What's actually in a website maintenance plan

A lot of small business owners don’t really know what they’re paying for when they sign a “maintenance” or “hosting” plan. They got pitched something at the end of a build, the developer said it was needed, and now somewhere between $50 and $300 a month leaves their account on autopay. Ask what they’re getting for that money and the answer is usually some version of “I’m not sure.” On one site I redesigned, the answer turned out to be seven broken links, a wrong zip code, and an exposed admin username, all on a $200-a-month plan.

That’s bad. So here’s what’s in mine, what isn’t, and what to ask anyone who’s charging you for one.

What’s in my standard plan

Every site I build comes with an ongoing plan, and it’s the default, not an upsell. Here’s what it covers.

An hour of work each month, used however makes sense. Most months that’s a small content update, a new staff bio, a holiday hours change, or a price tweak on a services page. Sometimes it’s fixing something that broke on someone’s phone. If you don’t have anything for me to do that month, the hour rolls over up to three months. It doesn’t disappear.

Hosting. Your site lives somewhere with a real cost behind it. Fast CDN, SSL that auto-renews, a build pipeline that publishes when I push code, infrastructure that doesn’t fall over when traffic spikes. I bundle that in instead of running it as a separate line item.

Google Search Console and Bing Webmaster Tools. I check what each search engine is actually doing with your site. If pages are getting indexed, if there are crawl errors, if a query you should be ranking for is starting to slip. A lot of developers set these tools up once and never log back in. Mine is a recurring check.

Cloudflare. Your site sits behind Cloudflare for security and speed. That blocks bad bots, caches pages closer to your visitors, and flags weird traffic patterns. If something looks off, I see it before you do.

Backups and uptime alerts. If the site goes down at 11 p.m. on a Saturday, I get pinged. I don’t expect you to be the one who notices.

Email me anytime. No ticket portal, no support form. You email me directly. Usually same day.

That’s the package. It’s what I’d want as a customer if someone else built my site.

What’s not in it

A few things to be upfront about, so nobody signs up with the wrong expectations.

Big new features. If six months in you decide you want a booking system or a member area, that’s a separate scope. I’ll quote it before I build it.

Marketing. Google Ads, social posts, blog ghostwriting. None of that is me. There are people who do that well and I’ll happily refer you.

“SEO packages.” I wrote about why those are usually nonsense. The technical SEO is built into the site at launch. The ongoing piece is monitoring it, which is included in the plan. There’s nothing else to buy.

Domain management (optional). If you want me to handle your domain too, I offer that as an add-on. I move it to my registrar, handle renewals, manage DNS, and set up email forwarding. Plenty of folks would rather keep their domain where it already lives, and that’s completely fine.

What a typical month looks like

A reasonable thing to want to know is what a month actually feels like. Here’s the honest range.

Plenty of months I don’t have anything to do for you. The site is fine, traffic looks normal, your inbox to me is empty. The hour banks toward next month. That’s the plan working, not failing.

A more typical month is a 15-minute ask. New staff member, holiday hours, a price tweak on a services page. I push the change, send you a note, done.

Heavier months come up too. New product photos arrive and we refresh the home page. You add a service and we wire up the page itself, the navigation, the schema markup, plus an internal link from a related post. Those run an hour and a half easy, which is where rollover from a quiet stretch earns its keep.

Why cap rollover at three months instead of letting it go forever? Practicality. Steady small touches keep a site healthy. Saving up six months of changes for one big push always goes worse, because half the asks are stale by the time we get to them and I’m context-switching back into a codebase I haven’t opened in a while. Three months of buffer absorbs a quiet stretch without turning the plan into deferred labor I owe forever.

I also send a short monthly recap. Whatever I did, whatever I’d flag for next month, in maybe five lines. It saves a lot of “wait, what am I paying for again?” conversations down the road.

Why I bundle monitoring instead of charging extra for it

Plenty of shops sell Search Console and Cloudflare as their own line items. $99 a month for “SEO monitoring,” another $49 for “security.” Peel that back and what they’re often doing is logging into a free Google tool once a quarter and emailing the screenshot. Critter Care was paying $35 a month for exactly that kind of package, and the site had no structured data, no meta descriptions, no sign that anyone had ever logged in.

I’m not playing that game. Keeping an eye on a site I built is part of the job. If your traffic from search starts to slip, that’s mine to flag, not a service I should be billing you for separately.

Same logic on Cloudflare. The free tier covers what most small businesses need. Setting it up is a one-time effort, and the payoff is ongoing: fewer bot hits, faster pages, basic DDoS protection. Charging extra for that would be like charging you to lock the front door.

What monitoring actually catches

Monitoring in the abstract is easy to wave at. Here’s the kind of thing that actually shows up. Some of these overlap with what I’d flag in a one-time audit, but the difference is catching them in week one of a quiet drift, not month thirty.

A page drops out of Google’s index because of a stray canonical tag introduced during an unrelated change. Caught the same week, it’s a 10-minute fix. Caught three months later after traffic to that page has cratered, it’s a much harder hole to dig out of.

