You built a website. It looks great. It’s live. And then your agency sends you a monthly invoice for “maintenance” with zero explanation of what that means. Sound familiar?
The maintenance mystery
I’ve audited maintenance contracts from agencies across three continents. The most common line item is “ongoing website maintenance, $200/month.” No breakdown. No deliverables. No way to verify if anything is actually happening.
Here’s what should be happening, and what you should demand to see proof of.
The 6 things real maintenance includes
1. Software updates (weekly). WordPress core, plugins, and your theme all release updates. Some are features, some are security patches. A missed security update is an open door for hackers. Your maintainer should update everything at least weekly, test that nothing broke, and keep a log. If they’re updating monthly, they’re leaving you exposed for 3 weeks out of 4.
2. Backups (daily). Full site backups, database and files, stored off-server. Not on the same machine as your website (if the server dies, your backup dies with it). You should be able to restore to any day in the last 30 days. Ask your agency: “Where are my backups stored? Can I download one right now?” If they hesitate, worry.
3. Uptime monitoring (24/7). Someone, or something, should be checking that your site is online every 5 minutes. When it goes down, you should know within minutes, not when a customer tells you. Downtime costs money. For a service business, even 2 hours of downtime during business hours can mean lost bookings and damaged search rankings.
4. Security scanning (daily). Automated malware scans, firewall rules, brute force protection, and file integrity monitoring. WordPress is the most popular CMS on earth, which makes it the most targeted. 96% of WordPress vulnerabilities come from plugins. Your maintenance provider should be scanning for threats, not waiting for you to notice your site has been defaced.
5. Performance monitoring (monthly). Page speed changes over time. A plugin update might add 200ms. A new image might not be optimized. Your Core Web Vitals score might drop. Monthly performance checks catch these regressions before they affect your Google rankings.
6. Content updates (as needed). Changed your phone number? New office address? Updated your prices? These small changes shouldn’t require a support ticket and a 3-day wait. Basic content updates should be included in your maintenance plan, not billed at $75/hour.
What maintenance should cost
For a standard WordPress business website (5-15 pages, no e-commerce), real maintenance costs break down like this:
Bare minimum (DIY): $0/month if you do it yourself. But you won’t. You’ll forget to update plugins for 6 months, skip backups, and not notice when your SSL certificate expires. This is how sites get hacked.
Basic managed: $50-100/month from a freelancer. You’ll get updates and backups. Maybe uptime monitoring. Probably no security scanning or performance checks. No guaranteed response time.
Professional managed: $100-250/month from a dedicated provider. All 6 components above, documented, with a dashboard you can check. This is what most small businesses need.
Agency “premium”: $300-500/month. Same as professional, but with an account manager and branded reports. You’re paying for the PDF, not better service.
Red flags in maintenance contracts
“Maintenance included in your hosting plan.” Hosting and maintenance are different things. Hosting keeps your server running. Maintenance keeps your software updated and secure. Bundling them isn’t wrong, but the provider should be able to itemize what each covers.
“We’ll handle everything.” Great. What’s everything? If they can’t give you a specific list of what they check, when they check it, and how you verify it, they’re selling you a vague promise.
“Maintenance is optional.” For WordPress, no it isn’t. An unmaintained WordPress site is a security liability within 90 days. Plugins with known vulnerabilities get exploited automatically by bots scanning the entire internet. It’s not a question of if, it’s when.
The all-inclusive alternative
At Fork IT, maintenance isn’t a separate line item. It’s built into the monthly plan alongside hosting, design, and SEO. We don’t charge extra because maintenance isn’t optional, it’s part of running a website. Charging separately for it is like a landlord charging you rent and then billing extra for the roof.
You get a dashboard showing your uptime, speed scores, backup status, and security scan results. Not a monthly email saying “everything’s fine.” Proof, not promises.
Questions to ask your current provider
Right now, go ask your web agency or hosting provider these five questions:
1. When was the last time you updated my plugins? (If they can’t answer with a date, they’re not doing it.)
2. Where are my backups stored? Can I download one? (If they say “on the server”, that’s not a real backup.)
3. What’s my current uptime percentage this month? (If they don’t know, they’re not monitoring.)
4. When was the last security scan? What did it find? (If they’ve never scanned, your site might already be compromised.)
5. What’s my current page speed score? (If it’s over 3 seconds, something’s wrong with their “maintenance.”)
If they can answer all five confidently with data, you have a good provider. Keep them. If they can’t answer even one, it’s time to audit what you’re actually getting for your money.