Website Maintenance Services (UK): What They Include, What They Cost and How to Choose

Introduction

Picture a small business website that has run quietly for eight months. A plugin update has been waiting for weeks. The host retires an old PHP version. On a Friday afternoon the contact form stops sending enquiries, and nobody notices until Monday's phone calls dry up.

That is how most website failures arrive: not as a dramatic hack on launch day, but as a slow build-up of small, deferrable jobs. Website maintenance services exist to do those jobs on a schedule, before they become a Friday-afternoon problem.

This guide explains what maintenance involves, what UK businesses pay for it in 2026, and how to tell a real plan from a monthly fee that buys very little. It is written for owners and marketing managers rather than developers, so each technical task is explained through what goes wrong without it.

We sell maintenance plans ourselves, so read our advice with that in mind. To make that easier, the guide shows you how to check any provider's claims, ours included.

The short answer

• What it is: the ongoing updates, security monitoring, backups, uptime checks, performance work and support that keep a live website safe and working after launch.
• What it costs in the UK: most small and medium business sites pay roughly £45 to £400 a month. Online shops and revenue-critical sites usually start from about £500 a month.
• How often: monitoring and backups run daily or continuously, updates weekly or monthly, and a proper review quarterly.
• What to check before you buy: what is covered, what is excluded, how quickly they respond, how many support hours you get, and whether backups are tested by actually restoring them.

What are website maintenance services?

Website maintenance services are the recurring technical tasks that keep a live website secure, fast, available and up to date. They usually cover software updates, security monitoring, backups, uptime and performance checks, and an agreed allowance for fixes and small content changes.

The definition is simple. The boundaries are where buyers get confused, because "maintenance", "support", "hosting" and "management" are used loosely, and a plan that sounds comprehensive may cover only one of them.

Maintenance, hosting, support, development and SEO

A useful test for any task is to ask what it does to the site. Does it keep the site as it is today (maintenance), change what the site can do (development), or change how much traffic and revenue it earns (growth)?

Service	The question it answers	Typical tasks	Normally inside a maintenance plan?
Hosting	Where does the site live, and is the server running?	Server, bandwidth, SSL installation, server-level backups	Separate, though some providers bundle it
Maintenance	Is the site healthy and current?	Updates, security checks, backups, monitoring, reporting	Yes, this is the core
Support	Who fixes it, or changes it, when I ask?	Fixes, small edits, how-to help	An allowance of hours or requests
Development	Can the site do something new?	New features, integrations, redesigns	No, quoted separately
SEO and marketing	Does the site attract and convert visitors?	Keyword work, content, link building, ads	No, a different service

The overlap with hosting causes the most surprises. A host may back up the server rather than your site, keep those copies only briefly, or not offer a restore you can run yourself. Ask what exists and who can use it before you assume it is covered.

We also separate maintenance from website management. At FMEOS, management is for larger sites that need frequent content updates, new sections and regular analysis, while maintenance keeps a stable site healthy.

The four kinds of maintenance

Software engineers split maintenance into four types. The split is useful for website owners because it shows what a "proactive" plan should include.

• Preventive: work done before anything fails, such as updates, backups, malware scans and certificate renewals.
• Corrective: fixing what has already broken, such as a form that no longer sends or a checkout error.
• Adaptive: responding to changes outside your site. Browsers change, hosts retire old PHP versions, payment providers update their requirements and the law moves.
• Perfective: making a working site better, for instance by improving speed or usability.

Adaptive maintenance is the one people forget. A website can start failing without anyone touching it, because the world around it changed. The shortening life of SSL certificates, covered later, is a current example.

What website maintenance services include

A complete plan covers ten areas. The last column is the one most plans never mention: the evidence you should be able to ask for. A task you cannot verify is a claim, not a service.

