Web Development Company in Pune: What a Website Maintenance Plan Should Include (and What to Ask Before You Pay for One)
A good website maintenance plan covers six things on a fixed schedule: updates to the software your site runs on, backups with a tested restore, security and access checks, uptime and expiry monitoring, a small monthly allowance of content or fix work, and a short written report that tells you what was done. If a web development company in Pune quotes you "maintenance" and cannot tell you which of those six are included, how often each happens and how you will know it happened, you are buying a label, not a service. This guide explains what each line item should mean in practice, which things are normally excluded, how to read a proposal, and which questions separate a real plan from a vague one.
It is written for owners of business websites, online stores and NGO donation sites who launched a site, were told it "needs maintenance", and now have to decide whether to pay a monthly fee for it. We do not publish our own prices here, and we do not quote statistics about how many sites are hacked or neglected, because we cannot source them. Where we mention market rates they are clearly labelled as general ranges to be checked against quotes you collect yourself.
Why a website needs maintenance at all
A website is not a printed brochure. It is software running on a server, usually built from several moving parts: a content management system such as WordPress, a theme, a set of plugins, a PHP or Node runtime, a database, a domain name and a security certificate. Each of those parts is maintained by a different party and each changes on its own schedule.
WordPress's own security documentation puts the principle plainly: always keep up to date with the latest version, because older versions no longer receive security updates (WordPress Advanced Administration Handbook: Hardening WordPress). The WordPress project's security page adds that only the latest version is officially supported, with older releases patched as a courtesy rather than a guarantee (WordPress.org: Security). In other words, standing still is itself a decision, and it is a decision that slowly increases risk.
Nothing visible changes when this happens. Your homepage looks the same. That is why maintenance is easy to postpone and why it is worth turning into a routine with an owner, rather than leaving it to someone's good intentions.
The six parts of a real maintenance plan
1. Software updates, with a process around them
Updates are the part everyone thinks of first, but the valuable part is the process, not the click. A sensible routine looks like this:
- Check for core, theme and plugin updates on a fixed rhythm, not "when we remember".
- Take a backup immediately before applying them. WordPress's upgrade guidance describes backing up the database and files, and verifying the backup, before upgrading (WordPress Advanced Administration Handbook: Upgrading WordPress).
- Apply updates on a staging copy first when the site earns money or takes donations, then to the live site.
- Look at the site afterwards: homepage, a form submission, the checkout or donation path, and the pages that bring most of your traffic.
- Record what changed.
Ask whether updates are automatic or manual. Automatic updates are reasonable for minor and security releases, and WordPress has supported background updates for core since version 3.7 (WordPress Advanced Administration Handbook: Hardening WordPress). But automatic does not mean unattended: somebody still needs to check that a plugin update has not broken a form. A plan that says "auto-updates enabled" and nothing else has not described a service.
We have separate guides on two specific update topics, so this section does not repeat them: how to audit plugins that are no longer maintained, in our plugin audit guide, and why an old server-side runtime becomes a problem, in our PHP end-of-life guide. A good plan should include checking both at least once or twice a year.
2. Backups, and proof that a restore works
A maintenance plan should state what is backed up (files and database), how often, where copies are stored and for how long. Above all it should say when a restore was last tested. The mechanics, and the four-part checklist for a proper setup, are in our guide to website backups and disaster recovery. For the purpose of reading a maintenance proposal, the shortcut is this: if the proposal says "daily backups" but does not mention a restore test, treat the line as unverified.
3. Security checks and access control
Security in a maintenance plan is mostly housekeeping, not heroics. The useful items are:
- A review of who has administrator access, and removal of accounts that belong to people who have left.
- Two-factor authentication on administrator accounts.
- Removal of plugins and themes you do not use. The WordPress hardening guide states it directly: if you are not using a plugin, delete it from the system (WordPress Advanced Administration Handbook: Hardening WordPress).
- A look at the login page for repeated failed attempts, if your hosting or a security plugin reports them.
- A check that plugins and themes come from trusted sources. The same guide warns against plugins and themes from untrusted sources and points to the WordPress.org repository or well-known companies.
The access review is where many small businesses have a real gap, because a former developer, an ex-employee or a freelancer still has an admin login years later. We cover the process in our guide to WordPress admin users, 2FA and offboarding. In a maintenance plan, ask that this review be listed as a recurring task with a named frequency, such as quarterly.
4. Monitoring: is the site up, and what is about to expire?
Monitoring is the part that lets someone find out about a problem before your customers do. There are two kinds.
Availability monitoring pings the site from outside every few minutes and alerts someone if it stops responding. Ask who receives the alert, whether it reaches a person outside office hours, and what the plan promises about response. Free and paid monitoring tools both exist; the tool matters less than whether an alert has an owner.
