Website hosting keeps the server your site lives on running. Website maintenance keeps the website itself safe and working: updates, backups you can restore, security checks and fixes. Most business websites need both, and the space between them, where neither party is responsible, is where most hacks start.
Key takeaways
- Your host looks after the building: hardware, network, server software and the data centre.
- Maintenance looks after what you put inside it: WordPress, plugins, themes, forms and content.
- Most WordPress vulnerabilities are in plugins, which hosts usually don’t update for you.
- Write down who owns each job. Anything with no name next to it is a gap.
What does web hosting include?
Think of hosting as renting a well-run building. The host provides the server, its power and cooling, the network connection and the data centre security. It keeps the server software and PHP patched and running.
A good host also provides SSL certificates, a control panel and often server-level backups and a firewall. What a host doesn’t usually do is open your website and look after what’s inside it.
What does website maintenance cover?
Maintenance is looking after the website itself. On a WordPress site, that means:
- Updating WordPress core, plugins and themes, then checking nothing broke.
- Taking backups you can actually restore, and keeping copies off the server.
- Scanning for malware and watching for blocklist warnings.
- Locking down logins, removing old admin accounts and unused plugins.
- Testing forms, checkout and key pages, and fixing what breaks.
Someone has to log in, do it and check the result, every month.
Hosting vs maintenance: who does what?
Here’s how the jobs usually split on a standard business hosting plan. Managed plans move some tasks across, so check yours.
| Job | Host | Maintenance |
|---|---|---|
| Server hardware, power and network | Yes | No |
| Server software and PHP versions | Yes | Tests the site on new versions |
| SSL certificate | Usually | Fixes mixed content warnings |
| WordPress, plugin and theme updates | Rarely | Yes |
| Backups | Often server copies | Off-site copies and test restores |
| Malware clean-up | May suspend the site | Cleans and hardens it |
| Forms, checkout and content checks | No | Yes |
For a closer look at what “managed” adds, see our guide to managed vs unmanaged hosting.
Why is the gap between them where sites get hacked?
Owners assume the host is “looking after the website”. The host assumes the owner or web designer is doing updates. So nobody does them.
That matters because the risk sits in the website layer, not the server. Patchstack logged 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins. Only six were in WordPress core (Patchstack). The most targeted flaws were being attacked in bulk within a median of five hours.
Sucuri found that 39.1% of content management systems were out of date when they were infected (Sucuri). A perfect server can’t protect an old plugin.
Do you need both hosting and maintenance?
Every website needs hosting. Whether you pay for maintenance depends on who will do the work. You have three honest options:
- Do it yourself. Fine if you’re comfortable with WordPress, set aside time each month and know how to restore a backup.
- Your web designer does it. Fine if it’s in writing, with a monthly report. Many designers build sites but don’t maintain them.
- A care plan. Someone else owns the job, on a schedule, with checks after each update.
A simple static site with no plugins needs little upkeep. A WordPress site with a contact form, a booking tool or a shop needs regular attention. Wordfence found just under one million infected WordPress sites in 2024 (Wordfence). Small sites are not too small to matter.
How to check who covers what on your site
- Read your hosting plan. Look for the words “updates”, “backups” and “malware”. Our checklist of web hosting terms and conditions shows which clauses to find.
- Ask your web designer in writing. “Do you update our plugins each month, and do you test afterwards?”
- Log in to WordPress. If the Updates screen shows a long list, nobody is doing the job.
- Name an owner for every row in the table above. Gaps become obvious fast.
How we split the job
Our Australian web hosting runs in NEXTDC data centres in Brisbane and Melbourne, with free SSL, free migration and a 99.9% uptime commitment. That’s the building.
Our Maintain & Protect website care plans look after what’s inside: off-site backups, daily malware scans, monthly updates with high-risk security patches applied weekly, and a monthly report. You can buy either one. Together, nothing falls in the gap. If you’re wondering whether the host also shapes your rankings, we cover does hosting affect SEO separately.
Frequently asked questions
Does my web host update my WordPress plugins?
Usually not. Most hosts keep the server and its software up to date, but leave WordPress core, plugins and themes to you. Check your plan’s wording, and log in to see whether updates are piling up.
Is website maintenance included with hosting?
Rarely in full. Hosting might include server backups, a firewall and SSL. Maintenance means someone logs in to your website each month, applies updates, tests that forms and pages still work, and fixes anything that breaks. That’s a separate job, and usually a separate service.
If my site gets hacked, is it the host’s fault?
Sometimes, but rarely. Most WordPress hacks come through an out-of-date plugin, a weak password or an old admin account. Those sit in the website layer, which the owner or their maintenance provider looks after.
Can I have hosting with one company and maintenance with another?
Yes. Many businesses do. The key is that both know who does what, and the maintenance provider has the access it needs to restore backups and fix problems.
How much does website maintenance cost compared with hosting?
With us, Personal hosting starts at $29 a month + GST and Maintain & Protect starts at $40 a month + GST, plus a one-off setup fee. Prices vary widely between providers, so compare what each one actually does each month.
Sources
- State of WordPress Security in 2026, Patchstack
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- 2024 Annual WordPress Security Report, Wordfence, April 2025