Website Maintenance Plans: What a Retainer Should Actually Cover

Most business owners sign a website maintenance retainer without knowing exactly what it buys. The proposal says "updates, backups, security, support," the monthly invoice shows up on time, and nobody checks whether the backups restore, whether the contact form still delivers, or what happened to the hours that weren't used. Then something breaks, and the answer turns out to be "that's outside the plan." A good retainer is boring in the best way: specific about what's covered, honest about what isn't, and set up so problems get caught before your customers find them. This is what we think a maintenance retainer should actually cover, and the questions to ask before you sign one.

Maintenance is the floor, not the plan

"Maintenance" usually means keeping the site from breaking: updates, backups, uptime. That's necessary, and it's the minimum. What most businesses actually need is broader — someone accountable for the site continuing to do its job, which is generating leads and supporting operations. The gap between those two is where most retainer disappointment lives.

It helps to think in three layers: protection (the site stays up, secure and recoverable), health (the site keeps performing for visitors and search), and improvement (the site gets better over time). A retainer should be explicit about which layers it includes.

The non-negotiables every website maintenance retainer should include

1. Backups that are tested. Automated, stored somewhere other than the server the site runs on, with retention long enough to roll back a problem you didn't notice right away. Ask when a restore was last tested. A backup nobody has restored is a hope, not a backup.
2. Updates applied safely. CMS core, plugins, themes, frameworks and dependencies updated on a schedule, tested on a staging copy first when the site is complex, with a rollback plan.
3. Security monitoring. Malware scanning, login protection, alerts for suspicious changes, and a defined response if something gets in.
4. Uptime monitoring. Someone gets alerted when the site goes down — before a customer calls to tell you.
5. Domain, DNS and SSL oversight. Certificate renewals, domain expiration, and DNS records tracked so nothing lapses. You should own the domain and the registrar account; the retainer manages it, not holds it.
6. Lead path testing. Regular test submissions of every form, a check that notification emails arrive, that call buttons dial the right number, and that booking or checkout flows complete. This is the item most plans skip and the one that matters most.
7. Access management. A current list of who has admin access, with former staff and vendors removed.

Performance and search health

A site can be "up" and still be quietly losing business. The health layer catches that:

• Core Web Vitals and speed checks on your important pages, especially after updates and new content. Our guide to Core Web Vitals for small businesses explains which numbers matter for leads.
• Search Console review for indexing errors, crawl problems and manual actions.
• Broken links and missing pages, with redirects added when content moves.
• Analytics and tracking checks so the numbers you use to make decisions are actually being recorded.
• Accessibility spot checks when new content or components are added.

Content changes and small requests

Every business needs small changes: new staff photos, updated hours, a seasonal promotion, a new service page. Retainers handle this in one of a few ways — a bank of hours, a set number of requests, or an unlimited queue processed one at a time. Each can work. What matters is that the terms are written down:

• What counts as a small request versus a project.
• Expected turnaround for routine requests and for urgent fixes.
• What happens to unused hours — roll over, expire, or apply to something else.
• How requests are submitted and tracked, so nothing lives only in someone's text messages.

Where maintenance ends and partnership begins

Here's the honest distinction. A maintenance plan keeps the site you have running. A partner retainer treats the site — and often the systems around it — as something that should keep improving: conversion testing, new landing pages, local SEO work, automations, CRM and integration work, and someone who knows your business well enough to suggest what to do next.

A simple decision rule: if your site mostly needs to stay stable and accurate, a maintenance plan is enough. If your website is a primary source of leads or is tied into how you operate, you're likely better served by ongoing partnership, because the cost of standing still is higher than the cost of the retainer. That ongoing-improvement model is what our partner retainer is built around. Our post on signs your business has outgrown its website is a useful gut check here.

Questions to ask before you sign

1. Who owns the domain, hosting account, code and content? The answer should be you, in writing.
2. What is explicitly excluded? Get the exclusions list, not just the inclusions.
3. What are the response times for an outage, a broken form, and a routine change?
4. How are backups stored, and when was a restore last tested?
5. What reporting will I get, and how often? A short monthly summary of updates applied, issues found and work completed is reasonable.
6. What happens if we part ways? Handover of credentials, files and documentation should be defined up front.
7. How is pricing structured? Pricing depends on the site's complexity and what's included; make sure you understand what triggers additional charges.

Red flags in maintenance plans

• The provider owns your domain or hosting account and won't transfer it.
• "Unlimited support" with no definition of what support means.
• No mention of testing forms, calls or booking — only server-level checks.
• Updates applied directly to the live site with no backup taken first.
• Reports that list automated scan results without anyone reviewing them.
• Promises of guaranteed rankings bundled into a maintenance fee.

If you're already planning a rebuild, sort out maintenance terms at the same time — our website redesign checklist covers the ownership and handover items to settle before launch. And if you're comparing providers, our guide to choosing a web design company in Salt Lake City covers the questions that reveal how a studio actually works after launch.

FAQ

Do small business websites really need ongoing maintenance?
Yes. Software, plugins, certificates and integrations change constantly, and forms and tracking break quietly. Even a simple site needs updates, backups and someone checking that leads still arrive.

What's the difference between hosting and maintenance?
Hosting is where the site runs. Maintenance is the ongoing work of keeping it updated, secure, recoverable and functioning. Some hosts include limited maintenance; most don't test your lead paths or handle content changes.

How much does a website maintenance retainer cost?
It depends on the site's complexity, integrations and how much improvement work is included. We scope retainers to the actual site and goals rather than selling fixed tiers.

Can I do maintenance myself?
On a simple site, you can handle a lot of it if you're disciplined about backups and testing. The risk is that maintenance is easy to postpone until something breaks.

What if we only need help occasionally?
Then a retainer may not be the right fit. Occasional fixes and upgrades can be handled as discrete projects instead.

A website maintenance retainer should leave you knowing exactly what's protected, what's being checked, and who's accountable when something breaks. If you want a site that keeps improving rather than just staying online, see how our partner retainer works, or contact us to talk through what your site actually needs month to month.