Or a single IP range starts hammering your contact form to scrape email addresses for a spam list. Cloudflare blocks it, you never see it. Without something watching, your inbox gets wrecked and the form’s submission rate looks broken in the analytics for reasons nobody can explain.

Sometimes a query you used to rank well for is slipping. The interesting question is whether that’s a competitor doing something better or a content gap on your end that closes with an hour of writing. Knowing the difference is the whole point.

Then there are 404s on pages someone linked to externally a year ago, because you renamed the page and forgot to redirect. Easy to fix once you spot it. You have to spot it.

Core Web Vitals quietly degrading because a third-party script (a chat widget, a tracking pixel, an embed someone added from Canva) is dragging load times. Worth knowing before Google starts deprioritizing the page in mobile search. You can run the same test on your own site if you want to see where you stand today.

None of this is dramatic. Nothing here takes a site down on its own. But ignored, it adds up, and a year later you’re looking at a site that’s quietly fallen out of the search results without anyone able to point at when.

The math, roughly

Maintenance plans aren’t cheap, and I don’t pretend otherwise. The argument is what you’d otherwise spend on the same things separately.

A typical small business stacking it themselves looks like:

• Hosting and infrastructure with another provider: $20 to $50/month
• “SEO package” from the developer who built the site: $200 to $500/month
• Security plugin or third-party service: $30/month
• One-off updates billed at $100 to $150/hour every time you need a tweak

That’s $300 to $700 a month before you’ve counted the time you spend chasing problems yourself when something breaks at an inconvenient hour.

A real plan rolls those into one number, and the number is lower than the pieces add up to separately. I’d rather charge fairly for the whole thing than run five subscriptions, three of which aren’t doing anything.

When a plan doesn’t make sense

I’ll be honest. Not every business needs a maintenance plan, and I’m not going to talk anyone into one.

If your site is purely informational and genuinely never changes, a plan is overkill. Pay for hosting, call me when something breaks. That’s a clean setup, and I’ll quote it that way if it fits you better.

Comfortable making small edits yourself in a CMS, and don’t want anyone else’s hands on the site? You mostly need infrastructure and a security backstop, not ongoing labor. We can scope it lighter.

Brand-new business with tight cash? Skip the plan for the first few months. Call me when you actually need something done or when something breaks. I’d rather hear from you when you need me than carry a subscription that’s eating your runway.

The plan makes sense when there’s a steady drip of changes happening, or when you’d rather not think about your site at all. If neither of those is you, save the money.

What to ask before signing anyone’s plan

If someone else is pitching you a maintenance or hosting plan, run through this list before you commit.

1. What do I actually get each month? Not “monitoring and updates.” Specifics. Is there a pool of hours? Does it roll over?
2. Who’s monitoring what, and how do I know? Ask to see a Search Console screenshot or a recent Cloudflare report. If they can’t show you, they aren’t checking.
3. What’s the response time when something breaks? Same day? Next business day? Three days?
4. Can I leave? What happens to the site if you cancel? Who owns the code? Where does the domain live?
5. What’s not included? If the answer is “everything is included,” they’re hiding the line items. There should be a clear boundary between what’s covered and what crosses into a separate quote.

If you can’t get a straight answer to any of those, that is the answer.

What happens if you cancel

This is the question worth asking up front, and most shops won’t answer it in writing. So here it is, plainly.

You own the site. You’ve always owned the site. Code, content, design, and your domain if it’s registered in your name. Canceling doesn’t change any of that.

Here’s the offboarding:

• I help you migrate hosting if you want to move it. The sites I build are static and portable, so handing them off to another developer or another host is a couple hours of work, not a rebuild. You get the codebase, the deployment config, and an exit checklist so whoever picks it up isn’t starting from zero.
• Search Console and analytics access transfer to whoever you designate. I remove my access, add yours, the historical data stays with you.
• Cloudflare either stays in your account (if you set it up) or gets transferred over. I don’t hold DNS hostage.
• There’s no termination fee, no minimum contract beyond 30 days notice, and no clawback on past work. Sign up in January, cancel in April, that’s it.

I run things this way because the alternative is bad for everyone. A client who feels stuck tells friends not to use you. A client who left clean, and remembered the experience as a clean exit, is the one who refers their cousin two years later. The math works out better when both sides can walk away whenever they want.

The honest version

A maintenance plan is only worth paying for if there’s actual maintenance happening. If you’re sending $200 a month so a server stays up and nobody ever touches the site, you’re paying for hosting with extra steps. Anything above the cost of the infrastructure should be buying you real work, not a peace-of-mind invoice.

Mine is built around that idea. A real hour of work every month. Real eyes on the analytics and security side. A person who picks up when you email. There’s no tiered ladder where the basic plan exists to make the premium plan look better.

If you’ve got a site I didn’t build and you want a second opinion on what you’re currently paying for, send me a note or grab a free site audit. I’ll look at what you’re getting. If your current developer is doing the work, I’ll tell you. If they aren’t, you should know.

I work with small businesses across the Denver Front Range: Denver, Lakewood, Golden, Littleton, Boulder, Arvada, Aurora, Westminster, and Highlands Ranch.