a local search, and what an AI assistant says when a buyer asks who to call. No email needed. It's a reasonable thing to run each quarter alongside the content review.
Who owns each job
Write a name next to every row. A role isn't enough.
In a small company, it's often split: the office manager tests the forms and updates team photos, an outside developer or the host runs updates and backups, and the owner or a sales lead reviews the service pages once a quarter. That works, as long as everyone knows their rows and someone checks the whole list. Keep the logins in a shared password manager, not in one person's inbox, and record where backups are stored and how to restore one.
Measure whether the plan is working
Keep it simple. Count how often the site was down, whether any form went unnoticed while broken, whether the mobile speed result held steady, and whether Search Console shows new errors. Quiet numbers mean it's working. If the same problem keeps coming back, the task needs a new owner or a shorter interval.
Doing it yourself, or handing it off
A company with a capable in-house web person, or a developer on retainer who answers quickly, can run this plan well. Print the table. Add names. Start.
If maintenance keeps sliding because nobody has the time, Inbound SDR includes it. We build a website of up to 100 pages in the first month, host it, and keep it healthy with site health maintenance and ongoing monitoring. Technical SEO is covered too: crawl and indexing fixes, sitemaps, page speed, Core Web Vitals, mobile and structured data. Your strategist has 2 to 3 expert hours a month for technical fixes and page changes, and a new blog goes up every business day, shared to up to 3 social platforms, so the content review never falls years behind. Packages start at $1,000 per month on a 12-month term, with a monthly report.
It's built around a site we build and host, so it isn't a maintenance-only contract for an existing site you want to keep exactly as it is. For that, a care plan from your host or developer is the better fit.
Maintenance questions
How much does website maintenance cost?
It ranges from your own time, if you do it in-house, to a monthly fee from a host, developer or managed service. Compare what's included, especially restore tests and who fixes broken forms.
Can I just turn on automatic updates?
For minor updates, usually yes. Major updates can break a theme or plugin, so check the site after they run and keep a recent backup.
Which task is easiest to skip?
Testing a backup restore, because nothing looks wrong until the day you need it.
Get the next one in your inbox
New playbooks, benchmarks and guides from our sales floor, for owners and sales leaders who sell to businesses. One email a month. See past issues.
