What are website maintenance services?
Website maintenance services are the regular work that keeps a live site safe, fast, accurate and recoverable: software updates, backups, monitoring, security checks and small edits. Think of it as servicing a vehicle rather than repairing a breakdown.
Every website depends on software that keeps changing. A WordPress site runs on the WordPress core, a theme, a set of plugins, a version of PHP and a database, and each of those gets updates that fix bugs and close security holes. Shopify handles the platform itself, but themes and apps still change. Even a static site built in Astro has dependencies and a hosting account that need attention.
Maintenance also covers the business side of the site. Opening hours change, staff come and go, prices move, a service is added. Sites that are not maintained drift out of date, and customers notice before owners do.
Does a small business website really need monthly maintenance?
Yes, if the site runs on a CMS such as WordPress, takes payments or collects leads through forms. A simple static site needs far less, sometimes just a quarterly check, and we will say so rather than sell you a plan you do not need.
The risk of skipping maintenance is not that something breaks on a particular day. It is that problems build quietly: a plugin stops receiving security fixes, the PHP version reaches end of life, a form’s email delivery fails and nobody notices for weeks. By the time the problem is visible, fixing it takes longer and costs more than regular care would have.
Monthly plan makes sense when
You run WordPress or WooCommerce, depend on web leads or sales, have several plugins, or nobody on staff is comfortable doing updates.
Occasional checks may do when
The site is static, rarely changes, has no plugins and sends forms through a simple, tested service.
Core, plugin and theme updates: why they are tested first
Updates should be tested on a staging copy before they reach your live site. Most update problems are conflicts between one plugin’s new version and another plugin or the theme, and staging catches them without customers seeing a broken page.
According to WordPress’s own documentation, automatic background updates arrived in version 3.7, originally covering minor core releases and translations; from version 5.6, new installations also receive major core updates automatically by default. Plugins and themes, however, mostly update only when someone applies them. That leaves a large share of a typical site’s code depending on a person remembering.
Our routine: copy the live site to staging, apply updates, check key pages, forms, checkout and any integrations, then update the live site at a quiet time for your business. If an update is known to cause trouble, we hold it and note why in your monthly report. Security releases that fix actively exploited problems are applied sooner.
- WordPress core and translations
- Plugins and premium plugin licences (renewed in your name)
- Theme and child-theme compatibility
- PHP version on the host
- JavaScript dependencies on custom and headless sites
PHP versions and hosting: the maintenance task most sites forget
Your hosting software ages as well as your site. On WordPress and WooCommerce sites, the PHP version is as important as the plugins, because an unsupported PHP version stops receiving security fixes.
The PHP project’s supported versions page shows each release branch receiving two years of active support and then two years of security-only fixes. It lists PHP 8.2’s security support ending on 31 December 2026, so sites still on 8.2 or older should plan a move to a newer branch. We check compatibility on staging, switch the version in your hosting panel and watch error logs afterwards.
Hosting itself is part of the review: disk space, database size, whether the host still suits your traffic and whether a managed WordPress host such as WP Engine or Kinsta, or an AWS setup, would serve you better. The hosting account stays yours; we only recommend.
Off-site backups and tested restores
A backup only counts if it is stored away from the website and has been restored successfully at least once. Backups kept on the same server can disappear in the same incident that takes the site down.
The US Cybersecurity and Infrastructure Security Agency recommends the 3-2-1 approach for small businesses: three copies of important data, on two different types of storage, with one copy off-site. It also advises testing that data can be restored, fully and partially, and being able to roll back at least seven days.
For websites, we keep scheduled backups of the files and database in storage separate from your host, in an account you own, with enough history to go back beyond a week. Before major updates we take an extra snapshot. A few times a year we restore a backup to a staging copy to prove it works, and note the result in your report.
Security monitoring and malware cleanup
Security maintenance is mostly prevention: fewer plugins, strong admin accounts, updates applied promptly and alerts when files change unexpectedly. Cleanup after a hack is slower and harder than any of those.