Task	What it involves	How often	Evidence to ask for
Software updates	Updating the CMS, plugins, themes and extensions, ideally on a staging copy first, then checking the live site	Weekly to monthly; security fixes as soon as practical	Change log of what was updated and when, plus the post-update checks
Security monitoring	Vulnerability alerts, malware scans, login protection, firewall rules, review of admin accounts	Continuous or daily; account review quarterly	Scan reports, alert history, current list of admin users
Backups	Automated copies of files and database, stored away from the server, kept for an agreed period	Daily for active sites; at least weekly otherwise	Backup log and the date of the last successful restore test
Uptime and error monitoring	Automated checks of the homepage and key pages such as checkout, with alerts to a named person	Continuous, with checks every few minutes	Uptime report and a note on each incident
Performance checks	Core Web Vitals, image weight, caching, database tidy-up, plugin load	Monthly and after major changes	Before-and-after speed figures
SSL, domain and DNS	Certificate renewal, domain expiry dates, DNS and email authentication records	Checked monthly; renewals automated	Expiry dates listed in the monthly report
Functional testing	Forms, checkout, login, search, broken links and 404 errors	Monthly; key journeys after every update	A written list of what is tested
Content changes and support	An agreed allowance of edits, fixes and how-to help	On request	Ticket log showing time used
Reporting and review	Plain-English summary of work done, issues found and recommendations	Monthly, with a quarterly review	The report itself
UK compliance checks	Cookie banner behaviour, privacy notice accuracy, accessibility regressions	Quarterly	Cookie scan and accessibility check results

Not every provider includes every row. That is acceptable, provided the plan says which are excluded and you do not assume otherwise.

What is usually not included

Each item below is a common source of an unexpected invoice, so ask about it before signing.

• New features, integrations and redesigns, which are development work.
• SEO campaigns, content writing and advertising.
• Hosting fees, domain renewals and premium plugin or theme licences.
• Clean-up after a hack, which many providers quote separately from routine care.
• Work outside agreed hours, including evenings and bank holidays.

At the cheapest end of the market, some plans amount to automated plugin updates applied straight to the live site, with a report afterwards and no testing. Hold any plan up against the table above. If a row is missing and the price is low, you have found where the saving came from.

How website maintenance works, step by step

A well-run plan follows the same eight steps. The first pass is onboarding, and every cycle afterwards repeats steps 3 to 8.

1. Audit and baseline. The provider lists what you actually run: CMS version, plugins, themes, PHP version, hosting, integrations and who holds admin access. This often surfaces abandoned plugins that nobody remembers installing.
2. Safety net. A full backup is taken and a restore is tested on a separate copy. Until a restore has worked once, you do not know that your backups do.
3. Triage updates. Available updates are sorted by risk. Fixes for vulnerabilities that attackers are already using jump the queue, while routine feature updates wait for the scheduled cycle.
4. Test on staging. Updates are applied to a copy of the site and the key journeys are checked: forms, checkout, login, search and the mobile layout.
5. Deploy. Approved updates go live, ideally at a quiet time, with a rollback plan ready.
6. Verify. The live site is checked again, and monitoring watches for errors and slowdowns over the following hours.
7. Report. You receive a plain-English summary of what changed, what was found and what needs your decision.
8. Review and adapt. Each quarter, the plan is compared with how the site is really used. New plugins, extra traffic or a changed regulation may mean more or fewer hours.

Steps 2 and 4 take the most time, and they are the ones most often cut where the price is low. If a provider cannot describe how they handle them, the rest of the plan matters less.

When something goes wrong between cycles

Monitoring can raise an alarm at any hour: the site is down, malware is flagged, or a serious vulnerability is published. The provider then triages, restores from backup if needed, finds the cause and closes the gap. Your plan should state how quickly they respond, who is notified, and whether this work sits inside your monthly fee or is billed on top.

Why website maintenance matters

The risks are measurable, they move fast, and they are mostly invisible until they cost you something.

Security: updating is necessary but no longer sufficient

Industry security research covering 2025 shows how quickly the threat has changed. WordPress is used here because it has the best public vulnerability data, not because other platforms are immune.

• Volume is rising. More than 11,000 new vulnerabilities were found in the WordPress ecosystem in 2025, around 42% more than the year before.
• The risk sits in add-ons. Around 91% were in plugins and 9% in themes. Only a handful were in WordPress core itself.
• Attackers move in hours. The most heavily targeted flaws were typically being exploited at scale within about five hours, and roughly half of high-impact vulnerabilities within 24 hours.
• An update does not always exist. Close to half of vulnerabilities had no developer fix when they were disclosed publicly.
• Host defences are patchy. In testing, common hosting-level defences blocked only a minority of WordPress-specific attacks.

The practical conclusion is that a monthly click on "update all" leaves a gap measured in weeks against attackers who work in hours. Good maintenance adds vulnerability monitoring and, where no fix exists yet, a temporary mitigation such as a firewall rule.

