What Website Maintenance Actually Includes

Your site is live, and now someone is offering a monthly maintenance plan, or you are wondering whether you need one at all. So what does website maintenance include? In short: keeping the software updated, taking backups you can actually restore, watching for security problems and downtime, keeping the site fast, and making small changes. Skip it and sites get hacked, slow down or quietly stop taking enquiries.

Here is what each part involves, why it matters more in South Africa than the foreign guides suggest, and how to tell a real plan from a padded line item.

What does website maintenance include?

A typical maintenance agreement covers the same core list ^[2]:

• Updates to the core software, theme and plugins.
• Security monitoring, scans and keeping the SSL certificate valid.
• Daily backups, and a tested way to restore them.
• Fixing bugs and broken features, such as a contact form that stops sending.
• Uptime monitoring, so someone knows within minutes when the site goes down.
• Performance checks, including Google's Core Web Vitals.

Core Web Vitals are Google's three measures of how a page feels to use. The targets are: the main content should load within 2.5 seconds, the page should respond to a tap or click in 200 milliseconds or less, and the layout shift score should be 0.1 or less, measured across most real visits ^[5]. A good plan checks these regularly, because new plugins, images and content slowly drag them down.

Another way to group the same work is into four areas: security, performance, content and SEO (such as fixing broken links), and technical health (such as backups and testing forms) ^[1]. Most plans run on a rhythm: security monitoring and backups daily, updates and performance reviews monthly, and a test restore of the backup each quarter ^[2].

Do websites really need maintenance?

A website is software, and software ages. WordPress, which runs a large share of South African small business sites, puts it bluntly: you should always keep up to date with the latest version, because older versions are not maintained with security updates ^[6]. Once a vulnerability is fixed in a new release, the information needed to exploit it is almost certainly public, which makes old versions more open to attack ^[6].

WordPress has applied minor and security updates to its core automatically since version 3.7 ^[7]. Plugins and themes are different: since WordPress 5.5, administrators can opt in to automatic updates plugin by plugin and theme by theme ^[10], but they are not switched on by default, and many sites leave them off because an untested update can break things. Someone still has to decide, test and watch. I go into the e-commerce side of this in is WordPress safe for e-commerce.

In South Africa there is also a legal reason. Section 19 of POPIA requires a responsible party, the organisation that decides why and how personal information is processed, to secure it with appropriate, reasonable technical and organisational measures ^[8], and to make sure those safeguards are continually updated in response to new risks ^[8]. A contact form, a customer login or an online store all hold personal information. Security is an ongoing duty, not something done once at launch. For what that means for your business specifically, get professional advice.

Hosting and maintenance are not the same thing

A common misunderstanding: "my host does all that". Good hosting keeps the server running and may take backups. Unless your plan says so, it does not update your plugins, test your checkout after an update, fix a broken form or notice that your pages have slowed down. Some managed hosting plans include some of this, so check the scope in writing; whatever is not listed sits with you or whoever maintains the site.

Load-shedding is another one. If your site is properly hosted in a data centre or the cloud, it stays online when your office loses power. What load-shedding affects is your ability to respond, which is one more reason to have monitoring that alerts someone who can act.

Where security lives also matters. On my own WooCommerce store on AWS, admin credentials are kept in AWS Secrets Manager rather than in configuration files, so a leaked file does not mean a leaked password. Small decisions like that are part of maintenance too.

What does website maintenance cost?

There is no single figure, because the work scales with the site. Locally, one South African studio offers care plans covering hosting, updates, backups and small changes from R350 a month ^[11], checked on 4 October 2026. Foreign guides, checked the same day, give much wider US-market ranges: Elementor says most small businesses pay between US$50 and US$500 a month ^[3], and Hostinger quotes anything from US$5 to US$5,000 a month ^[4]. Many South African agency pages publish build prices rather than maintenance prices; one lists once-off build packages between R1,990 and R16,900 ^[9].

What actually drives the cost:

• How many plugins and integrations need updating and testing.
• Whether the site takes payments, because a broken checkout is lost revenue.
• How fast you need a response when something breaks.
• How many content changes are included each month.

A brochure site with a contact form needs far less than an online store. Ask for the scope in writing and compare like with like.

How to tell a real maintenance plan from a padded one

• Tested restores, not just backups. A backup you have never restored is not really a backup ^[2]. Ask when they last did a test restore.
• A named rhythm: what happens daily, monthly and quarterly.
• Monitoring with alerts to a person, not just a dashboard nobody reads.
• A clear line between maintenance and projects. Small changes are upkeep. A redesign or new feature is a separate job.
• A short monthly report that says what was updated and what was found.

This is how I run it on my own builds. On a WordPress marketplace on South African cPanel hosting, every deploy takes a timestamped copy of the current build and a database dump before anything changes, then smoke-tests the critical paths by hand, so a bad release can be rolled back from those copies. An external uptime checker runs on a short interval and sends email alerts. I describe the setup in Git deployment on cPanel shared hosting.

“A plan that cannot show you a tested restore is selling you peace of mind, not maintenance.”

What to do next

• Ask any provider for the scope and the daily, monthly and quarterly tasks in writing.
• Ask when they last restored a backup to prove it works.
• List what personal information your site collects, so you know what POPIA expects you to protect.
• Decide honestly what you can do yourself: a simple brochure site can manage light upkeep, a store usually cannot.

If your site has been running without anyone looking after it, get in touch and I will check what state it is in and what it needs.