What a website maintenance package includes, and what it should cost
Two maintenance packages with the same name can include very different work. Here is each job a package should cover, what is usually left out, what to ask for in writing, and what ours cost.
A website maintenance package is a monthly service that keeps a website’s software updated, backed up, watched for security problems and checked after every change, with a set time for someone to respond when something breaks. Some packages also include the hosting and a few hours of changes to your content; many don’t. What one should cost depends on which of those jobs are inside it. Ours are R975 a month incl. VAT with hosting included, or R2,450 a month with two hours of changes and a faster response.
This guide goes through each job, what is usually left out, and what to ask for in writing before you sign. It is about WordPress, because that is what we build and look after.
What does website maintenance include?
Website maintenance includes updates to the site’s software, tested before they go live; backups kept away from the server; security monitoring; a watch on whether the site is online; checks that pages and forms still work; and a record of what was done. Changes to your content are maintenance too, but many packages sell them separately.
| Job | What it involves | What to ask for in writing |
|---|---|---|
| Software updates | WordPress, its plugins and its theme updated as new versions come out | Who installs them, how often, and whether each one is tested on a copy of the site first |
| Backups | Copies of the site’s files and its database, kept away from the server | How often, where they are kept, how far back they go, and who restores one |
| Security monitoring | A scanner on the site, and a person who reads its alerts | Who reads the alerts, and what happens when one is serious |
| Uptime monitoring | An automatic check that the site is online | Who is told when it goes down, and how soon they act |
| Checks after updates | Pages, forms and the checkout looked at on a computer and on a phone | What is checked, and on which devices |
| Server software | The server and its PHP version kept current | Whether the host or the maintenance provider does it |
| Reporting | A record of what was done each month | What the report covers, and how often it arrives |
| Content changes | Text, images and prices replaced when you ask | How many hours are included, and what counts as a change |
| Renewals | The domain name and any paid plugin licences | Who tracks each renewal date, and who pays |
What differs from one package to the next is how many of these rows are inside it, and how carefully each job is done. If you want the jobs set out month by month, to do yourself or to hold a supplier to, see a monthly WordPress maintenance checklist for business owners.
Where does hosting stop and maintenance start?
Hosting stops at the server, and maintenance starts at the website. Hosting keeps the site online, on a server that is backed up and kept current. Maintenance looks after the website itself: WordPress, its plugins and its theme. Some companies sell both under one name and others sell them apart, so check which jobs each monthly fee pays for.
This matters most when you compare prices. A package that includes hosting and one that doesn’t are not the same product, even when the names match.
We sell them as two. Our managed hosting is R450 a month incl. VAT (R5,400 a year). It includes daily off-site backups, a restore when you need one, and uptime monitoring, and it doesn’t include updates, fixes or content changes. Our care plans include the hosting, so you pay one fee, not two. A care plan needs our hosting: we don’t offer one on hosting someone else runs. The hosting side is explained in what managed WordPress hosting is.
The two jobs meet at the server’s software. WordPress runs on PHP, and PHP’s supported versions page says a release that has reached its end of life is no longer supported, and that its users may be exposed to unpatched security vulnerabilities. Moving a server to a newer version is the host’s job. Checking first that your site’s plugins and theme work on it is maintenance. Ask who does each. Our servers run current PHP versions.
Why should updates be tested before they go live?
Updates should be tested because each one changes the software your site runs on, and a change can break a page, a form or a checkout. Testing on a private copy of the site finds the problem before your customers do. Installing an update is the easy half; checking the site afterwards is the half a package pays for.
Skipping updates is not the safe choice. WordPress’s guide to plugin and theme auto-updates says that to keep a site secure you should always update your plugins and themes to the latest version. WordPress’s guide to the Site Health screen gives the reason: plugins have deep access to your site, so it is vital to keep them up to date.
WordPress can install updates on its own. The auto-updates guide explains that an administrator can switch automatic updates on for each plugin and each theme, and that by default WordPress then emails the site’s owner to say which updates went through and which failed. The same guide adds a caution: before you switch them on, you may want to make sure you can roll back to a previous version of your website in case things go wrong.