Expiry monitoring watches the things that stop a site dead on a date: the domain registration, the SSL certificate, the hosting plan, and any paid plugin licences. These are covered by our guide to domain, DNS and SSL renewals. A maintenance plan should list the expiry dates it is watching and, importantly, which account each belongs to. If the domain is registered in the developer's name rather than yours, no plan fully protects you.
You can also use Google's own free tooling as an extra set of eyes. Search Console has a page indexing report, a sitemaps report, a report on manual actions and security issues, and Core Web Vitals reports, all of which are described in Google's help documentation (Google Search Console Help: URL Inspection tool). Ask whether the plan includes someone looking at these monthly. If you have no Search Console access, ask for it. It belongs to your business, not your agency.
5. A small monthly allowance of changes
Most plans include a bucket of "minor changes": editing text, swapping an image, adding a team member, updating a price. The word "minor" must be defined or it becomes a source of argument. A workable definition is a time limit per month (for example, a number of hours) or a task list (text and image edits on existing pages, no new page templates, no new features).
Be clear about what happens to unused time. Some plans let it roll over for a month or two; most do not. Neither is wrong, but it should be written down. Also ask what happens when you exceed the allowance: a quote for the extra work, an hourly rate, or a queue behind other clients.
6. A short report you can read in five minutes
The easiest way to tell whether maintenance happened is a report. It does not need to be long. A useful monthly report contains:
- What was updated (core, themes, plugins) and any that were skipped, with the reason.
- Backup status and the date of the last restore test.
- Uptime for the month and any incidents.
- Security items: user changes, blocked login attempts if available, anything unusual.
- Changes made from your allowance.
- Anything that needs your decision, such as a plugin that is abandoned or a hosting plan that is too small.
If a plan includes no report, you have no way to audit it. Reports also create a record, which becomes valuable if you later change developer and need to know the site's history. This ties in with the ownership points in our website handover and ownership checklist.
What is normally excluded, and why you should check
Most disagreements about maintenance come from assumed inclusions. These items are commonly excluded from a base plan, and each one is reasonable provided it is stated in advance:
- New features and redesigns. Adding a booking system, a new section or a new landing page is project work, not maintenance.
- Content creation. Writing blog posts, product descriptions or photography is usually separate.
- Marketing and SEO work. Maintenance keeps the site healthy; it does not market it. If you want ongoing optimisation, that is a different service, such as SEO.
- Recovery after a hack caused by something outside the plan. Many plans cover cleaning a hacked site only when the plan was active and the updates were being applied. Ask how a hack is handled, whether it costs extra, and what is promised.
- Third-party tool costs. Premium plugins, paid monitoring, CDN plans, email-sending services and hosting upgrades are normally billed at cost or by you directly.
- Fixing problems caused by other people's edits. If someone in your team installs a plugin and breaks the site, the fix is usually billable.
- Compatibility with a major platform change. A PHP or CMS major upgrade can need paid work. Ask whether it is covered.
Not one of these exclusions is a red flag on its own. The red flag is when the plan is silent and the first time you discover the boundary is when you are asking for help.
Three plan tiers compared
The table below is a general framework for comparing proposals, not a price list. The tier names and contents are illustrative; vendors package them differently.
| Item | Basic (brochure site) | Standard (lead-generation or content site) | Active (store or donation site) |
|---|---|---|---|
| Update rhythm | Monthly | Fortnightly or weekly | Weekly, with staging test |
| Backups | Weekly, off-site copy | Daily database, weekly files | Daily or more often for the database, off-site |
| Restore test | Once a year | Twice a year | Quarterly |
| Availability monitoring | Basic alert | Alert to a named person | Alert with an agreed response time |
| Access review | Twice a year | Quarterly | Quarterly, plus after every staff change |
| Minor changes | A few small edits | A defined number of hours | A defined number of hours plus priority fixes |
| Checkout or form test | Contact form | Forms and tracking | Full test order or test donation |
| Report | Short monthly summary | Monthly with Search Console review | Monthly with incidents and decisions needed |
The point of the table is that the right tier depends on what a day of downtime costs you. A brochure site that is down for a day is an inconvenience. A donation site down during a campaign, or a store down on a sale day, is lost revenue. Choose the tier by the cost of failure, not by the monthly fee.
A hypothetical example: reading two proposals
The following is a made-up scenario to show how to compare quotes. It is not a real client and the figures are placeholders.
Imagine a Pune clinic with a 12-page WordPress site, an appointment-enquiry form and a Google Business Profile that sends visitors to the site. It receives two maintenance proposals.
Proposal A is one line: "Website maintenance, monthly." No details.
Proposal B lists weekly update checks with a pre-update backup, daily backups with an off-site copy and a restore test twice a year, uptime alerts to two named people, a quarterly access review, up to a stated number of minor edit hours a month, a monthly report, and a short list of exclusions including new pages and paid plugin licences.
Proposal B might cost more, or it might cost the same. What matters is that the clinic can hold the supplier to it. If the appointment form stops working on a Friday evening, the clinic knows who was meant to be checking, how it would have been detected and what to ask for. With Proposal A, any complaint becomes a negotiation about what "maintenance" meant.
