Website Maintenance and Management: What a Monthly Plan Should Cover

A website nobody is looking after breaks quietly. The developer who built it moves on, updates land on whoever is least busy, and the contact form is down for a month before a customer calls to say so.

This guide covers what a monthly management plan should include, what belongs outside it, and how the fee gets decided. There isn't one right monthly price; it depends on the site, what it's connected to, and how much you want handled. What follows is how I scope it, so any plan can be compared on the same terms.

Hosting, maintenance and management are three different jobs

People use "maintenance," "support," and "care plan" to mean very different things. I split the work into three layers so we can see who owns each one.

Hosting is the server your website runs on. The hosting company keeps the machine running. It does not update your site, check your forms, or know what your business needs next.

Maintenance is keeping the website itself healthy: updating the software it runs on, keeping backups you can actually restore, and checking that the important things still work after every change.

Management is the ongoing work of keeping the site useful: publishing content changes, coordinating the tools connected to it, and keeping a short list of what to improve next.

I'm DreamHost's CMO; the hosting is DreamHost's product and billed separately, and the work described here is my own. If your current hosting fits the site, it stays. I don't move hosting to justify a plan.

What a monthly plan should cover

I start with three short lists the business helps me write: the customer actions your business depends on, the content changes your team expects to make, and the tools connected to the site. Form delivery, scheduled jobs, license renewals, and logins still held by a previous provider all go on those lists. They're the things that break quietly.

From there, a sound plan covers:

• Software updates, done carefully. For WordPress, that means the core install, the theme, plugins, and any custom code. I back up before updating, apply the change, then check the behavior that matters. WordPress's own guidance says the same: back up first so you can roll back if something goes wrong. WordPress: updating the site
• Backups I've tested. A backup you've never restored is a hope, not a plan. More on that below.
• Customer-journey checks. A page can load while the business task behind it is failing. I send a controlled test inquiry and follow it to the saved record, the email, and the person who's supposed to respond. For a booking, I check the calendar entry. For an order, I separate the payment from the order record.
• Content changes. Updating a service, swapping a team photo, adding a project, or building a page for a new offer. We agree which kinds of changes fit inside the monthly scope and which are their own project.
• A running improvement list. Small things worth fixing, in priority order, with a note on what each one would take.
• A short monthly report. What changed, what I checked, what's still open, and anything that needs your decision.

Here's what a report entry looks like in practice: "Updated the booking plugin. Test booking reached the calendar and the staff notification. The cancellation email still needs your wording approved." You can act on that. "Performed routine maintenance" tells you nothing.

What should stay outside the plan

A plan that promises everything can't be compared with anything. A good one draws clear lines.

Hosting and provider fees are separate. DreamHost, your domain registrar, your booking tool, your email service, and any paid plugins bill you directly. I list them in the proposal so you know what the site actually costs to run.

New features and redesigns are their own projects. If the improvement list grows a big item, I scope it separately with its own price. Small projects, improvements and optimizations run in my $1,000–$3,000 planning range; a new website or a full redesign sits at $4,000–$10,000. The website cost guide explains what moves those numbers.

Unlimited changes deserve suspicion. Anyone offering them should explain how requests queue, what's excluded, and what happens in a busy month. I'd rather define the included work and tell you plainly when something falls outside it.

Initial cleanup on an inherited site is scoped before the monthly plan starts. Recovering logins, updating badly outdated software, or building the first tested backup are one-time jobs. They don't mean you need a redesign. They mean the site needs a starting point.

How I handle backups and recovery

Ask any provider two questions: what's in the backup, and when did you last restore it?

A backup needs the site's files, its database, uploaded media, and configuration. For WordPress, the files and the database are separate things, and a complete recovery needs both. WordPress: backups A copy of the public pages won't bring back your customer or order records.

I keep backup copies somewhere other than the web server they protect. DreamHost's own guidance explains why: a copy stored on the same server can be lost to the same incident as the live site. DreamHost: backup storage considerations Hosting-level backups are a useful extra layer, not the plan. DreamHost's standard file restore, for example, doesn't restore the database, and the help article describes backup availability as not guaranteed. DreamHost: restoring website files Coverage varies by product, so I confirm what your actual hosting provides.

For a site taking orders or inquiries, restoring an older database can erase newer records. We decide in advance how those get preserved. Then I test the restore, so the day we need it isn't the first time we try it.

Security works the same way. I keep software current, tighten who has access, and know exactly what's installed. WordPress frames security as reducing risk, not eliminating it, and separates what the host handles from what the site owner handles. WordPress: security and hosting responsibilities I won't tell you a plan makes risk disappear. I'll tell you what it reduces and how.

Put an owner beside every responsibility

I built this map so you can see the gaps before agreeing to any plan. It starts with a fictional split: a manager handles upkeep and priorities, your team handles content. Recovery and customer-journey checks still need an owner. Move the pieces around to match your situation.

A missing owner is a decision waiting to be made. It doesn't go away because your hosting account has a support button.