What a Website Maintenance Plan Should Include in 2026 (and What It Costs)
A website maintenance plan in 2026 should cover security updates, tested off-site backups, uptime alerts, content changes, accessibility checks, speed and search monitoring, and a monthly report. For most small business sites that is two to six hours of skilled work a month. At agency rates that works out to roughly $200 to $900 a month, plus hosting.
Key takeaways
- Plugins cause most WordPress risk. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins.
- Speed of patching matters. Patchstack found that heavily exploited flaws reached mass attack in a weighted median of 5 hours.
- Pay for named tasks and response times, not a vague "we keep it running" promise.
Why does a small business website need a maintenance plan at all?
A website is software that sits on the open internet. Attackers scan for old code every day, forms quietly break, and content goes out of date. A maintenance plan is a schedule that catches those problems before a customer does. Without one, most owners learn their site is broken from a lost lead.
Think of it like servicing a work truck. Nobody plans to break down. The oil change is cheap compared with the tow, the lost day and the missed jobs.
Three things changed the math in the last two years:
- Attacks got faster. Patchstack's State of WordPress Security in 2026 report says about half of high-impact vulnerabilities were exploited within 24 hours.
- Accessibility got more attention. The Department of Justice says in its web accessibility guidance that businesses open to the public need accessible websites.
- Search got pickier. Google and AI search tools reward pages that load fast, stay accurate and work on phones.
The FTC's cybersecurity guide for small business puts it plainly: if your host gives you a prebuilt site or software package, use the latest versions with current security patches. A maintenance plan is how that actually happens month after month.
What should a website maintenance plan include in 2026?
A complete plan covers seven jobs: software updates, backups, uptime and security monitoring, content updates, accessibility checks, speed and search health, and reporting. Each one needs a set schedule and a named person. If a quote does not list these jobs in writing, assume some of them are missing.
Use this table as your checklist when you compare plans or build your own routine.
| Task | How often | What "done" looks like |
|---|---|---|
| Core, theme and plugin updates | Weekly, plus same day for critical security fixes | Updates applied on a staging copy or with a backup first; site checked after |
| Backups | Daily for active sites, weekly for simple ones | Copies stored off the host; one test restore each quarter |
| Uptime monitoring | Every few minutes, automatic | Alerts go to a real person who responds within an agreed time |
| Security scan and login review | Weekly | Malware scan clean; old user accounts removed; two-factor login on |
| Form and phone-link tests | Monthly | Every form sends; every tap-to-call link dials the right number |
| Content updates | As needed, with a monthly hour bank | Prices, hours, services, staff and photos match reality |
| Accessibility check | Monthly scan, yearly manual review | Contrast, alt text, form labels and empty links fixed |
| Speed check (Core Web Vitals) | Monthly | Key pages meet Google's "good" thresholds on mobile |
| Search Console and broken links | Monthly | Indexing errors and 404s reviewed and fixed |
| Domain, SSL and email settings | Quarterly | Domain on auto-renew; certificate valid; SPF, DKIM and DMARC in place |
| Report to owner | Monthly | One page: what was done, what broke, what needs a decision |
The sections below explain why each item earns its place.
How often should plugins and platform software be updated?
Check for updates at least weekly, and apply critical security patches the same day they come out. Patchstack found the most heavily attacked WordPress flaws reached mass exploitation in a weighted median of five hours. A monthly update habit leaves a site open for weeks.
The Patchstack numbers for 2025 are worth knowing if you run WordPress:
- 11,334 new vulnerabilities, up 42% from 2024.
- 91% were in plugins, 9% in themes, and only 6 in WordPress core, all low priority.
- 46% had no developer fix when they were made public.
- Premium (paid) plugins were not safer. They had three times more known exploited vulnerabilities than free ones.
That 46% figure matters most. Updating is not enough when no update exists yet. A good plan also removes plugins you do not use, replaces plugins that stop getting updates, and uses a firewall or virtual patching service to block attacks on known holes.
Patchstack also tested regular hosting defenses. In its first study, traditional defenses blocked only 12% of attacks aimed at WordPress-specific vulnerabilities. Do not assume your host has you covered.
