Website Maintenance: Checklist, Costs and SLA Template

What website maintenance covers, a weekly-to-yearly checklist, what it costs in India, and an SLA template to put in your maintenance contract.

Published 19 September 2026 by Web Hippo in Web Dev

Website maintenance is the routine work that keeps a live website secure, fast, working and accurate after launch: software updates, backups, security checks, renewals, and making sure the contact form still reaches someone. Most sites don't fail dramatically. They decay quietly, until a plugin gets exploited, the domain lapses or leads stop arriving and nobody notices for three weeks.

This guide is for Indian business owners and marketers who own a website but not the technical side of it. You'll get a plain list of what maintenance covers, a weekly, monthly, quarterly and yearly checklist, what it costs, how to choose between doing it yourself and hiring help, and a clause-by-clause SLA template to put in any maintenance contract.

What Website Maintenance Covers

Think of maintenance in seven areas. A site built on WordPress, Shopify or a custom stack needs all of them, though the effort varies. A static site (plain HTML files, no database) has far fewer moving parts, which is one reason we compare the two in our static vs dynamic website guide.

1. Software updates

Your CMS (content management system, such as WordPress), its plugins and its theme all get updates that fix bugs and security holes. WordPress's own hardening guide puts it bluntly: once a security fix is released, the information needed to exploit the old version is almost certainly public. It also says to delete plugins you no longer use, not just deactivate them.

WordPress helps, but only partly. Since version 5.6, new installs update core automatically. Plugin and theme auto-updates arrived in WordPress 5.5, but an administrator has to switch them on one by one, and they depend on WordPress's scheduled tasks actually running. So "WordPress updates itself" is only half true.

2. Backups and restore tests

A backup should include both the files and the database, stored somewhere other than the hosting server. WordPress's documentation recommends keeping several snapshots at different intervals, so you can still go back to a clean copy if a hack went unnoticed for days. The step most people skip is the restore test. A backup you have never restored is a hope, not a backup.

3. Security monitoring

This means watching for malware, unexpected file changes, new admin users and repeated failed logins, and keeping logins protected with strong passwords and two-factor authentication. Google Search Console's Security Issues report is the free safety net: it flags hacked content, malware and deceptive pages that Google has detected on your site. Our website security check guide walks through the tools in detail.

4. Uptime, SSL and domain renewals

Uptime monitoring pings your site every few minutes and alerts you when it goes down. Renewals are the boring part that causes the worst outages. SSL certificates (the padlock in the browser) are getting shorter lives: under a CA/Browser Forum ballot passed in 2025, the maximum validity fell to 200 days from 15 March 2026, drops to 100 days from 15 March 2027 and reaches 47 days in 2029. Anything renewed by hand will eventually be forgotten, so automatic renewal is now a requirement, not a nice-to-have.

5. Speed and broken links

Sites slow down as images, plugins and tracking scripts pile up. A monthly speed check on your key pages, plus a crawl for broken links and 404 errors (pages that no longer exist), catches most of it. Search Console's page indexing report also shows pages Google can't reach.

6. Forms, tracking and integrations

This is the area generic maintenance plans ignore, and the one that costs businesses the most money. Contact forms break when an email password changes, a plugin updates or a CRM connection expires. Analytics tags go missing after a theme update. Submit every form yourself once a month and confirm the lead arrives where it should, and check that conversions still show in GA4 (see our GA4 tracking guide).

7. Content and legal pages

Prices, team members, addresses, timings and offers go stale. So do legal pages. If your forms collect personal data, your privacy notice needs to match what you actually collect and why, especially now that India's data protection rules apply; our DPDP checklist for marketers covers what to review. That is a compliance question as much as a maintenance one, so involve whoever advises you on legal matters.

The Website Maintenance Checklist

Here is the schedule we use as a starting point. A small brochure site can stretch some of the weekly items to fortnightly; an online store taking payments should not.

What Happens When Maintenance Is Skipped

The three failures below are the ones we see most often when a business asks us to look at a site that "just stopped working". Each one is cheap to prevent and expensive to fix.

