Website maintenance happens where you can't see it. Ask for the proof.
Your web person says the site's on a maintenance plan. You pay for it every month, the site looks the same every month, and you've no way to tell whether anything was done.
The short answer
A plan should cover software updates, backups that have been restored at least once, the security certificate, and the domain renewal.
- It should also cover fixes when a form or a booking breaks.
- The federal Cyber Centre's baseline for small organizations asks for automatic patching1.
- It also asks for encrypted backups with long-term copies kept offline, and restores checked regularly1.
- Certificates can now last at most 200 days, falling to 47 by 2029, so renewal has to be automatic2.
- Ask for a monthly note that says what was done, and keep the logins in your business's name.
What the plan covers, and what to ask to see
| Part of the site | What good looks like | Ask to see |
|---|---|---|
| Software, themes and plugins | Patched automatically, or on a set schedule where automatic isn't possible1 | The list of what was updated this month |
| Backups | Encrypted, with long-term copies kept offline1 | The date a restore was last tested1 |
| Security certificate (the padlock) | Renewed automatically: at most 200 days from 15 March 2026, 100 days from 15 March 2027, 47 days from 15 March 20292 | Who gets the alert if renewal fails. Without it, Chrome tells visitors the site is not secure3 |
| Domain | Renewed before it expires; a lapsed .ca can stop the website and email working once the registrar cancels the auto-renewal4 | The renewal date, and the registrant name: yours |
| Hosting, registrar and admin logins | Two-factor authentication on the administrative accounts1 | Which accounts have it, and whose name they're in |
| Security standard | A named standard in the contract; the Cyber Centre's page names OWASP ASVS Level 1 in one place and the OWASP Top 10 in another1 | Which one they work to, in writing |
| Warnings from Google | Someone reads Search Console's security issues report: hacked pages can show a warning in search results5 | Who's on the Search Console account |
| Forms, bookings and payments | Tested end to end after every update | When the contact form was last tested, and where the test landed |
A builder, a WordPress site, or one built for you
On a hosted builder, most of the list belongs to the builder.
The builder runs the software.
The detail
What's left is yours: the words and photos, the domain renewal if you bought it elsewhere, and testing the forms.
On WordPress, someone has to do the whole list, every month.
Themes and plugins each need updating, and each update can break a form.
The detail
That's what a maintenance plan is for, and why the monthly note matters.
If the site takes bookings, quotes or payments, test those first.
A page that looks fine can still be losing every enquiry.
The detail
Book a test appointment and send a test quote request after each round of updates.
Five questions before you sign
- Are the domain, the hosting and the admin logins in my business's name, and will I have them?
- Where are the backups, are they encrypted, and when was a restore last tested1?
- If someone gets into the site or its data, how and when will you tell me1?
- When the contract ends, what happens to my data and my files, and how do I get them1?
- Where are the servers, and where are the people who can log in1?
The monthly note to ask for
Maintenance you can't see should still leave a record. Ask for a short note like this every month, and keep them.
- Site: [domain]. Month: [month, year]. Done by: [name].
- Updated: [software, theme and plugin names, with versions]. Anything held back, and why: [notes].
- Backups: last daily [date], last offline copy [date], last restore test [date and result].
- Certificate: renews automatically, next on [date]. Domain: renews on [date], registered to [your business].
- Tested after updates: contact form [pass/fail], booking [pass/fail], payment [pass/fail].
- Security: Search Console issues [none / details]. Admin accounts with two-factor: [list].
- Fixed this month: [what broke, when it was noticed, when it was fixed].
- Coming up: [renewals, end-of-support dates, anything that needs your decision].
Where we fit
We build the website, keep it fast and findable as part of the growth engine, and keep the accounts in your business's name.
The detail
What it costs against a builder plan you look after yourself is on our website cost page. We don't publish a price, because every system we build is scoped to the business it runs; if a builder plan would serve you better, we'll say so.
Sources
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security. Read 2026-10-28.
- Baseline Requirements for TLS Server Certificates, version 2.3.1, CA/Browser Forum. Read 2026-10-27.
- Check if a site's connection is secure (computer), Google Chrome Help. Read 2026-10-27.
- Your domain name expired. What now?, CIRA (Canadian Internet Registration Authority), 2024-03-04. Read 2026-10-27.
- Security issues report, Google Search Console Help. Read 2026-10-27.
Checked on 2026-10-28.