So automatic updates do the installing. They don’t look at the site afterwards, and they don’t act on the email. Somebody has to, and that person is what you are paying for.
On our care plans, updates to WordPress, its plugins and its theme are tested on a staging copy of your site first. Staging is a private copy that visitors never see, so your live site is not the test.
Checking after an update includes checking on a phone. Google’s guide to mobile-first indexing says Google uses the mobile version of a site’s content for indexing and ranking. A page that breaks on a phone is broken in the version Google reads. Every site we build works on phones, and we fix a display problem on a phone free.
What backups should a maintenance package include?
A maintenance package should include regular backups of both the site’s files and its database, kept somewhere other than the server the site runs on, going back far enough to reach a clean copy. It should also say who restores a backup when one is needed.
WordPress’s guide to backups explains that a WordPress site has two parts, the database and the files, and that you need both to restore it fully. Ask whether a backup holds both.
How often depends on how busy the site is. The guide suggests weekly backups for smaller websites with fewer posts and daily backups for high-activity websites. A store that takes orders every day changes every day.
The guide also advises keeping at least three backups, in different places, in case one is corrupted or lost. And it recommends that automatic backups are backed up by hand once in a while, to make sure the process is working.
Speed of recovery is the last part. The guide notes that most hosts back up the entire server, but that it takes time to request a copy of your site from their backups, and a speedy recovery is critical. So ask three questions. Who restores the site? How long does it take? Is it charged for?
Our managed hosting backs your site up every day with Acronis and keeps at least seven days of copies off the server, with a restore included when you need one. Both care plans include the hosting, so both have it.
What security work belongs in a maintenance package?
Watching and prevention belong in a package: a security scanner on the site, a person who reads its alerts, software kept up to date and a server set up to keep intruders out. Cleaning up after a hack usually doesn’t. It is a separate job with its own price, so ask what it would cost.
Google is one of the places to watch. Search Console Help’s page on the Security issues report says that if Google determines a site was hacked, the report will show its findings. It also says affected pages or sites can appear with a warning label in search results, or behind a warning page in the browser. Ask who checks that report for your site, and how often.
Some of the work is yours. WordPress’s hardening guide says many potential vulnerabilities can be avoided with good security habits, that a strong password is an important part of this, and that two-step authentication is a good idea as well. No package can protect a site whose administrator password is easy to guess.
Wordfence, a security plugin for WordPress, runs on every site we look after, and both care plans include Wordfence monitoring. The free version is the default. A paid firewall upgrade is licensed to your own account at your cost, or supplied by us with a small markup. Our servers are hardened, from locked-down file access to bot protection. For what the plugin does and doesn’t do, see what Wordfence does, and what it cannot do on its own.
With us, a clean-up is a separate service. Our website rescue clean-up starts at R5,200 incl. VAT, and at least three months of a care plan are paid on top of it. If your site has already been hacked, start with what to do in the first 24 hours.
What is usually not included in a maintenance package?
New work is usually not included. A maintenance package keeps the site you have working; it doesn’t add to it. New pages, design work, new features and SEO campaigns are normally quoted separately. Content changes are included only if the package says so, and then only up to the hours it states.
Here is where our own line sits. The basic care plan doesn’t include content changes; the full care plan includes two hours of them a month.
Two definitions prevent most arguments. With us, a change is a request to replace existing content with new content: a new price, a new photograph, a rewritten paragraph. And unused hours don’t carry over to the next month. Ask any provider for both answers before you sign, because packages differ on both.
Work outside a plan is quoted per task before we start. Whether a plan or paying per task suits you better is a comparison of its own, in maintenance plan or hourly support: how to compare the options.
Three more things tend to sit outside a package:
- Paid licences. A paid plugin or theme you want is licensed to your own account at your cost, or bought by us with a small markup.
- Faults in a new build. These belong to the builder, not to a maintenance fee. In the first 30 days after a site we built goes live, anything that breaks because of our own work is fixed free.
- The domain name and other yearly costs. They are set out in the running costs nobody quotes.
