What website maintenance should cover after launch
A "maintenance package" is often sold as a vague line item. Here is what should be in one, and what is just padding.
The site is delivered and everyone's happy. Six months later you notice the contact form isn't working, and nobody knows how long it's been broken.
That's what maintenance is for, but what goes into a "monthly maintenance" package is often never spelled out.
What you actually need
Backups
This is the most important item. Take a full backup every week and keep it somewhere other than the server.
A backup that sits on the server is no use when the server dies, and you usually find that out at the worst moment.
Also ask whether anyone has tried restoring the backup. If a restore has never been tested, you don't know the backup works.
Updates
If you run WordPress, this is essential. Without regular core, theme and plugin updates, security holes pile up. Most attacks use known vulnerabilities that were patched long ago.
Updates shouldn't be applied blindly, though. Try them on a staging copy first, because plugin updates break sites all the time.
A custom-built site needs far less of this. If there aren't thirty plugins, there aren't thirty things to update.
Uptime monitoring
If your site goes down at 3am, will you find out at 9? A monitoring service checks it every few minutes and alerts you when it goes down.
There are free options and setup takes five minutes. If it isn't in your maintenance package, set it up yourself.
Security
Renewing the SSL certificate (usually automatic, but worth checking), watching login attempts on the admin panel, and running form submissions through a spam filter.
What may be padding
Automated "monthly SEO report" PDFs are usually documents nobody reads. If you want a report, make it specific: which keyword moved to which position this month, what was done and what comes next.
"Unlimited changes" is another promise to look at closely. A truly unlimited package is either very expensive or defines "change" very narrowly. Ask what the contract means by it.
What each kind of site needs
<strong>A small custom-built brochure site.</strong> Monthly maintenance may not be needed. With automatic backups and monitoring in place, a yearly check is enough.
<strong>A WordPress site.</strong> Monthly maintenance is a real need, because the updates and the security risk never stop.
<strong>E-commerce.</strong> Maintenance is a must. An hour of downtime costs you sales directly, and payment and stock integrations need constant attention.
Questions to ask
Where are backups stored, and has restoring one been tested?
Are updates tried on a staging copy first?
How quickly does someone respond when the site goes down?
What is the hourly rate for work outside the package?
If I end the agreement, can I take my backups and access with me?
Again, the last one matters most. If you end the agreement, your site shouldn't stay in someone else's hands.