If your site runs on a hosted builder, such as Webflow, Squarespace or Wix, the platform patches its own core code and servers. That removes most of the update work. It does not remove the other jobs on the checklist. Third-party scripts, chat widgets and form tools still need review.
What makes a website backup actually useful?
A useful backup is recent, stored somewhere other than your web host, and proven to restore. Many owners find out during an emergency that their only copy lived on the same server that got hacked, or that the backup file was broken. A plan should name where backups live and test them.
The FTC's small business guidance tells owners to back up important files routinely and to keep backups disconnected from the network so ransomware cannot reach them. Apply the same idea to your website.
Ask any provider these four questions:
- How often are backups taken, and does that match how often the site changes?
- Where are they stored? At least one copy should sit outside your hosting account.
- How long are they kept? A hack can go unnoticed for weeks, so 30 days or more is safer than 7.
- When was the last test restore, and how long did it take?
Do not forget the database and form entries. A copy of the page files without the database will not bring back blog posts, orders or leads.
What should uptime and security monitoring cover?
Monitoring should check your site every few minutes and alert a person when it goes down, when the SSL certificate is close to expiring, or when a scan finds malware. The alert is only half of it. The plan needs a stated response time, such as one business hour for a full outage.
Good monitoring also watches the quiet failures that cost leads without taking the site down:
- A contact form that looks fine but never delivers email.
- A booking widget that stopped loading after a script change.
- A phone number in the header that is one digit off after a redesign.
- Google Search Console warnings about pages dropping out of the index.
On the security side, ask for two-factor login on every admin account, removal of old staff and contractor logins, and a weekly malware scan. These steps are cheap and close the doors attackers use most.
Why do content updates and accessibility checks belong in the plan?
Out-of-date prices, hours and service lists cost trust, and AI search tools may repeat wrong details. Accessibility errors shut out customers with disabilities and add legal risk. Both drift over time as people edit the site, so both need a regular check, not a one-time fix at launch.
For content, most plans include a small bank of hours each month. One to two hours covers price changes, new photos, a seasonal offer and a staff update for most service businesses. Ask what happens to unused hours and what extra work costs.
For accessibility, the data shows how common the problems are. The WebAIM Million 2026 report scanned the top one million home pages and found:
- 95.9% had detected WCAG 2 failures.
- An average of 56.1 errors per page.
- Low-contrast text on 83.9% of pages and missing image alt text on 53.1%.
- Missing form labels on 51% and empty links on 46.3%.
These are the same barriers the Department of Justice lists in its guidance: poor color contrast, images without text descriptions, form fields without labels and videos without captions. Automated scans catch many of them, but not all. A monthly scan plus a yearly manual review with a keyboard and a screen reader is a sensible floor.
Most new accessibility errors come from routine edits. Someone uploads a photo without alt text or picks a light gray font for a new banner. That is why the check belongs in maintenance, not just in the original build.
How do speed and search health fit into maintenance?
Speed and search health are maintenance because they slip as content, images and scripts pile up. Each month, check your key pages against Google's Core Web Vitals and review Search Console for errors. Fixing a slow image or a broken link early is far cheaper than recovering lost rankings later.
Google's Web Vitals guidance sets the "good" targets at the 75th percentile of page loads:
- Largest Contentful Paint: 2.5 seconds or less.
- Interaction to Next Paint: 200 milliseconds or less.
- Cumulative Layout Shift: 0.1 or less.
The usual causes of slipping scores are oversized photos, new tracking tags, chat widgets and pop-ups. A maintenance plan should review new scripts before they go live and remove ones nobody uses.
In Search Console, look for pages that fell out of the index, new 404 errors, and manual action or security warnings. Also check the domain and email basics each quarter. The FTC recommends making sure your host can provide SPF, DKIM and DMARC email authentication if you send email from your company domain.
What should a website maintenance plan cost in 2026?
Price it by the hours of skilled work, not by a package name. Most small business sites need two to six hours a month. Clutch reports typical web design company rates of $100 to $149 an hour, so that is roughly $200 to $900 a month, plus hosting and software fees.
