A live website creates several different kinds of work.
A software update, a broken enquiry form, a new team profile and a redesigned customer journey should not all enter the same undefined support bucket. They carry different urgency, risk and amounts of decision-making.
A useful plan makes those categories visible. It says which work happens routinely, how requests are estimated, what counts as an incident and when a change needs its own scope.
What should website maintenance and support include?
Define the websites and systems covered; software, dependency and configuration maintenance; monitoring and backup responsibilities; content and design request handling; incident reporting; response commitments where offered; accessibility and performance review; reporting, exclusions, account ownership and the exit process.
Separate support into four workstreams.
This separation makes priorities and commercial boundaries easier to understand without forcing every request through a new supplier search.
Routine maintenance
Supported software and dependency updates, configuration care, certificate and domain checks, monitoring review and backup verification keep known systems in an expected operating state.
Content and design requests
Copy, imagery, new articles and small layout changes need a request, approval and publishing route. Define the allowance and when a request is too large for routine support.
Planned improvements
New pages, journeys, integrations and features usually need discovery, design, testing and release work beyond maintenance. They can be prioritised through a small roadmap and scoped when ready.
Incidents and urgent fixes
Availability failures, security concerns and broken critical journeys need a separate reporting and escalation route. Severity should follow business impact, not the volume of messages.
Technical maintenance is more than installing updates.
Updates are important, but a dependable process also knows what exists, whether the change succeeded and how to recover if it did not.
Asset and dependency awareness
Keep a useful record of the platform, libraries, plugins, services, integrations and account owners. Unsupported components should be visible before they become emergency work.
Controlled updates
Apply supported updates through a route that allows appropriate testing and rollback. Urgent security issues may need faster triage than the normal release cadence.
Monitoring and verification
Check that priority pages, forms, certificates and integrations continue to work. Monitoring should lead to a named action rather than create alerts nobody owns.
Backup and recovery
Confirm what is backed up, where the copy is held and whether restoration works. Recovery responsibility should not begin after the live data has already been lost.
Use support to improve the website, not only preserve it.
Once the operational baseline is covered, the same relationship can create a controlled route for useful change.
Review real questions
Enquiries, sales conversations, support requests and search data can show where content or journeys are unclear. Turn repeated friction into a prioritised improvement rather than isolated edits.
Recheck accessibility
New content and components can introduce barriers after the initial launch. Include keyboard, focus, labels, alternatives and responsive behaviour in ongoing quality checks.
Watch performance budgets
New scripts, media and integrations accumulate. Review important pages after material changes and decide whether each added cost still earns its place.
Keep decisions recorded
A short change log, open-risk list and roadmap reduce repeated discovery. They also make handover possible if the people or provider around the website change.
A website support plan checklist.
Use these lines to turn a broad retainer into a service both sides can operate consistently.
Assets covered
Name the websites, environments, domains, integrations, repositories and third-party services inside the plan.
Maintenance work
List the updates, checks, monitoring review and backup responsibilities included as routine care.
Request allowance
Define how content and design requests are submitted, estimated, approved and counted against any retained time.
Incident route
Set the reporting channel, severity definitions, coverage hours and any contractual acknowledgement or response targets.
Exclusions
Separate new features, major redesigns, unsupported systems, third-party outages and work requiring a specialist review.
Reporting
Agree how completed work, open risks, recommendations and unused or additional time are made visible.
Ending the service
Cover notice, access removal, outstanding requests, documentation, backups and transfer of operational knowledge.
Sources and further reading.
These primary sources inform the guidance above. Your project may need additional legal, security or accessibility advice for its own context.
Vulnerability management
UK National Cyber Security Centre: Guidance on supported software, update strategy, vulnerability assessment, ownership and prioritisation.
Web Content Accessibility Guidelines 2.2
W3C: The W3C Recommendation used to structure repeatable accessibility checks for web content and interaction.
Choose the route you will actually use.
The best support plan is not the one with the longest feature list. It is the one that matches how often your website changes, how important it is to the business and who can make decisions when work is needed.
Website maintenance questions.
What is included in website maintenance?
Maintenance commonly covers supported software and dependency updates, configuration checks, monitoring review, backup verification and routine technical fixes. The exact systems, cadence and exclusions should be named in the agreement.
Does website support include content changes?
Only if the plan says so. Some retainers include a defined allowance for copy, image or page changes; others price them separately. Clarify request size, approval, turnaround, unused time and what becomes a separately scoped improvement.
How often should a website be maintained?
There is no single cadence for every task. Security updates may need prompt action, monitoring is continuous or frequent, content reviews follow the business and deeper accessibility or performance reviews can be periodic. The plan should define each trigger rather than promise a generic monthly check.
What is the difference between a fix and an improvement?
A fix returns agreed behaviour to its expected state. An improvement changes or extends that state, such as a new page system, workflow or integration. Defining the distinction reduces disputes about what a retainer includes.
Do small business websites need ongoing support?
They need an owner for updates, incidents, domains, forms and future changes. That responsibility can sit internally, with the original studio or with another provider. A retained plan is useful when the business wants predictable access and does not have that capability in-house.