There is also a calendar effect. Malicious file uploads rose sharply in November and December 2025. If you run a shop, the weeks before Black Friday are the time to have everything patched and tested.

One more pattern explains why owners often miss infections. Some malware shows clean pages to site owners and scanners while serving spam to search engines or redirecting real visitors. You may only learn about it from a customer complaint or a drop in rankings.

Speed: sites slow down without anyone touching them

Google's Core Web Vitals measure three things at the 75th percentile of real visits:

Metric	What it measures	Good	Poor
Largest Contentful Paint (LCP)	How quickly the main content appears	2.5 seconds or less	Over 4 seconds
Interaction to Next Paint (INP)	How fast the page responds to taps and clicks	200 milliseconds or less	Over 500 milliseconds
Cumulative Layout Shift (CLS)	How much the layout jumps while loading	0.1 or less	Over 0.25

Sites drift away from these numbers. Each new plugin adds scripts and database queries, editors upload heavier images, and small inefficiencies accumulate. Treat Core Web Vitals as a quality floor that protects visitors' patience, not as a lever that overrides relevance in search.

Revenue: quiet failures cost the most

A homepage can be up while the contact form fails, a checkout button errors on one browser, or an expired certificate throws a warning. Monitoring only the homepage misses all three. This is why the evidence column in the table above lists key-journey checks rather than just uptime.

Compliance: the rules also change

UK cookie rules and penalties changed in 2026, and accessibility expectations continue to rise. Both are covered in the UK compliance section below.

What website maintenance cannot do

Maintenance lowers risk and keeps a good site good. It does not fix everything, and a provider who implies otherwise is overselling.

• It cannot turn a weak build into a strong one. A bloated theme, a page builder doing too much or underpowered hosting will keep a site slow however carefully it is updated. That needs development work.
• It does not guarantee rankings or traffic. Healthy sites rank more reliably than broken ones, but visibility depends on content, competition and links. That is the job of SEO, not maintenance.
• It cannot make abandoned software safe. If a plugin or theme is no longer supported by its developer, updating is impossible. The honest options are to replace it, isolate it or rebuild around it.
• It does not make you attack-proof. The aim is fewer successful attacks, faster detection and quicker recovery. Claims of "hacker-proof" sites are a red flag.
• It depends on access and documentation. A provider who inherits a site with undocumented custom code, missing credentials or no staging environment will need an audit first, and the first month may cost more than the next eleven.
• Hours are finite. On an hours-based plan, every content edit comes out of the same allowance as security checks. If you edit constantly, you may need more hours or a separate content arrangement.

How much do website maintenance services cost in the UK?

UK website maintenance typically costs between £45 and £400 a month for a small or medium business site, and from around £500 a month for online shops and revenue-critical sites. The spread is wide because providers sell different things under the same name.

What the money buys

The bands below overlap, and the price inside each depends on how many human hours the plan includes.

Band	Typical monthly price	What you are usually buying	Suits
Essential care	About £45–£150	Updates, backups, uptime alerts, a small allowance of support hours and fixes	A brochure site that changes occasionally
Business care	About £100–£400	More support hours, faster turnaround, regular content changes, security checks and reporting	A business site that generates leads, or WordPress with several plugins
Business-critical	About £500–£2,000	Checkout and order monitoring, fastest response, developer hours, multiple sites	Online shops, bookings, memberships, high-traffic sites
Management and growth	About £500–£2,500+	Maintenance plus SEO, content, analytics and development	Sites expected to grow enquiries or sales

The hours test for any quote

Most professional maintenance is priced in hours, not as a flat fee for unlimited work. So ask every provider two things: how many support hours the plan includes, and what they charge per hour beyond it.

That gives you a quick test. Divide the monthly fee by the hourly rate to see how much human time you are really buying. UK agency rates vary widely, which is why two £100 plans can be very different products.

Apply the same test to us. Our standard rate is £18 an hour. Our Basic plan (from £45) includes up to 2 support hours a month, Pro (from £129) up to 6 hours, and Premium (from £520) up to 30 hours. If a quote cannot tell you its hours, ask why.

What drives the price

• Size and structure. More pages, templates and products mean more to test after each update.
• Platform. WordPress with 15 to 30 plugins takes more care than a simple site with few dependencies.
• Integrations. Payment gateways, CRMs and booking tools each add something that can break.
• Business criticality. A site that takes orders daily needs more proactive monitoring than one that gets the occasional enquiry.
• Response time. A same-day turnaround costs more than a five-day one.
• Content changes. Frequent edits use hours that would otherwise go on technical care.