On each site we review who has admin access and remove old accounts, turn on two-factor login where the platform supports it, limit repeated login attempts, remove plugins nobody uses and scan for malware on a schedule. File-change alerts show when something modifies core files outside an update, which is often the first sign of a compromise.
If a site is hacked, the work is to contain it, find how the attacker got in, remove the malicious code, restore clean files where needed, rotate passwords and close the hole. Whether cleanup on a site we already look after falls inside your plan or is quoted separately is written into your care-plan quote, so there is no argument about it on a bad day. For a site we have never seen, we look first and then quote.
- Admin accounts reviewed and reduced
- Two-factor login where available
- Unused plugins and themes removed
- Malware scans and file-change alerts
- Passwords and keys rotated after any incident
Uptime monitoring and SSL certificates
Uptime monitoring checks your site from outside your hosting on a regular interval and alerts us when it stops responding. It means someone notices an outage before customers start calling.
We monitor the home page and, where useful, one or two important pages such as the contact form or the checkout, because a site can load its home page while the form endpoint fails. Alerts come to us and, if you like, to you. We then check whether the cause is the host, the domain, the certificate or the site itself.
SSL certificates are shortening. Let’s Encrypt currently issues certificates valid for 90 days and has announced it will cut that to 45 days by 2028, in stages. Most hosts renew automatically, but automatic renewal can fail after a DNS change or a hosting move, so we watch expiry dates as part of the plan.
Content edits during your US business day
Send content changes whenever they come up, by WhatsApp or email, and we make them in our working day, which overlaps your morning and runs through your night. Changes you send by early afternoon Eastern are often live when you start the next day.
Typical edits are new staff or provider bios, price and service changes, holiday hours, event notices, blog posts you have written, photo swaps and small layout tweaks. The number of edits a plan includes each month is set in your written quote; bigger items, such as a new section or several new pages, are quoted before we start.
For time-sensitive edits, such as closing for a storm or changing a promotion, message us as early as you can. Our team replies on WhatsApp seven days a week, and during your morning there is live overlap for a quick call if the change needs discussion.
Response times across time zones: what to expect honestly
Our working hours are in India Standard Time, which sits about nine and a half to ten and a half hours ahead of US Eastern time depending on daylight saving. That gives a live overlap in your morning and means much of our work happens while you sleep.
What that means in practice: a problem reported in your morning is usually picked up the same day; a problem reported late in your evening often reaches us at the start of our day. Any response-time commitment we make is written into your care-plan quote rather than promised on a web page, and it will be one we can actually meet from India.
If your business needs someone watching the site overnight in the US with a guaranteed response in minutes, be honest with yourself about that requirement. A provider with a staffed US overnight rota is the better fit for that one need, and some businesses pair local on-call cover with a remote team for routine care.
How much do website maintenance services cost for a US business?
With us, care plans start at US$120/mo a month. Other website maintenance services price across a wide range, and the gap usually reflects what is included: tested updates versus automatic ones, off-site versus same-server backups, how many content edits are covered and whether hack cleanup is part of the plan.
When you compare quotes, ask each provider to list the same items so you are comparing like for like. A cheap plan that runs automatic updates without testing and stores backups on the same server is doing less work than it appears. An expensive plan may include hours you never use.
What pushes a monthly price up: WooCommerce or other checkout features, a long plugin list, integrations with CRMs or booking tools, frequent content changes and custom code. What keeps it down: a lean site, a good host and content that changes rarely.
- Platform and number of plugins or apps
- Whether the site takes payments
- Expected content edits per month
- Integrations that need checking after updates
- Custom code and its dependencies
How to choose a website maintenance provider
Pick the provider who asks for a written inventory of your site before quoting and who can explain, step by step, what happens in a normal month and on a bad day. Vague plans produce vague results.
Ask where backups are stored and when a restore was last tested. Ask whether updates are tested before they go live. Ask how you report a problem, who answers, and when. Ask what happens if the site is hacked. Ask what you receive each month. And confirm that the hosting, domain and admin accounts stay in your name so you can change providers without asking anyone’s permission.
