Website maintenance services: what a good plan should cover

Good website maintenance services cover six jobs: software updates, backups that can be restored, security checks, monitoring of the site and its renewals, regular tests of forms and payments, and small edits. In India the same service is often sold as a website AMC (annual maintenance contract), and two plans with the same name can promise very different work. The difference sits in the detail: where the backups are kept, who checks an update before customers see it, and what "support" means on a Saturday night.

A note on bias: we sell website maintenance and hosting ourselves, so read this as a checklist you can hold any provider to.

What should a website maintenance plan cover?

Ask for each job in writing, with how often it happens and the proof you will see. "Complete website care" is a promise, not a task list.

Which parts do plans usually leave vague?

Backups: kept elsewhere, kept long enough, actually tested

A backup kept only on the site's own server is lost along with it if that server fails or is hacked, so at least one copy should live elsewhere. Ask how far back the copies go: hacks that plant hidden code often change nothing you can see, so a plan that keeps only the last few days may hold no clean copy by the time anyone notices. Then ask when someone last restored a backup to a test copy of the site and checked it worked, because until that happens nobody knows.

Updates: checked before and after

Updates close security holes, but they can also break things: a plugin can clash with the theme, or a payment plugin can stop talking to the gateway. A careful plan takes a backup first, tries bigger updates on a private copy of the site, and afterwards checks the pages that bring in money, such as forms, checkout and bookings.

The plan should also cover the PHP version on your hosting (PHP is the language WordPress and Laravel sites run on). PHP 8.2 stops receiving security fixes on 31 December 2026, according to the PHP project's supported versions table, so a site still on it should be tested on a newer version now. For each platform's other upkeep, from plugins to framework upgrades, see this comparison of custom websites and WordPress.

Security: a scan is not a clean-up

Scans and basic hardening should be standard: two-step login on admin accounts, blocks on common attack routes, and removal of old users such as a former employee or a previous developer. Cleaning up a hacked site is different work: finding how the attacker got in, removing what they left and closing the gap. Some plans include it, while others charge extra or exclude it, so ask before you need it.

Support and small changes: a reply is not a fix

A promised response time only means someone will acknowledge your message. Ask for urgent problems (site down, checkout broken, a hack) to be kept apart from routine requests, and for the plan to say how each is handled in the evenings, on Sundays and in festival weeks such as Diwali.

Small changes usually mean text, photos, prices, timings and contact details. A new page layout, feature or integration is project work and should be quoted in writing before anyone starts. Ask whether the allowance is counted per request or per hour, and what happens to unused time.

What has changed that older checklists miss?

SSL certificates no longer last a year

The CA/Browser Forum, where certificate issuers and browser makers agree the rules for SSL, voted in 2025 to shorten the maximum life of a certificate in steps: 200 days for certificates issued from 15 March 2026, 100 days from March 2027 and 47 days from March 2029. A "one-year SSL" bought from a reseller now has to be reissued and reinstalled within the year, and soon every few months. Certificates your host renews automatically already cope; the risk is a paid one installed by hand. The plan should renew certificates automatically or include the reinstalls, and watch the expiry date on every address the site uses, including www and any subdomains.

Form emails need the right records on your domain

Since February 2024, Google's email sender guidelines have required anyone sending to Gmail addresses to use SPF or DKIM (records on your domain proving the mail is really from you), and mail without them may be marked as spam or rejected. A contact form that sends mail from the hosting server without those records can look fine on the website while enquiries never reach your inbox. The plan should test every form each month, to the inbox that actually handles enquiries, and recheck the records whenever you change hosting or email provider.

India's six-hour reporting rule

Under CERT-In's 2022 cyber security directions, a defaced website or one with planted malicious code or links is among the incidents to report to CERT-In, within six hours of noticing it. CERT-In's FAQs add that the directions cover sole proprietorships (as a "body corporate"), that any entity which notices an incident must report it, and that the duty can't be handed to someone else by contract.

Ask your CA or lawyer how this applies to you, and make sure the plan says the provider tells you as soon as it finds an intrusion, with the details a report needs. The same directions expect logs of IT systems to be kept for a rolling 180 days, so ask your host how long it keeps your site's logs.

What extra does an online store or booking site need?

• A test order or booking after every update. Check that it shows as paid, the confirmation email arrives and stock or availability updates.
• Payment alerts that reach someone. If the site keeps rejecting Razorpay's payment confirmations (webhooks) for 24 hours, Razorpay switches them off and emails an alert that someone must read. The Razorpay setup guide covers the other settings to check.
• Tax and message changes. When GST rates on many goods changed on 22 September 2025, many stores had to update their tax settings, so agree whether such work counts as maintenance. Order SMS must match templates registered on the DLT portal, so new wording needs a new template first.
• A quiet spell before big sales. Hold back non-urgent updates ahead of a planned sale, so a routine update can't break checkout on your busiest day.

What should a monthly maintenance report show?

Ask for a sample report before you sign. A useful one fits on a page and lists:

• Updates applied, and anything held back with the reason
• The last successful backup and the date of the last test restore
• Downtime: when, for how long and why
• Security findings and any change to admin users
• Form, checkout and booking tests, with dates
• Renewal dates for the domain, hosting, SSL and paid licences, with the name and email each is registered to
• Open issues that need your decision

If every report just says "all systems normal", ask what was actually checked.

Checklist: what to agree before you sign

First, run your homepage through our free website checker for an outside view of HTTPS, redirects and any software versions your server gives away. Then get these in writing:

• Every task and how often it happens, plus a list of what is excluded
• Which third-party bills are included (domain, hosting, business email, paid plugins) and which are extra
• Who receives each alert, with at least one copy going to an inbox your business controls
• The domain registered in your business's name, and your own admin access to the site, hosting and Search Console
• For a site they didn't build, a first check of hosting, domain, software versions, backups and admin accounts
• Exit terms: a full backup of files and database whenever you ask and, if the provider hosts the site, a written right to move hosts

FAQs

Can I maintain my website myself?

Yes, for a small site, if one person owns the routine: updates with a backup first, a monthly form test, auto-renew on the domain and a look at any emails from Search Console. The harder parts to do yourself are restore tests, PHP upgrades and cleaning up after a hack. A sensible split is to make your own content edits and pay someone for those three.

How often should a website be backed up?

As often as its content changes. A brochure site edited once a month can manage with weekly copies. A store taking orders needs its database backed up at least daily, since orders and sign-ups added after the last copy are lost in a restore.

Does website maintenance include SEO?

Basic search health usually does: fixing broken links, keeping redirects working and acting on problems Search Console reports. Ongoing SEO, such as new content, local listings and earning links, is separate work with its own scope. If a maintenance plan promises rankings, treat that as a warning sign, because nobody controls Google's results.

Is a monthly plan better than paying per fix?

Paying per fix can suit a simple site that rarely changes and takes no payments, but nobody is watching between calls, so problems surface when a customer mentions them. A site that brings in enquiries, bookings or orders every day usually needs a plan, because its updates, backups and renewals can't wait for something to break.

If you'd like a second opinion on a maintenance plan you've been quoted, or want us to look after your site, send us the address and what's worrying you. We start with a read-only check of the hosting, domain, software and backups, then agree in writing what we look after as standard and what counts as a change request. You're welcome to hold us to this checklist too.