What’s Actually Included in a Website Maintenance Package? (And What Isn’t)

“Website maintenance packages” is one of those phrases that sounds like it means something specific, until you actually compare what three different providers put inside one. Some website maintenance packages are a real, staffed service. Others are a cron job that runs updates unsupervised and calls itself the same thing. Here’s what should actually be inside a website maintenance package, broken down by what each piece is for — and how to tell the difference before you’re relying on it.

What every real website maintenance package should include

Software updates. WordPress core, your theme, and every plugin need regular updates, many of which patch security holes as soon as they’re publicly disclosed — the kind tracked publicly by resources like the WPScan vulnerability database. The question isn’t just “do updates happen” — it’s whether they’re tested before going live, or just pushed straight to your site and hoped for the best.

Backups. A saved, restorable copy of your entire site, taken on a real schedule — not a one-time setup that was never touched again. If something breaks, a backup is the difference between a five-minute restore and rebuilding from scratch.

Uptime and error monitoring. Something watching your site around the clock so you find out your site is down from an alert, not from a customer’s complaint.

Security hardening. Firewall rules, login protection, malware scanning — the layer that makes your site a harder target in the first place, not just something that responds after a breach.

A monthly report. Not a nice-to-have — this is how you actually verify the other four are happening, instead of just trusting that they are.

If any of these five is missing, what you’re looking at isn’t really one of the website maintenance packages worth paying for — it’s a partial one, priced like a full one.

Where website maintenance packages genuinely differ — and should

Beyond the core five, real packages differentiate on things that legitimately cost more to provide:

Development hours. Pure maintenance keeps your site running as-is. Many businesses also need small ongoing changes — content updates, a new landing page, a form tweak. Packages that bundle a few hours a month save you from separate hourly billing for routine work.

Response time. A same-day, priority response for a site going down costs more to staff than a 48-hour window. Both are legitimate — they just fit different levels of how much downtime actually costs you.

Backup frequency. Bi-weekly is fine for a mostly-static site. An actively updated site — new content, active campaigns — benefits from weekly or even daily backups, since more changes mean more that a stale backup would lose.

Ownership scope. Some packages only touch the WordPress software itself. Others take on the full technical picture — hosting, DNS, CDN, email — so you have one point of contact instead of juggling providers when something goes wrong.

A concrete example, tier by tier

Here’s how this breaks down in practice, using our own three tiers as a reference:

Basic Care covers the full core five — updates, backups, monitoring, security, reporting — with a 48-hour response window and no bundled development time. This is a genuine, complete maintenance package for a stable site that doesn’t change often.

Pro Care adds 2 hours/month of development work, weekly backups, a dedicated account manager, and technical SEO monitoring, with a 24-hour response window. This is the tier for a site that’s actively growing.

Partner Care adds 4 hours/month, daily backups, same-day priority response, and full technical ownership of hosting and infrastructure — built for sites where downtime has a direct revenue cost, like e-commerce.

Notice what doesn’t change across tiers: the core five are non-negotiable at every level. What changes is response speed, backup frequency, and how much active development is bundled in.

The gap between a real and a partial package usually only shows up at the worst possible time. A site running on a “maintenance package” that’s actually just an unattended update script tends to look identical to a properly staffed one — right up until an update conflicts with a plugin, nobody’s watching, and the site is broken or offline until the owner happens to notice. The five core pieces exist specifically to close that gap: not to make maintenance more impressive on paper, but to make sure someone actually catches the problem before a customer does.

How to compare website maintenance packages side by side

When you’re looking at quotes from different providers, line them up against the same five categories every time: what’s updated and how often, how backups work and how far back they go, what triggers an alert, what security measures are included, and whether you get a report you can actually read. Providers that welcome this comparison are usually confident in what they offer. Providers whose answers get vaguer the more specific your questions get are telling you something too.

What a package should never leave out — no matter the price

Regardless of tier or price point, walk away from any package that can’t clearly answer: how often backups run, whether updates are tested before going live, and what the guaranteed response time is if the site goes down. If those three answers are vague, the package is probably automated updates wearing a maintenance label — see our deeper breakdown of what backups, updates, and uptime monitoring actually do for why that combination matters more than any single piece on its own.

Why two packages at the same price contain different things

Here is the part that makes comparison genuinely hard: what sits inside a package varies far more between providers than the price does. Two quotes at €200 a month can differ by an order of magnitude in actual work.

The reason is that most of the cost is labour, and labour is only spent when something needs doing. A provider running an automated update script across four hundred sites has almost no marginal cost per site. A provider who tests updates on a staging copy, checks the site afterwards, and reads the changelog when a plugin makes a breaking change is spending real time every month. Both can honestly write “plugin updates included.”

So the price tells you very little. What tells you something is the answer to how. Ask whether updates are tested before they go live. Ask what happens if an update breaks something — whether the rollback is automatic, manual, or a conversation. Ask how many sites one person looks after.

None of that appears on a pricing page, which is exactly why the feature list is the wrong thing to compare on its own. The list is nearly identical everywhere. The work behind each line is not.

The part nobody puts on the list

Here is the item that never appears on a features grid and is worth more than most of the ones that do: somebody noticing.

A concrete example from our own portfolio. A client’s marketing lead wanted to add a page. She installed a plugin to duplicate an existing one, picked a page as her starting point, and duplicated it. The site broke. It was restored from an earlier version seven minutes after she told us.

That is the story people expect from maintenance — something broke, someone fixed it. But that is not the interesting part.

The interesting part is that the duplication left residue in the site’s URLs. Pages ended up on addresses with numeric suffixes appended to avoid collisions, and one page’s address described a completely different topic than its content. Nobody noticed, because nothing looked broken. Two years later we found it during a routine check and cleaned it up — renaming the pages properly and putting redirects behind them so no accumulated links were lost.

Nobody at that organization could have spotted that. It produced no error, no alert and no complaint. It just quietly split the site’s search authority for two years.

That is what you are actually buying. Not availability when something breaks — you will notice that yourself. You are buying attention on the things that break silently.

Where to start

For the full pricing and feature breakdown across all three tiers, see our WordPress maintenance plans. If you’re comparing options and want to know what a fair price looks like for what’s included, our WordPress maintenance cost breakdown covers that in detail.

Svetoslav Kodzhamanov is the founder of Hexweb, a WordPress web design and development studio he started in 2018 and has since grown into a small team of designers and developers. He has personally led close to 500 WordPress projects for businesses and agencies across North America and Europe. He works with clients worldwide and speaks English, German, Bulgarian and Russian.

Not sure what shape your site is in right now? Our free website audit runs thirteen checks and comes back in plain English, with no obligation.