Website Maintenance Provider Checklist: How to Choose the Right Company

In this guide:

• A checklist to run through before choosing a provider.
• Questions to ask, with what a good answer sounds like next to a red-flag answer.
• What to check if your site runs on WordPress, Shopify, Magento, Webflow or custom code.
• Where UK GDPR comes into a maintenance contract, and when a written agreement matters.

Written for UK business owners and office managers comparing website maintenance providers, whether that means a first care plan or replacing one that isn’t working out.

Most businesses only think hard about a website maintenance provider twice: when something has already gone wrong, or when a freelancer who used to “just look after the site” has gone quiet. This checklist is for the point before either of those happens, so you know what to check while you still have the choice.

What a Website Maintenance Provider Should Actually Cover

A website maintenance provider looks after a site once it’s live: applying software updates, watching for security issues, taking and testing backups, checking performance, and fixing bugs when something stops working. That’s different from a web design or development project, which builds or rebuilds a site rather than keeping an existing one running. It’s also different from a single malware clean-up, which fixes one incident rather than preventing the next one. Some providers do all three; others specialise. Knowing which one you actually need is the first thing to get straight before you start comparing quotes.

A maintenance plan does not guarantee your site can never be hacked or never go down; no provider can promise that honestly. What it should do is reduce the chance of it happening and shorten how long it takes to fix if it does.

The Website Maintenance Provider Checklist

Work through this before you sign anything. Group the items by area, and don’t move on from a section until you’ve got a straight answer for each line.

Security and updates

• They apply core, theme and plugin (or app) updates on a set schedule, not only when something breaks.
• They test updates before applying them to a live site, rather than updating everything at once and hoping nothing conflicts.
• They run security monitoring or malware scanning, not just updates.
• They can explain, in plain terms, how they’d handle a compromised site if it happened on their watch.

Backups and recovery

• Backups are stored off the live server, so a hosting failure or hack doesn’t take out the backup along with the site.
• You know how often backups run and how far back they go.
• They’ve told you how long a full restore actually takes, not just that “backups are included”.
• They can point to backups being tested, not just taken and left untouched.

Support and response

• You know who picks up a report when something goes wrong: a named contact, a small team, or a general queue.
• Urgent issues (site down, checkout broken, signs of a hack) and routine requests are handled differently, with different timeframes for each.
• You’ve been given a realistic response time, not just “as soon as possible”.
• There’s a way to reach them outside the exact hours stated, or a clear explanation of what happens if something breaks overnight or at a weekend.

Contract and pricing

• What’s included is written down, not just described verbally on a sales call.
• Pricing is fixed and clear, with anything chargeable on top spelled out in advance.
• You know the notice period and what happens to your backups and access if you leave.
• You know exactly what happens if something is outside the plan, for example a full rebuild after a serious hack, versus what’s routine.

Reporting and communication

• You get a record of what work was actually done, not just an invoice.
• You know who owns your hosting, domain and admin logins, and that it isn’t locked to the provider’s own account.
• Communication happens in plain English, not just a list of plugin version numbers.

Questions to Ask Before You Sign

A provider’s answers to these questions tell you more than their marketing page does. The table below shows what a straight, useful answer sounds like next to the kind of answer that should make you ask a follow-up question.

What to Check for Your Specific Platform

General maintenance principles apply everywhere, but the detail changes by platform. Ask a provider about the platform your site actually runs on, not a generic answer that could apply to any of them.

WordPress

Check that core, theme and every plugin are covered, not just WordPress itself. Ask how they handle plugin conflicts after an update, since in our experience this is one of the most common causes of a broken WordPress site. If your site has been compromised before, ask specifically about their approach to WordPress malware removal and how they’d stop the same entry point being used again.

Shopify

Ask how they handle app updates and conflicts between installed apps, since a Shopify store’s stability often depends on apps rather than the core platform. Check they test changes on a duplicate or development theme before pushing to the live store, particularly around checkout.

Magento

Magento sites tend to carry more custom code and extensions, so ask how security patches and version upgrades are planned and tested rather than applied immediately to a live catalogue. Performance under load is also worth asking about directly if you carry a large product range.

Webflow

There’s no stack of plugins to patch, so the questions shift towards CMS organisation, how interactions and animations are tested as the site grows, and whether performance is checked as new pages and assets are added.

Custom-built sites

Ask whether they can work directly in your existing codebase or whether they’d want to rebuild first. Ask for documentation of any changes they make, so the site doesn’t become something only one person understands.

Red Flags That Should Make You Walk Away

Data Protection: What UK GDPR Expects From a Provider With Site Access

If a maintenance provider has access to personal data through your site, for example contact form submissions, customer accounts or order details, they are very likely acting as a data processor on your behalf. Under UK GDPR, the Information Commissioner’s Office is clear that a written contract must be in place whenever a controller uses a processor to handle personal data, and that this contract needs to cover specific points: assistance with data subject requests, how a data breach would be reported, what happens to your data if you end the arrangement, and rules around using any sub-contractors (ICO, contracts and liabilities between controllers and processors).

In practice, this means a maintenance agreement covering more than routine technical work, one where the provider can see or handle customer data, should include this in writing rather than being left as an assumption on either side. This is a general pointer, not legal advice; if you’re unsure whether your arrangement needs a formal data processing agreement, it’s worth checking with a data protection adviser or solicitor.

Ad-Hoc Help or a Rolling Care Plan?

Not every business needs the same shape of arrangement. A small brochure site that rarely changes might be well served by occasional ad-hoc support, paid for the work involved rather than a monthly retainer, for things like a content update or a broken link fix. A site that takes enquiries or sales, or one that’s been hacked or gone down before, generally needs a rolling website maintenance care plan with updates, monitoring and backups running on a fixed schedule, so nobody has to remember to ask for them.

As an illustration of how this typically splits: our own WordPress maintenance plans are sized to how big and how busy a site is, while smaller one-off jobs are handled through an ad-hoc “tweaks” service rather than forcing every business onto the same monthly contract. Whichever provider you’re comparing, ask them directly which shape fits a site like yours rather than accepting whichever option they sell by default.

Frequently Asked Questions

How much should a website maintenance provider cost?

It depends on your platform, site size and how much support is included, so there’s no single figure that applies to every business. See our website maintenance cost guide for a fuller breakdown of what typically affects the price.

Should I use the same company that built my website?

Not necessarily. Some web design agencies maintain sites well; others treat maintenance as an afterthought to the build. Judge a maintenance offer on its own merits using this checklist, rather than assuming continuity with the original developer is automatically the safer choice.

What’s the difference between a maintenance checklist and a maintenance provider checklist?

A maintenance checklist covers the tasks a site needs done regularly, which you can read in our website maintenance checklist. This guide covers a different decision: what to check before choosing who does that work for you.

Can I switch website maintenance providers without disruption?

Yes, provided your hosting, domain and admin access are already in your name rather than locked to the outgoing provider’s account, which is exactly why that’s one of the first checks on the list above.

Use this checklist against every provider on your shortlist, including your current one if you’re not sure they’re still the right fit. A provider that welcomes the questions is usually a good sign in itself.