A maintenance plan should explain what is checked, what is changed and who responds when something fails. Hosting a website and maintaining its application are different responsibilities. Neither a monthly invoice nor an uptime graph proves that a customer can complete the important journey.

Keep an inventory

Record the domain registrar, host, source repository, CMS, email provider and third-party integrations. Identify the business-controlled account owner and renewal responsibility for each. Keep secrets outside the document and use appropriate access management rather than shared passwords.

For WordPress, include themes and plugins. For custom applications, include runtime and dependency versions, databases and background tasks. Both types of site need ongoing attention; a custom framework does not eliminate maintenance.

Test outcomes as well as uptime

  • Contact submission reaches the intended inbox.
  • Booking or checkout behaves correctly for success and failure.
  • Important pages and redirects return appropriate responses.
  • Content, contact details and service descriptions remain accurate.
  • Backups can be restored through a documented procedure.
  • Key journeys remain usable after updates.

Agree how often checks run and what evidence is retained. A backup that has never been restored is an untested assumption. A form that reports success without checking the email provider can conceal a delivery problem.

Make update risk explicit

Review security advisories and dependencies, test changes in an appropriate environment and keep a rollback path. Define which work is routine maintenance and which requires a new scope. Major redesigns, new integrations and content production should not hide inside an undefined promise to handle everything.

Review search and performance

Watch for indexing changes, broken internal links and new performance regressions. Compare repeatable tests and investigate meaningful changes instead of treating every daily fluctuation as an incident.

Our website care service describes the areas to scope. For a handover, bring the account inventory, known issues and most important customer journeys. The HTTPS guide explains why transport security is one part of this work, not a substitute for it.