Also confirm whether quotes include VAT. A £200 plan costs £240 with VAT if you cannot reclaim it.

Three worked examples

These are illustrations with stated assumptions, not client case studies.

1. An eight-page brochure site for a local trades business. The owner needs it to stay secure and online. A budget of £45 to £129 a month, or £540 to £1,548 a year, covers this. If the owner did it themselves at 2 to 5 hours a month, and valued their time at £75 an hour, the hidden cost would be £150 to £375 a month. Use your own hourly figure, but do the sum.
2. An online shop turning over £360,000 a year. Average revenue is £360,000 ÷ 8,760 hours, about £41 an hour. Real revenue is uneven, so an outage during a sale costs several times more than the average hour. A £520-a-month plan is £6,240 a year, or about 1.7% of revenue.

\text{Downtime cost} = \frac{\text{annual online revenue}}{8{,}760} \times \text{peak factor} \times \text{hours offline}

The peak factor is the number you supply: 1 for a quiet night, higher for a sale or Black Friday.

1. A growing business site. A site needing around 6 hours of work a month fits our Pro plan at £129, about £21.50 per included hour. Ad-hoc work at £18 an hour looks cheaper, but it carries no guaranteed response time. The plan buys priority, a 0–3 day turnaround, CMS and eCommerce support and SEO work.

Costs outside the monthly fee

Budget separately for hosting, domain renewals, premium plugin and theme licences that renew annually, and any emergency work if the plan excludes it. Ask for a written list of what falls outside the fee before you sign.

DIY, freelancer, agency or host: who should maintain your website?

There is no single right answer. The right choice depends on how much the site earns, how technical you are, and who is available when something breaks.

Option	Strengths	Weaknesses	Best for
Do it yourself	No fee, full control	Skills gap, usually no staging copy, nobody to check your work, stops when you are busy or ill	A simple site run by someone technical
Freelancer	Personal, flexible, often cheaper	One person means one point of failure during holidays, illness or a career change	A small site, provided access and documentation are shared
Maintenance agency or specialist	Team cover, defined process, monitoring tools, agreed response times	Higher cost, and quality varies by provider	A site that generates leads or sales
Automatic updates and a security plugin	Very cheap	No testing, no human accountability, nobody reading the alerts	A static site that rarely changes

A four-question test

Answer these honestly before you decide.

1. Does the site take money, bookings or customer data? If yes, professional cover is usually justified.
2. Who can fix it at 9am on a Monday, and who covers when they are away? If the answer is "nobody" or "me, on holiday", you have a gap.
3. Do you have a staging copy, and have you ever restored a backup? If either answer is no, you are not maintaining safely, whatever you call it.
4. What is an hour of your time worth against the monthly fee? Use the 2 to 5 hours a month estimate from the cost section.

A "yes" to the first question, or a "nobody" to the second, is enough reason to buy cover. If both are comfortably covered, DIY or a lighter plan can be sensible.

If you do keep it in-house, at least put the weekly and monthly items from the checklist below in a shared calendar, and test one restore this quarter.

How maintenance differs by platform

The work depends on how much of the stack you own. On a hosted builder, the vendor handles most of it. On a self-hosted CMS or a custom build, it is all yours or your provider's.

Platform	What the platform vendor handles	What maintenance focuses on	Watch for
WordPress	Core releases only	Plugin and theme updates tested on staging, vulnerability monitoring, PHP version, backups	Abandoned plugins, expired premium licences, plugin count creeping up
WooCommerce	As WordPress	Everything above, plus checkout, payment gateway, stock and order emails tested after changes	Extensions that touch checkout; payment provider changes; peak-season readiness
Shopify	Hosting, platform security and patching	Theme updates, apps, tracking scripts, content, speed, accessibility	App bloat; theme updates that overwrite customisations
Magento and OpenCart	Vendor patches, but you apply them	Server and PHP versions, security patches, extension compatibility	Patches released faster than a store can safely apply them without a process
Joomla and Drupal	Core releases	Core and extension updates, and planning for major version upgrades	Major versions reaching end of life; upgrading is a project, not routine care
Hosted website builders	Hosting, updates, security	Content accuracy, forms, links, cookie banner, basic SEO	Paying for technical care you do not need
Custom builds (Laravel, React, PHP)	Nothing	Dependency and framework upgrades, runtime versions, API changes, monitoring	Missing documentation, no repository access, a single developer who knows it all

This is why a flat price for "website maintenance" can mislead. A hosted-builder site and a 500-product WooCommerce store are different jobs.

