A website maintenance checklist lists everything that recurs after launch to keep a site secure, reachable and correct: updates, backups with a tested restore, certificate and account security, current legal pages, working links, decent load times and content that is still true. The rhythm: security updates immediately, everything else weekly, monthly and yearly from a fixed list. The cost depends mostly on the contract; top-ranking German agencies list, for example, 129 or 139 euros a month plus VAT with a small time block for changes (November 2026). Do it yourself, sign with an agency, or hand it to an AI employee who prepares and checks the work while you approve.
Ralf, my AI employee for websites, maintains kevinwelter.com technically and has built more than 20 client websites; see Build and Modernize a Website With AI. What domain and hosting cost is in What Does a Website or Landing Page Cost?, and if maintenance no longer helps an old site, read Modernizing a Website With AI: How To.
What website maintenance includes
Seven areas, none of them optional.
Three sources to check, as of November 2026. Since version 5.5, WordPress allows automatic updates per plugin and theme, runs them twice a day by default, and advises regular automatic backups. According to php.net, PHP 8.2 gets security fixes until 31 December 2026, PHP 8.3 until the end of 2027; plan the switch with a test, because old plugins can break. For load time, Google's web.dev names as good values: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint at most 200 milliseconds, Cumulative Layout Shift at most 0.1. Targets, not a ranking promise.
On legal pages: this is not legal advice. The baseline a website needs is in Getting a Website Built: Steps, Options. Maintenance means asking with every new form or service whether the texts still fit, and getting the answer from someone qualified to give it.
Website maintenance checklist: what is due when
A suggested rhythm for a small business site on a builder or CMS. With a shop, customer accounts or many plugins, weekly quickly becomes daily.
Immediately, as soon as it appears
- Install security updates for the system and plugins, after a fresh backup
- Remove logins for contractors and staff who no longer need them
Every week
- Check that the backup ran and where it is
- Click through the home page and contact form on a phone, and send a test enquiry
Every month
- Install remaining updates, then click through the site
- Look for broken links and error pages, for example in Search Console (Setting Up Google Search Console)
- Measure load time of key pages against last month
- Check prices, dates and offers against reality
Every quarter
- Restore a backup as a test, in a test environment, not on the live site
- Review accounts and permissions; delete unused plugins instead of deactivating them
- Check the certificate and its validity (How to Check an SSL Certificate)
Once a year
- Review the PHP version and hosting plan, including the price after any introductory period
- Read imprint and privacy policy against the services you actually use
- Check the site from the outside for typical gaps (Check Your Website Security Online)
- Remove content nobody needs, and for every deleted address decide: redirect or retire
Where the website lives, and what that means for maintenance
How much maintenance stays with you depends on where the site is hosted.
This website runs on my own k3s cluster at Hetzner (Kubernetes on Hetzner: k3s in Production); production changes come from Git through ArgoCD (GitOps with ArgoCD: Deploy from Git), the nodes run an operating system with automatic updates, and cert-manager renews the certificates. For a small business site that is more than you need; for your own server, the basics are in Securing Your Own Server: Linux and Windows.
An AI employee uploads in two ways. With Git, it commits the change and a deploy takes it live; with me, a deploy only goes out with my explicit word, which the employee records with a timestamp in the log. On classic web hosting it uses SFTP. Strato, for example, states that all its web hosting packages include SFTP access and that multiple accounts let you give external contractors access to specific directories only (as of November 2026). Three rules:
- SFTP, not FTP. Standard FTP sends the password in clear text, as RFC 2577 notes.
- A separate, tightly scoped login. Its own user for the website directory only, which you can revoke at any time. Never your main login.
- Never put credentials in the chat. Password or key sit encrypted where the tool reads them at runtime. In my clusters, secrets are encrypted with SOPS, and the private key never sits in the repository.
What website maintenance costs: three billing models
A one-page site and a shop need different maintenance, so compare models, not averages.
Domain and hosting come on top, with figures in What Does a Website or Landing Page Cost?. Ask every provider: Is the restore tested? Who holds which logins? Is there a report after each run? What does extra time cost? How do you leave and get your data?
Doing it yourself, an agency, or an AI employee
How Ralf maintains kevinwelter.com
Ralf works to a fixed process: in an early cross-check he found errors in four out of ten briefs, and since then inventory checks, build, screenshots and click-through tests have been fixed steps. He prepares the launch; approval, positioning, legal statements and sensitive customer data stay with me. He invents no service, price or review and flags missing information.
Sebastian writes the posts and measures, with Lighthouse for load times and linkinator for broken links among others (AI for SEO and Blogging: How Sebastian Works). Falk hunts for gaps and only tests systems that belong to me or have written approval (Finding Security Flaws: Meet Falk).
An example of a maintenance request: "From 1 December the opening hours change to Monday to Friday, 8 am to 5 pm. Update them on the home page, the contact page and in the footer, check desktop and mobile, save screenshots and prepare the launch." Live only after approval.
Ralf is included as a ready-made template in the Premium tier of my community at 149 US dollars a month; in the Standard tier, at a founding price of 5 US dollars a month for the first 50 members (the price goes up after that), you build him yourself (as of October 29, 2026).
Frequently asked questions
What should a website maintenance contract include?
Update intervals, backup frequency and a tested restore, response time for an outage, the time block for changes and the price beyond it, who holds which logins, and how you get your data when it ends.
How often should a website be maintained?
Security updates immediately, a backup check weekly, other updates plus links and load time monthly, a restore test quarterly, legal pages and hosting plan yearly.
What is the monthly website maintenance cost?
It depends on scope. Top-ranking German agencies list, for example, 129 and 139 euros a month plus VAT with a time block, or a retainer from 50 euros (November 2026). Compare what the amount covers.
Does my website need maintenance if it has no plugins?
Yes, just less. Backups, the certificate, links, legal pages and content remain; updates shift to the packages in the project.
Should an AI employee get access to my hosting?
Yes, with its own SFTP login limited to the website directory and revocable at any time, and never with the password in the chat. Approval for the launch stays with you.
Where to go from here
Copy the checklist into your calendar, one slot per rhythm, and on the first run note where your backup is stored and when you last restored it. To hand off the work but keep approval, see how Ralf works. Ralf and the other ready-made AI employees are available to load in my community AI Employee Framework. How a new page gets built for you before it needs maintenance is in Hiring a Landing Page Designer: Steps, Cost.
Your first AI employee up and running within an hour
Join the community$5/month founding price, first 50 members
