What does website maintenance include? Five things: a site built so it can be maintained, hosting that is kept current, scheduled updates with security monitoring and tested backups, search checks that catch problems before rankings drop, and accurate business information that Google and AI tools can trust. If a provider only mentions plugin updates and a monthly invoice, you are buying one fifth of the job. Use the checklist below to compare what each provider actually does. It comes from xCreative™, a Melbourne studio in Chadstone that has built websites since 2016 and now hosts and maintains the servers behind nearly 100 client websites. It is the fourth article in our series that began with how we handled PHP2Shell.
The checklist is not only for WordPress. The five areas apply on every platform, but who does which part changes:
- Drupal, Joomla or Magento sites need the same updates as WordPress, plus planning for major version end dates, which tend to be bigger projects.
- Custom Laravel or other PHP builds depend on framework and package updates that only a developer who knows the code can apply safely. Ask who that person is.
- Hosted builders such as Shopify, Squarespace, Wix or Webflow run the platform for you. Maintenance there means keeping apps and themes in check, plus content, logins and SEO. Our guide to who patches what sets out each platform.
- Static sites have little running on the server, and Next.js or other Node builds update through their own package lists. Both still rely on form services and hosting, and the domain renewal still needs an owner.
Development: maintenance starts before launch
How a site is built decides how expensive it is to look after. A site assembled from 60 plugins, each from a different author, carries 60 update schedules and 60 chances that one author stops updating. When we build, the questions are practical: can this feature be done with code we control instead of another plugin, is the theme still supported, and will the next developer understand what we did?
Ask a provider for these at handover:
- A list of every plugin, theme, app or extension, who holds each paid licence and when it renews.
- Where custom code lives, kept in one documented place rather than edited into theme files that an update can overwrite.
- Admin accounts under your own business email. The domain, the hosting account and your Google accounts should be in your name too.
Our guide to changing web developers lists the accounts and files to secure in the first week.
Hosting: the layer most owners never see
Hosting is the server and software your website runs on, and it ages too. When PHP2Shell, the October flaw in the PHP language, was announced, half of the servers we manage ran a ready-made software bundle that had stopped receiving updates, so the fix could not be installed on it. We moved every one of those servers to new servers between 22 and 24 October. A maintenance plan should cover this layer, or say plainly that your host does.
What to check:
- Software versions. The PHP supported versions page shows PHP 8.2 receives security fixes until 31 December 2026. Ask which version your site runs and what the plan is before that date. Our guide to PHP end of life covers the other layers that expire.
- Backups stored off the server. The Australian Cyber Security Centre’s guidance on securing your website tells owners to check how often their host backs up and notes that storing backups offsite is more secure.
- HTTPS certificates that renew automatically, with someone alerted if a renewal fails.
- Uptime monitoring that alerts a person, not just an inbox nobody reads.
Maintenance and security: what happens in a bad week
Routine updates are the visible part. Ask how often the core software and plugins are updated, and whether updates are tested first so a booking form does not break on a Friday night. Ask how a restore works and when one was last tested, because a backup nobody has restored is still unproven.
The bigger question is what the provider does when an urgent patch lands. Here is what PHP2Shell looked like for us. The PHP project released fixed versions on 21 October 2026 and said that upgrading was the only complete fix. On 22 October we upgraded half of our servers in place to PHP 8.2.35 and checked each one. The other half moved to new servers between 22 and 24 October. Along the way we checked servers for suspicious files and removed migration plugins left behind after earlier moves. When PHP published a second advisory, we turned off the affected setting (session upload progress) on every server we manage on 24 October and confirmed the live value on each website.
A good provider can describe a week like that in plain terms. Ask them for their last example. The ACSC guidance asks owners to turn on multi-factor authentication for admin accounts, keep software and plugins updated, and review the site for unauthorised changes. A maintenance plan should cover all three, and its monthly report should say what was done, what was blocked and what is recommended next.
SEO: keep Google able to find and trust the site
Maintenance and SEO overlap more than most plans admit. A hacked site can be flagged in Google’s results. Google’s Security issues report explains that affected pages can show a warning label in search results or a warning page in the browser, and that every listed issue must be fixed across the site before a review is requested. Someone should be watching Search Console for that report and for pages dropping out of the index.
Ask whether the plan includes:
- A monthly look at indexing and security messages in Search Console.
- Speed checks against Google’s Core Web Vitals, since plugins and images slow sites down over time.
- Testing contact forms after updates, because a broken form costs enquiries without showing any error.
- Redirects planned before any redesign or move, which our checklist on rebranding without losing Google rankings covers.
GEO: give AI search accurate facts to repeat
GEO, or generative engine optimisation, is about being cited when people ask ChatGPT, Gemini or Google’s AI Mode for a recommendation. Google’s guide to AI features says there are no extra technical requirements for AI Overviews or AI Mode. A page must be indexed and eligible to appear with a snippet. The same guide lists checks that belong in maintenance: crawling allowed in robots.txt and by any CDN or hosting setup, structured data that matches the visible text, and Business Profile information that is up to date.
In practice that means your business name, address, phone number and services match on the website, the Google Business Profile and directories. It also means a firewall setting has not quietly blocked AI crawlers, which we covered in should you block AI crawlers. Our AI search optimisation work starts from those checks.
We design and build websites through our website design and development team, then host and maintain them, with SEO and GEO handled by the same studio. If you want an outside view of what your current plan covers, see our website maintenance service or contact our Melbourne studio and we will check your site against this list.
Frequently asked questions
How often should website maintenance happen?
Updates and backups should run on a schedule, usually weekly or monthly depending on how often the site changes. Urgent security patches should not wait for the schedule. A monthly report is a sensible minimum so you can see what was done.
Is hosting the same as maintenance?
No. A host keeps the server running, and some also update the server software. Whether anyone updates your website software, plugins or content depends on the plan. Ask your host and your developer in writing who updates what.
Do I need maintenance if my website never changes?
Yes. The software under an unchanged site keeps ageing, and new flaws are found in old versions. PHP2Shell affected sites whether or not anyone had edited them that year.