A question worth putting to any provider: which parts of my stack do you update, and which does the platform vendor handle? A good answer names components. A vague one suggests they have not looked.

One caution on the security figures in this guide. They describe WordPress because that is where the public data is richest. Other self-hosted platforms carry similar exposure through third-party extensions.

How to choose a website maintenance provider

Compare providers on scope and evidence, not on the headline price. Ask these ten questions of every shortlisted provider, including us, and keep the answers in writing.

Question	A good answer sounds like	A warning sign
What exactly is covered, and what is excluded?	A written scope with named exclusions and stated hours	"Everything" or "unlimited"
Do you test updates before they go live?	A staging copy, then named checks of forms, checkout and login	"Updates are applied automatically"
When did you last test a restore, and how long did it take?	A date and a time-to-restore figure	"We take daily backups" and nothing more
What is your response time, and your resolution time?	Two separate commitments, with hours covered and an emergency route	"24/7 support" with no timings
Who will I actually deal with?	A named contact or dedicated support manager	A ticket form and a chatbot
Who owns the domain, hosting and admin accounts?	You do, and the provider has delegated access	The provider holds them in its own name
What does the monthly report show?	A change log with versions, uptime, backup status, scan results and recommendations	A single "all is well" summary
What happens if the site is hacked?	A defined process: contain, restore, find the cause, close the gap, plus whether clean-up is included	"That will not happen"
How do you handle personal data?	Written data-protection terms, because a provider with admin access to a site holding customer data is usually acting as a processor under UK GDPR	No mention of it
What happens if I leave?	A handover pack, a short notice period and all credentials returned	Fees to leave, or files you cannot export

Contract terms worth reading twice

• Minimum term and notice. Some retainers lock you in for months. Ours run month to month and can be changed or cancelled at any time. Check yours.
• Unused hours. Do they roll over, and for how long?
• Out-of-scope rate. What is the hourly price for work beyond the allowance?
• Auto-renewal and price reviews. When can the price change, and with how much notice?
• Backup retention. How many days of restore points are kept, and where?
• Liability. Limits on liability are common, so read what the provider will and will not stand behind.
• VAT. Is the quoted price before or after VAT?

Red flags

• Promises of "hacker-proof" security or guaranteed rankings.
• "Unlimited" changes and support at a very low price.
• No staging environment and no restore testing.
• Your domain or hosting registered to the provider.
• Reports made of green ticks with no list of what changed.
• Pressure to sign a long-term contract before anyone has looked at the site.
• Unwillingness to put you in touch with existing clients. Any provider worth hiring should be happy to.

If you are inheriting a site

Expect an audit first. A new provider needs to learn what is installed, what is outdated and what nobody documented. Gather every credential into a password manager before you start, confirm you own the domain, and ask for the audit findings in writing. A one-off onboarding fee is reasonable. A long contract signed before the audit is not.

Website maintenance checklist

Use this to run maintenance yourself or to audit a provider. Items under "Continuous or daily" should be automated and alerting, not done by hand.

Continuous or daily

• Uptime and error monitoring, with alerts going to a named person.
• Automated backups running, and failures flagged.
• Security alerts reviewed, not just collected.

Weekly

• Check for pending updates and apply critical security fixes straight away.
• Review backup logs for failures.
• Run a malware and vulnerability scan.
• Send a test through each contact form and confirm it arrives.
• Clear spam comments and review new user registrations.

Monthly

• Apply routine updates on a staging copy first.
• Test the key journeys: forms, checkout, login, search, mobile layout.
• Check for broken links and 404 errors.
• Review Core Web Vitals and page speed.
• Review admin accounts and remove anyone who no longer needs access.
• Check SSL, domain and hosting expiry dates, and confirm certificate renewal is automated.
• Read the maintenance report and ask about anything unclear.

Quarterly

• Restore a backup to a test environment and time it.
• Remove unused plugins, themes and user accounts.
• Check that the cookie banner behaves as your cookie policy says.
• Spot-check accessibility, including keyboard navigation and colour contrast.
• Check the PHP version and hosting resources.
• Compare hours used against the plan allowance.