Now suppose Proposal A is cheaper by a visible margin. The sensible question is not "why is B dearer?" but "what is A not doing?" Ask Proposal A's author to answer the questions in the next section. If they answer them clearly and the plan fits, it may be perfectly good. If they cannot, the saving is not real.
Questions to ask before you sign
Use these in the order below. A good supplier will answer them without hesitation, and the quality of the answers tells you more than the price.
- What exactly is included each month, and is there a written list?
- How often do you check for updates, and do you test on a staging copy first?
- Where are backups stored, who owns that account, and when did you last restore one?
- Who is alerted if the site goes down, and what do you commit to in response? If a response time is promised, get it in writing, along with what happens if it is missed.
- Whose name are the domain, hosting, SSL and Search Console in? The answer should be yours.
- How many hours of changes are included, and what happens to unused time?
- What do you charge for a hack clean-up or emergency recovery, and under what conditions is it free?
- What will I receive each month, and can I see a sample report?
- What is the notice period, and what do I get if I leave? Ask for the handover: credentials, backups, documentation. Our guide to contracts, ownership and warranty covers what to look for here.
- What is not included?
Do you need a plan at all?
Not every site does. If your website is a five-page static site that rarely changes and has no login, no plugins and no forms processed on your server, the maintenance burden is genuinely small, and a yearly check by someone you trust may be enough. The same is true if you are comfortable doing updates yourself and have a tested backup.
You are more likely to need a plan if any of these apply:
- The site takes money, donations or sensitive personal data.
- It runs on WordPress or another platform with plugins.
- Nobody in your team is comfortable logging in and applying updates.
- The business depends on enquiries from the site, so a silent form failure costs real leads.
- You want one accountable party rather than a rotating cast of freelancers.
An in-between option is a pay-as-you-go arrangement: no monthly retainer, but an agreed quarterly check and hourly rate for fixes. It can work well for low-change sites provided someone owns the calendar and the expiry dates.
How to judge whether the plan is working after three months
Once you have signed, give the plan a short review at the three-month mark. Look at the reports and ask yourself:
- Did every report arrive on time, and did it say something specific?
- Were there incidents, and were you told before you noticed?
- Did anything need your decision, and was it explained in plain language?
- Did the minor-changes allowance match your actual needs, or are you constantly over or under?
- Could someone else take over the site using the documentation you have received?
If the answers are mostly yes, the plan is earning its fee. If the reports are copy-pasted and say little, ask for improvements or consider moving. This is easiest if you have kept ownership of your domain, hosting and backups.
Working with Govindani Infotech on website maintenance
Govindani Infotech is a Pune-based website design and development company at 2nd Floor, Landmark Plaza, 206 Satara Road, Parvati Paytha, Pune 411009. We build and look after business websites, online stores and NGO donation platforms, so the questions above are ones we expect to be asked about our own work.
If you already have a site and want an honest view of what it needs, the most useful first step is a short review: tell us the platform, where it is hosted and who currently holds the logins, and we will say which of the six parts above are already covered and which are gaps, before any price is discussed. If you are planning a new build, our website creation service page explains how we scope the work, including what happens after launch. You can message us on WhatsApp at wa.me/919201958278 or use the contact page. Our own pricing is confirmed by the team directly, not published in this article.
Frequently Asked Questions
What does a website maintenance plan include?
A complete plan covers software updates for the CMS, theme and plugins, backups with restore testing, security and user-access checks, uptime and expiry monitoring, a limited allowance of small content or fix work, and a regular report. New features, content writing and marketing work are usually separate.
How much does website maintenance cost in India?
It varies widely with the platform, the size of the site and the response you need, so any single figure would be a guess. TODO: verify current market ranges by collecting at least three written quotes for the same list of tasks. Compare what each includes, not only the monthly fee.
How often should a website be updated and maintained?
For a WordPress site, updates should be checked at least monthly, and weekly for stores and donation sites, with a backup before each round. WordPress's documentation says to always keep up to date with the latest version because older versions stop receiving security updates. Access reviews and restore tests can be quarterly or twice a year.
Can I maintain my website myself instead of paying for a plan?
Yes, if you are comfortable applying updates, keeping tested backups and monitoring expiry dates, and if the site is simple. The risk is that these tasks get skipped when you are busy. A pay-as-you-go arrangement with a quarterly check can be a middle path for sites that rarely change.
If you have just launched or relaunched and your pages are not appearing in search, see our guide to why a new website is not on Google and how to fix "Crawled – currently not indexed".
Sources: WordPress Advanced Administration Handbook: Hardening WordPress; WordPress Advanced Administration Handbook: Upgrading WordPress; WordPress.org: Security; Google Search Console Help: URL Inspection tool. The tier table, the hypothetical clinic example and the question list are our own illustrations, not drawn from those sources.