What should a website maintenance package cost?
A website maintenance package should cost what the jobs inside it take to do properly. Four things move the price: whether hosting is included, how many hours of changes are included, how fast the provider promises to respond, and how large or complicated the site is. Compare packages job by job, not by name or by price alone.
A low price can be honest. It may simply pay for fewer jobs: updates installed but not tested, or backups but no monitoring. The table in the first section shows you which rows are missing.
These are our three levels, so that you have real figures to compare against.
| Managed hosting | Care plan, basic | Care plan, full | |
|---|---|---|---|
| Price a month, incl. VAT | R450 | R975 | R2,450 |
| Hosting, daily off-site backups (restore included) and uptime monitoring | Included | Included | Included |
| Updates tested on staging first, and Wordfence monitoring | Not included | Included | Included |
| Changes to your content | Quoted per task | Quoted per task | Two hours a month |
| Response when you ask for help | No set time | One business day | Four business hours |
| Response when your site is down | No set time | Four business hours | Four business hours |
The full plan also brings a monthly performance and security report and a quarterly speed review; the website maintenance and care plans page lists everything each plan includes and leaves out.
What should you ask before you sign?
Ask what is included, what is charged separately, how fast the provider responds and how you leave, and ask for every answer in writing. A provider who does the work will have the answers ready. One who can’t say who tests an update or who restores a backup has answered you too.
- Which jobs are included? Go through the table in the first section row by row, and ask which rows are charged separately.
- How fast do you respond? Ask for one time for a request and one for a site that is down.
- Does the package need your hosting? If it does, the price of moving is part of the decision.
- How do I cancel? Ask for the notice period.
- What happens if I leave? Ask whether you can take the site with you.
Our answers to the last two are short. A care plan is cancelled with one calendar month’s notice. Your website and its content are yours, and you can move them wherever you like.
Can you maintain a website yourself?
Yes, if you do it every month and know what to do when an update goes wrong. WordPress gives you the tools. WordPress’s guide to the Site Health screen says the screen groups what it finds into critical issues, recommended improvements and passed tests, and describes critical issues as potential security vulnerabilities or serious performance issues.
The tools are not the hard part. The hard part is doing the work in a busy month, reading every alert, and having a backup you know how to restore. A monthly WordPress maintenance checklist for business owners sets out the routine. If it is more than you want to carry, that is what a package is for.
How we look after websites
We have built and run websites since 2001. Today we build them on WordPress, host them and look after them. Some of the sites we look after are sites we built. Others were moved to us from other providers.
Thrive Raw Food For Dogs has been a client since 2025. We built its online store that year, and we still host, maintain and support it. Smallies World, a WooCommerce store, has been a client since 2024; we host and maintain it, and have rebuilt sections of it.
Maintenance has a limit, and we say so. A site can be kept current for years, but technology moves on, and at some point a rebuild is the better answer. Tin Soldier and Something Fab have been clients since 2005. We rebuilt both sites in 2025 as the technology moved, and we still host them.
Our website maintenance and care plans page has both plans in full. Tell us what your site runs on and who looks after it now: Get a quote. We reply to new enquiries on the same business day.
Frequently asked questions
How much does website maintenance cost?
With us, R975 a month incl. VAT (R11,700 a year) on the basic care plan, with the hosting included, or R2,450 a month incl. VAT (R29,400 a year) on the full care plan, with two hours of changes a month and a response within four business hours. Our website maintenance and care plans page lists what each plan includes. Elsewhere, the cost depends on which jobs are inside the package.
How much do website maintenance packages typically cost?
A typical price tells you little, because packages with the same name include different work. One may be hosting and backups only; another may include tested updates, monitoring and hours for changes. Compare them job by job, and check whether hosting is inside the price.
How long does website maintenance take?
Website maintenance is ongoing, not a job with an end date. WordPress, its plugins and its theme keep releasing updates, so the same work comes round every month: install and test the updates, confirm the backups, read the security alerts and check the site. How long that takes depends on the size of the site and the number of plugins it runs.