Annually

• Run a full security and performance audit.
• Calendar every renewal: domain, hosting, SSL, premium licences.
• Review content accuracy: services, prices, contact details, legal pages.
• Review the provider's performance against the agreement, and the agreement against your needs.
• Update the incident plan: who to call, where backups live, who holds which credentials.
• Check whether your CMS or framework version is approaching end of support.

Common website maintenance mistakes

1. Treating hosting as maintenance. Hosting keeps the server running. It does not test your plugin updates, read your security alerts or check your checkout.
2. Updating the live site without a safety net. No fresh backup and no staging copy means a bad update becomes a live outage.
3. Never testing a restore. A backup you have not restored is an assumption. Corrupt, incomplete or unreachable backups are discovered at the worst possible moment.
4. Monitoring only the homepage. The homepage can be up while forms, checkout or login are broken. Monitor the journeys that earn you money.
5. Keeping software you do not use. Every installed plugin and theme is attack surface. Deactivating is not the same as deleting.
6. Sharing logins and never revoking them. One shared admin password, and access for former staff and former agencies, is how many avoidable incidents start. Give each person their own account and review the list quarterly.
7. Not owning your own accounts. If your domain or hosting is registered in an agency's or ex-employee's name, you are one disagreement away from losing control of your website.
8. Buying on price alone. Without a written scope, stated hours and a response commitment, two quotes of £50 and £250 are not comparable.
9. Ignoring end-of-life software. Unsupported PHP versions, CMS versions and abandoned plugins stop receiving security fixes. No amount of monitoring makes them safe.
10. Mistaking the report for the work. A report full of green ticks proves a script ran. Ask for the change log, and spot-check one entry each month.

Advanced concepts worth knowing

These are the ideas that separate a careful provider from a script that clicks "update all". You do not need to implement them. You need to know enough to ask about them.

Recovery time and recovery point

Two plain-English questions drive every backup decision. How long can the site be down before it hurts (recovery time)? How much recent data can you afford to lose (recovery point)?

A brochure site can lose a day of changes without much harm. A shop taking orders every few minutes cannot. For the shop, a daily backup could lose a full day of orders, so the database needs far more frequent backups or a separate order log. Set these targets using the downtime cost formula from the pricing section, then check the plan meets them.

Backups that survive an attack

The familiar 3-2-1 rule still applies: three copies, on two kinds of storage, with one held off-site. Add two refinements. Keep copies where an attacker with access to the site cannot delete them, and keep restore points old enough to predate a slow infection. Attackers often plant persistent footholds that reinfect cleaned sites, so a backup from last night may already be compromised.

Virtual patching when no fix exists

As noted earlier, close to half of WordPress vulnerabilities had no developer fix at disclosure. A virtual patch is a firewall rule that blocks the specific attack until a real update appears. Generic firewalls catch only a minority of WordPress-specific attacks, which is why platform-specific rules are worth asking about.

Integrity monitoring

Modern malware is often injected into legitimate core, plugin and theme files rather than dropped as obvious new ones. File-integrity monitoring compares your files against known-good versions and flags changes, which catches infections that a simple "find new files" scan misses.

Staging, visual comparison and scripted journeys

A staging copy lets updates break things safely. Better providers add automated screenshot comparison, which flags layout changes a human might miss, and scripted tests that walk through checkout or a booking in test mode after every change.

Certificate and DNS automation

Since 15 March 2026, publicly trusted SSL certificates can last at most 200 days. The limit drops to 100 days on 15 March 2027 and 47 days on 15 March 2029, under the industry rules that govern certificate authorities. Renewing once a year by hand is no longer enough. Renewal must be automated, with alerts well before expiry.

Custom and AI-generated code

More custom plugins and front ends are now generated with AI, which widens the attack surface. Treat any custom or AI-written code like third-party code: review it, test it, document it and include it in the update and monitoring plan.

An incident plan for the first hour

Write this down before you need it.

1. Contain: put the site in maintenance mode and rotate admin, hosting and database credentials.
2. Preserve: keep server and access logs, because they show how the attacker got in.
3. Restore: roll back to a backup that predates the compromise.
4. Close the gap: patch or remove the entry point before going live again.
5. Verify: rescan, and check Google Search Console for security or spam warnings.
6. Report if required: if personal data is involved, UK GDPR generally requires notifying the ICO within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. Take advice if in doubt.