We could not find a reliable national survey of maintenance plan prices with a stated method and sample size. Many price ranges online come from companies selling those plans. So we built the estimate from Clutch's pricing guide, which draws on its database of web design firms and verified client reviews. Clutch lists $100 to $149 an hour as the typical rate, and $25 to $49 an hour for agencies that work mainly in website builders.
| Site type | Typical monthly hours | At $25–$49/hr | At $100–$149/hr |
|---|---|---|---|
| Simple brochure site on a hosted builder | 1–2 | $25–$98 | $100–$298 |
| Service business site with forms, booking and a blog | 2–4 | $50–$196 | $200–$596 |
| WordPress site with many plugins or light ecommerce | 4–6 | $100–$294 | $400–$894 |
The hour counts are our planning estimates. The dollar ranges are simple math on Clutch's published rates. Hosting, premium plugin licenses, security firewalls and platform fees are extra and vary by vendor.
Watch for these red flags when comparing quotes:
- No task list. "Ongoing care" with no named jobs is hard to hold anyone to.
- No response time. A plan should say how fast someone acts on an outage or hack.
- Backups only on the same host. That copy can disappear with the site.
- The provider owns your domain or logins. Keep the domain registrar and admin access in your own name.
- No report. If you never see what was done, you cannot tell if anything was done.
A low price is fine when the site is simple and the list is complete. A high price is fine when it buys fast response, real testing and hours you will use.
Should you handle maintenance yourself or hire it out?
Do it yourself if your site is simple, you can protect 30 minutes a month, and an outage would not cost much. Hire it out if you take payments or bookings online, run WordPress with many plugins, or would lose real money from a day offline. Many owners split the work.
A common split looks like this:
- Owner or office staff: content changes, photos, hours and prices, plus a quick monthly test of the forms and phone links.
- Provider: updates, backups, monitoring, security, speed, accessibility scans and Search Console fixes.
Whichever route you take, write the checklist down, put it on a calendar and keep a short log. The log helps when something breaks, because you can see what changed and when.
Frequently asked questions
Do I need a maintenance plan if my site is on Webflow, Squarespace or Wix?
You need less of one, not none. Hosted builders patch their own core software and servers, so the plugin-update chore mostly goes away. You still need someone to check forms, fix broken links, update prices and photos, test accessibility, watch speed and Search Console, and keep your domain and email settings current.
How often should my website be backed up?
Back it up at least as often as it changes. A site that takes orders or bookings daily needs daily backups. A brochure site that changes monthly can live with weekly copies. Keep at least one copy away from your host, and test a restore a few times a year so you know the backups work.
Is cheap website maintenance worth it?
It depends on what the low price covers. Many cheap plans run automatic updates and a backup tool, which is useful, but nobody checks the results. If a plan does not include a person testing your forms, reviewing alerts and fixing problems within a set time, you are paying for software, not care.
Can I do website maintenance myself?
Yes, for many small sites. Turn on automatic updates where your platform allows it, set an uptime monitor, add Search Console alerts, and block 30 minutes a month for the checklist in this guide. Hire help when you cannot keep that schedule, when you take payments, or when a hack or outage would cost real money.
What should a website maintenance contract spell out?
It should list the tasks and how often they happen, the hours of content changes included, how fast urgent issues get a response, where backups live and how long they are kept, who owns the domain and logins, what a monthly report shows, and what extra work costs per hour.
The bottom line
A website maintenance plan is a written list of jobs, a schedule and a person who answers the alert. Cover updates, tested backups, monitoring, content, accessibility, speed and search. Price it by the hours of real work. If you want a second opinion on your current plan or site, Book a free call with Mike, or run the free 60-second check to see how visible your site is in search and AI answers.
Sources
- Patchstack, State of WordPress Security in 2026
- WebAIM, The WebAIM Million: 2026 report
- U.S. Department of Justice, Guidance on Web Accessibility and the ADA
- Federal Trade Commission, Cybersecurity for Small Business
- Google, Web Vitals (web.dev)
- Clutch, Web Design Company Pricing Guide
Keep reading
WhatConverts: Shows which page, ad or search brought in each call and form, so you know what is really making money. Try WhatConverts →
Semrush: Tracks your Google rankings and keywords so you can see what is working and catch drops early. Try Semrush →
