What website maintenance actually involves each month
Find out what a maintenance retainer really covers each month, what it never covers, and which businesses are paying for nothing.
You are either paying for this blindly or not paying at all
Most small businesses sit in one of two positions. Either a monthly amount leaves the account for website maintenance and nobody can say what was done for it. Or nothing is paid and nothing happens until the site goes down on a Saturday. Both positions are expensive and both come from the same cause. Maintenance is sold as a word rather than as a list.
Maintenance is routine custody of a live system. The software your site depends on changes every few weeks whether or not you touch the site. The work is keeping up with those changes without breaking anything and knowing you can put the site back if something does break.
What a retainer excludes before what it includes
Maintenance does not include new features and it does not include new pages. It is not search optimisation and it is not content writing. A redesign is not maintenance. Hosting, the domain renewal and paid plugin licences are usually billed separately or passed through at cost. Recovery after a site is compromised often falls outside the monthly scope as well because the effort is unpredictable. Read that clause before you need it.
Inside the scope the list is short and should be written down. Core, theme and plugin updates applied in a controlled way. Backups taken on a schedule and a restore tested rather than assumed. Uptime monitoring with somebody actually receiving the alert. A check that the SSL certificate will renew. A live test of every form that collects enquiries. A small allowance of content edit time measured in hours. GST at 18% applies to the fee.
Who is paying for nothing
A static brochure site on a managed platform with no plugins and no forms does not need a monthly retainer. The platform handles the updates. Paying a recurring fee for a site that changes twice a year is a subscription to a report. Pay for work when work is needed and keep a hosting plan that takes automatic backups.
The harder case is the business that gets no enquiries from its site and updates nothing on it. Buying maintenance there protects an asset that is not earning. Decide whether the site has a job first. If it does not then the cheapest responsible option is a current backup and decent hosting while you decide. A business with an in-house developer is usually buying a duplicate.
Sites that genuinely need monthly custody are the ones with moving parts. Payments, logins, bookings, integrations with accounting or CRM software, or a large catalogue. In those cases a failure is not cosmetic. It stops orders.
The actual monthly sequence
A competent month starts with a backup taken before anything is touched. Updates are applied on a staging copy rather than on the live site. The key journeys are then walked through by hand. Load the home page, open a product or service page, submit the contact form, complete a test transaction if you take payments. Only then do the changes move to live.
The rest is inspection. Error logs are read for repeated failures. The uptime record for the month is reviewed rather than filed. SSL expiry dates are checked ahead of time because an expired certificate makes a site look dangerous to every visitor at once. A restore is performed from a real backup periodically because an untested backup is a belief rather than a safeguard.
How to judge whether you are getting value
The metric that matters is recovery. How long would it take to put the site back as it was yesterday and when was that last demonstrated rather than described. After that comes the number of days a broken thing stayed broken before anyone noticed. A contact form that stopped delivering in March and was found in June costs more than the whole year's retainer.
The metric that flatters is an uptime figure near one hundred per cent. A site can be up and still be useless with a failed form or a payment gateway left in test mode. A monthly report listing the number of updates applied flatters in the same way because the count says nothing about what was tested.
The mistake that costs the most
The common mistake is treating email delivery as somebody else's problem. Enquiry forms send through the server by default and that mail is increasingly refused or filed as spam. Nobody notices because the failure is silent. There is no bounce and no error on screen. Businesses discover it when a customer calls to ask why they were ignored. The fix is a proper sending service and a test submission every month.
The second version is applying updates directly on the live site with no backup in hand. It works most times. The time it does not you are editing files at midnight to recover a storefront.
Settle these points before signing
Agree the response expectation for an outage in writing and agree who receives the alert. Confirm that the domain and hosting accounts are registered to your business rather than to a supplier. Establish what counts as an included hour. Then agree what happens at exit, because handover of credentials and a current backup is the clause people forget until they need it.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.