A handover pack

Whatever provider you use, keep a current record of the platform and versions, plugin list and licences, DNS records, backup locations, deployment process and who holds which accounts. It lets you switch provider in days, not months, and it is useful to any auditor or insurer who asks how the site is run.

UK compliance: what maintenance has to keep up with

This section is general information, not legal advice. Its purpose is to show where maintenance and compliance overlap, because a site that was compliant at launch can drift out of line.

Area	What the rules say	What maintenance should do
Cookies and tracking (PECR, UK GDPR)	Consent is required for non-essential cookies. The Data (Use and Access) Act 2025 changed PECR, with the main provisions in force from 5 February 2026. It added conditional exemptions for some low-risk uses such as certain analytics, and raised maximum PECR fines to UK GDPR levels, up to £17.5 million or 4% of global turnover	Scan for cookies and trackers after every plugin, theme or tag change. Do not assume every analytics set-up qualifies for the new exemption; check the ICO's current guidance or take advice before relying on it
Security of personal data (UK GDPR)	You must use appropriate technical and organisational measures, and use written terms with anyone who processes personal data for you	Keep a record of updates, backups and monitoring as evidence. Agree data-protection terms with your provider
Accessibility (Equality Act 2010)	Websites offering services in Great Britain fall under the duty to make reasonable adjustments. There is no statutory technical standard for private businesses, and WCAG 2.2 AA is the usual benchmark. Northern Ireland follows the Disability Discrimination Act 1995	Re-test keyboard use and contrast after redesigns and plugin changes, because updates can introduce regressions
Cyber Essentials	High-risk and critical security updates must be applied within 14 days of release	Use 14 days as a ceiling for web software even if you are not certified. Ask your assessor how the scheme applies to your hosting set-up
Card payments (PCI DSS)	If card details touch your own pages, PCI DSS obligations apply	Prefer hosted payment pages from your payment provider, which reduce how much of this lands on your site

Two practical points follow. First, put compliance checks in the quarterly review instead of treating them as a one-off project. Second, ask your provider in writing which of these they check, because they may sit outside the plan unless agreed.

How FMEOS approaches website maintenance

FMEOS is a UK-focused web design, eCommerce, SEO and hosting studio that has worked with business websites for over 18 years. Maintenance is one of the services we sell, so weigh this section accordingly and use the questions above to test us.

Our standard maintenance packages

	Basic	Pro (most popular)	Premium
Price	From £45 a month	From £129 a month	From £520 a month
Best for	A single website with occasional requests	Faster response and more requests	Multiple websites and priority care
Service requests per month	1–3	1–8	1–20
Support hours per month	Up to 2	Up to 6	Up to 30
Turnaround time	0–5 days	0–3 days	0–2 days
What's included	Content updates and link repairs; email, domain and hosting support	CMS and eCommerce support; SEO updates work included	Multiple website support; all features expanded

Basic keeps a single website current, with content updates, link repairs and help with email, domain and hosting. Pro adds CMS and eCommerce support and includes SEO work, with a faster turnaround. Premium covers multiple websites with every feature expanded and the quickest response.

• Month to month. All plans can be changed or cancelled at any time. No long lock-in.
• A dedicated support manager. You speak to the same person, rather than explaining your problem to a new agent each time.
• Transparent hourly rate. Work outside a plan is billed at £18 an hour, in 30-minute increments. Clients on a plan always get priority.
• Discounts for good causes. Up to 50% off for UK educational and non-profit organisation websites.
• Platforms. WordPress, WooCommerce, Shopify, Magento, OpenCart, Joomla, Drupal and custom PHP, Laravel and JavaScript builds.
• Maintenance and management are separate. Website management is for larger sites that need frequent content work, new sections and regular analysis. Corporate and bespoke packages are available on request.
• Hosting under the same roof. UK web hosting starts from £3.25 a month, which helps when the same team is responsible for the server and the site.

You can compare the plans on our maintenance packages page. If you are comparing us with another provider, send us the ten questions from the provider section and ask for the answers in writing. If you want a view on your current set-up first, get in touch and we will talk through what, if anything, you need.

Frequently asked questions

What is included in website maintenance services?

Most plans include software updates, security monitoring, backups, uptime monitoring, performance checks, an allowance of support hours for content changes and fixes, and reporting. Better plans also test updates on a staging copy and restore backups to prove they work. New features and clean-up after a hack are commonly excluded.

How much does website maintenance cost per month in the UK?

