Site maintenance services should keep the website secure, recoverable, usable and commercially accurate. The supplier must define what is monitored, what is changed, how the result is tested and how quickly incidents are handled.
What maintenance can include
Coverage may include:
- core, theme, plugin and dependency updates;
- backups and restore testing;
- uptime, certificate and security monitoring;
- forms, checkout and critical journey checks;
- performance and accessibility regression checks;
- broken links, redirects and 404 review;
- analytics and conversion validation;
- small content and design changes;
- incident response and supplier coordination;
- monthly evidence and improvement priorities.
Do not assume these are included because a package is called “care”. Get the boundaries in writing.
How a controlled maintenance service works
Intake and prioritisation
Requests and alerts enter one queue with severity, owner and response target. Critical failures are separated from normal improvement work.
Safe change
Back up first, use staging or a controlled preview where appropriate, record the change and prepare rollback. WordPress advises backing up before updates because core files are affected.
Verification
Test the affected component and the complete customer journey. Read back the live state. A successful deployment log is not proof that checkout, forms or analytics still work.
Reporting
Report outcomes: what changed, what was verified, what failed, what remains open and what is recommended next. Avoid monthly lists of routine updates with no risk or customer context.
Retainer, hours or service level?
A small hours bank suits irregular content and design changes but may not include proactive monitoring.
A maintenance retainer covers a defined recurring checklist and response window. A service-level agreement adds formal availability, incident and recovery commitments for higher-risk sites.
Choose based on business impact and internal capacity. A low-cost plan with no restore test can be expensive when failure arrives.
Questions to ask
- Which checks are automated and which are manual?
- Are backups stored separately and restored in tests?
- What is the critical response route?
- Are licences and hosting included?
- How are changes approved and rolled back?
- Which browsers and journeys are checked?
- Is SEO, analytics, accessibility or content included?
- What evidence appears in the monthly report?
- Who owns accounts and source code?
A short buyer check
Ask what happens when the site breaks at 6pm. Who sees the alert? Who can act? How fast will they reply? What will they test before they say the site is back?
For example, take a real update. It may be a plugin patch, a price change or a new form. Is there a backup? Is there a test site? Can the team roll it back if the live page fails?
Keep a short log of each change and each check. You should know what was done, what passed and what still needs work. That is how a service becomes accountable.
For a detailed task schedule, use the website maintenance plan. If you need an accountable service around the current site, ask DreamWeb to scope coverage from the real risks.
Related reading: Page speed optimization service.