A hacked WordPress site

An outdated plugin is exploited, spam pages or redirects appear, and Google notices before the owner does. According to Google's help page, affected pages can show a warning label in search results or a full-page browser warning. After cleaning up, you request a review in Search Console, and Google says most reviews take several days or weeks. That is weeks of lost trust on top of the cleanup bill.

An expired domain

The renewal reminder goes to the email of a developer who left years ago, the card on file has expired, and the site and company email both stop working. For .com and other generic domains, ICANN's expired registration policy requires reminders about a month and a week before expiry, and a 30-day redemption period after deletion, usually at an extra restore fee. Country domains such as .in follow their own registry rules, so check your registrar's terms rather than counting on a grace period.

A broken form that loses leads

Say a Kukatpally dental clinic's enquiry form stops sending emails after a hosting change. The page still shows "Thank you, we'll call you", so visitors think they've booked. Ad spend continues, the phone goes quiet, and the team blames the campaign. A monthly test submission would have caught it in minutes. In our experience this is the most common and most expensive maintenance failure, because nothing looks broken.

DIY vs Retainer vs Ad-hoc Support

There are three ways to get website maintenance done. The right one depends less on budget and more on how much revenue depends on the site and whether anyone in-house will actually follow the checklist.

Our view: if the website brings in enquiries or orders every week, a retainer with a written scope is worth it. If it is a five-page brochure site that rarely changes, DIY with the checklist above plus an ad-hoc developer for bigger jobs is usually enough.

What Website Maintenance Services Should Include

Whoever you hire, a proper website maintenance service should cover at least these items, and say so in writing:

Updates to CMS, plugins and theme, with a backup first and a check afterwards
Daily or weekly off-server backups, with a restore test at least quarterly
Uptime and security monitoring, with a named person who responds to alerts
Tracking of domain, hosting and SSL renewal dates
Monthly form, checkout and tracking tests
A fixed number of content-change hours each month
A short monthly report: what was updated, what broke, what was fixed
Full admin access for you, and a handover process if you leave

Red flags in a maintenance quote

The domain is registered in the agency's name. It should always be in your business's name, with your email as the contact.
No mention of restore tests. "Daily backups" alone tells you nothing.
"Unlimited changes" with no definition of a change or a response time.
No reports. If you can't see what was done, assume it wasn't.
You don't get admin logins, or they are withheld until you pay an exit fee.
Nulled (pirated) premium plugins, which often carry malware and never receive updates.

A Maintenance SLA Template for Your Contract

An SLA (service level agreement) is the part of the contract that says what gets done, how fast and what happens if it isn't. Most small-business maintenance agreements in India are a single line on an invoice. Use the table below as a starting draft and fill in numbers you and your provider agree on. The example values are placeholders, not an industry standard.

The two clauses that matter most are ownership and response time. With ownership in your name, you can always switch providers. With response time in writing, "we'll look into it" has a deadline.

Website Maintenance Cost in India

Web Hippo's working range for website maintenance is ₹3,000 to ₹30,000 a month for security updates, content changes and backups. Running costs sit on top: in our website cost guide for India we put hosting at ₹2,000 to ₹50,000 a year, a domain at ₹800 to ₹2,000 a year, and SSL as usually free with hosting. That guide covers build costs; this section covers only what keeps the site running.

Where a site lands in that range depends on a handful of drivers:

Platform and plugin count. A WordPress site with 30 plugins needs more testing per update than a static site.
E-commerce and payments. Checkout, payment gateway and inventory integrations need testing every month.
Content hours. The biggest variable. Monthly edits and new pages cost more than updates.
Response time. Faster, longer support hours cost more.
Integrations. CRMs, WhatsApp, booking systems and ERPs each add something that can break.
Hosting quality. Managed hosting with its own backups and security can lower the maintenance workload.

If you would rather hand the whole checklist to one team, our web development team builds and maintains business websites across Hyderabad and India, with the scope and response times agreed in writing.

Frequently Asked Questions

Last checked September 2026. WordPress update behaviour, SSL certificate lifetimes and domain renewal rules were checked against WordPress.org, CA/Browser Forum and ICANN documentation. Cost ranges are Web Hippo's working estimates, not quotes.