Roughly £45 to £400 a month for most small and medium business sites, and from around £500 a month for online shops and revenue-critical sites. FMEOS plans start from £45 (Basic), £129 (Pro) and £520 (Premium) a month.

Is website maintenance necessary?

Yes, for any live site that handles enquiries, orders or personal data. Software ages, vulnerabilities are published daily, and browsers, hosts and regulations change. A small static site needs less care, but not none.

How often should a website be maintained?

Monitoring and backups should run continuously or daily. Security fixes should be applied within days, routine updates weekly or monthly, and the whole site reviewed quarterly. Cyber Essentials expects high-risk and critical updates within 14 days of release.

What is the difference between website maintenance and hosting?

Hosting provides the server that keeps your site online. Maintenance looks after the website itself through updates, security, backups, testing and fixes. Some providers bundle both, so check the plan states which it covers.

What is the difference between website maintenance and website management?

Maintenance keeps an existing site healthy and current. Management goes further for larger sites that change often, adding regular content work, new sections and ongoing analysis.

Can I maintain my website myself?

Yes, if the site is simple and you are technical. You will need a staging copy, backups you have tested and roughly 2 to 5 hours a month. If the site earns money directly, or nobody can cover when you are away, paid cover is usually safer.

How much does WordPress maintenance cost?

In the UK, roughly £45 to £150 a month for a simple WordPress site and £100 to £400 for business sites with several plugins, rising for WooCommerce. Plugins drive the cost: around 91% of new WordPress vulnerabilities found in 2025 were in plugins.

What happens if I do not maintain my website?

Problems build quietly: unpatched vulnerabilities, slower pages, broken forms, expired certificates and, eventually, a hacked or offline site. The most heavily targeted WordPress flaws are now exploited at scale within hours of disclosure.

Does website maintenance help SEO?

Indirectly. It keeps the site fast, secure and free of broken pages, which protects existing visibility. It does not create rankings by itself. That takes content, links and a proper SEO programme.

How do I know my provider is doing the work?

Ask for a monthly report with a change log listing versions and dates, uptime, backup status, the date of the last restore test, security scan results and recommendations. Spot-check one entry each month against the live site.

Do maintenance plans include content changes?

Usually, as an allowance measured in hours or requests. Check what counts, what happens if you go over, and the hourly rate for extra work. At FMEOS, plans include 2 to 30 support hours a month, and extra work is £18 an hour.

How long are website maintenance contracts?

It varies. Some retainers have a minimum term of several months, while others roll monthly. FMEOS plans are month-to-month and can be cancelled at any time. Check the minimum term, notice period, hours roll-over and out-of-scope rate before signing.

Key takeaways

• Website maintenance services are recurring updates, security, backups, monitoring, performance checks and support. Hosting, development and SEO are separate jobs.
• Judge a plan by scope and evidence, not price. Use the ten-task table, ask for proof of each task, and apply the hours test: monthly fee divided by hourly rate.
• Most UK small and medium sites pay roughly £45 to £400 a month, and online shops from around £500.
• Updating alone no longer protects a site. Attackers exploit heavily targeted flaws within hours, and close to half of WordPress vulnerabilities had no fix at disclosure. Ask about monitoring and virtual patching.
• Test updates on a staging copy, and test backups by restoring them.
• You should own your domain, hosting and admin accounts, and hold a current handover pack.
• Compliance belongs in maintenance: cookie behaviour under the 2026 PECR changes, accessibility regressions, the 14-day patching benchmark and automated SSL renewal.

Where to start this week

You can learn more about your site's real condition in an afternoon than in a month of reading. In this order:

1. Confirm ownership. Check that the domain, hosting and admin accounts are registered to your business, and list everyone with access. Remove anyone who should not have it.
2. Find your last backup. Establish when it ran and where it is stored. Ask for a restore test to a separate copy, or run one yourself.
3. Audit your plugins and extensions. Remove anything unused and flag anything its developer has not updated in over a year.
4. Check Core Web Vitals. Open Google Search Console or PageSpeed Insights and compare your figures with 2.5 seconds, 200 milliseconds and 0.1.
5. Test the money paths. Submit a test enquiry through every form and run a test order through checkout.
6. Decide who looks after it. If you already pay someone, send them the ten questions. If not, work through the four-question test.

If you would like a second opinion on any of this, our team offers a free consultation. You can see the maintenance packages or contact us directly.