- Where are backups kept, and when was a restore last tested?
- Are updates tested on staging first?
- How do I report a problem, and when will someone look at it?
- What does the plan say about hack cleanup?
- What does the monthly report include?
- Which accounts will be in my name?
Maintaining Shopify stores and custom-coded sites
Maintenance looks different off WordPress, but it does not disappear. Shopify maintains the platform itself; custom-coded sites have their own dependencies and hosting to watch.
On Shopify, care means reviewing installed apps (and removing unused ones that still load scripts), testing the theme after app updates, checking checkout and shipping settings, keeping product data tidy and updating seasonal content. On custom sites built in Astro or Next.js, it means updating framework and library versions on a branch, running the build, checking pages and integrations, and deploying. We also watch for changes in the APIs of your CRM, booking or accounting tools, which can break integrations without warning.
If we built your site, we already know its structure. If someone else did, the first month includes a review of the code and accounts so we understand what we are looking after. See custom website development for how our own builds are documented.
What a monthly website maintenance report should show
A good monthly report shows what was done, what was found and what needs a decision, in language a business owner can read in two minutes.
- Updates applied, and any held back with the reason
- Backup status and the date of the last restore test
- Uptime for the month and any incidents
- Security scan results and account changes
- Content edits completed
- Core Web Vitals trend from Search Console
- Recommendations, such as a PHP upgrade or a plugin to replace
If you want search performance in the same report, pair maintenance with monthly SEO, from US$150/mo a month.
Handing your website maintenance to a team in India: the first two weeks
Most of the work in the first fortnight is learning your site so that routine care is quick afterwards. Calls happen in your morning, Eastern time, and the rest runs over WhatsApp and email.
Invoices are in USD and paid monthly by bank wire, Wise or PayPal, as set out in your quote. Invoices come from India; your accountant can advise on how to record them. The agreement covers what the plan includes, confidentiality and account access, and our terms and refund-policy pages set out the general basis.
Days 1–4
You add us as users on the hosting, CMS and domain accounts. We record every plugin, integration, form and renewal date in a written site record.
Days 5–9
Staging copy set up, off-site backups configured and a first restore tested; uptime and SSL monitoring switched on.
Days 10–14
First round of tested updates, security review, a list of risks we found and your first short report.
We do not visit premises or handle hardware such as office networks or printers; the plan covers your website and the services it connects to.
Worked example: a care plan for a yoga studio’s WordPress site
A hypothetical to show what a plan covers. Say a yoga and pilates studio in Boulder, Colorado, runs a WordPress site with a class-schedule plugin, WooCommerce gift cards, a newsletter form and about twenty plugins, several with lapsed licences. The owner updates nothing because the last update broke the schedule.
The first month would set up staging, off-site backups and monitoring, renew the necessary licences in the studio’s name, remove unused plugins and test updates against the schedule and gift-card checkout. After that, a normal month is tested updates, backups, scans, teacher bio and timetable edits, and a short report. The studio’s own staff would keep posting class notices themselves.
- Monthly care plan: estimated from US$120/mo a month
- Staging copy used for every update because of the schedule plugin
- Gift-card checkout tested after each WooCommerce update
- Quarterly restore test recorded in the report
This is an illustration, not a client or a quote. The real plan would depend on the plugin list, the host and how many edits the studio sends each month.
Website maintenance checklist for US business owners
Whether you maintain the site yourself or hire website maintenance services, these are the tasks and their rough rhythm.
- Weekly: confirm backups ran; review uptime alerts; apply urgent security updates
- Monthly: tested plugin, theme and core updates; malware scan; content edits
- Monthly: test the contact form and, for stores, a checkout
- Quarterly: restore a backup to staging; review admin accounts; check Core Web Vitals
- Twice a year: review PHP version, hosting plan and plugin list
- Yearly: renew domain and licences in your name; review privacy and cookie wording with your adviser
- Always: keep a list of every account, login owner and renewal date