To choose a website maintenance company, ask about the moments that matter: what happens after an update, how a backup gets restored, what they do if your site is hacked and who picks up the phone. Most companies list the same services, so the answers to those questions are what set them apart. Here are 12 to send to every company on your shortlist.
Key takeaways
- “Updates included” means little unless someone checks the site afterwards.
- Ask where backups are stored, how long they’re kept and whether a restore costs extra.
- Read the fine print on any hack guarantee: what it covers, and what it doesn’t.
- Know who does the work, where they are, and how they reach you in an emergency.
- Make sure you own your accounts, licences and backups, so you can leave if you need to.
What does a website maintenance company actually do?
A maintenance company looks after the website itself: the software, plugins and theme, backups, security scans and small fixes. That’s different from your host, which keeps the server running. If you’d rather have one provider cover the server and the site, managed hosting combines the two to a degree.
If you’re still deciding whether to hand the work over at all, our honest look at whether to outsource website maintenance compares the time and money. And if you want to see how much work is involved, our website maintenance checklist lists every task by week, month and year.
What should I ask a website maintenance company?
Send the same questions to each company, in writing. Clear, specific answers are a good sign. Vague ones, or a sales pitch instead of an answer, tell you something too.
Questions about the routine work
1. What exactly is included each month?
Ask for a list, not a summary. A sound plan covers core, theme and plugin updates, off-site backups, malware and vulnerability scans, uptime monitoring and a report. Check whether premium plugins are included, because some companies only update free ones.
2. How often do you update, and do you test afterwards?
Speed matters. Patchstack found that heavily exploited WordPress flaws were attacked at scale within a median of 5 hours of disclosure (Patchstack). Monthly updates alone are too slow for urgent security fixes. Good answer: routine updates on a schedule, urgent security fixes sooner, and a check of key pages and forms afterwards.
3. Where are backups stored, and how long are they kept?
The 3-2-1 rule calls for three copies, on two kinds of storage, with one off-site (Backblaze). A backup on the same server as your site can disappear with it. Ask for weeks of history, since an infection can sit unnoticed for days.
4. Can you show me a restore, and does it cost extra?
A backup is only useful if it can be restored. Ask when they last restored a site, how long it took and whether you can restore just the files or just the database. Our guide to restoring a website from backup shows what a good process looks like.
Questions about when something goes wrong
5. What happens if my site gets hacked?
Some companies offer a guarantee, others charge for every clean-up. Either way, ask what a clean-up includes. Sucuri found backdoors on 49% of the compromised sites it cleaned, and malicious admin users in 55% of infected databases (Sucuri). A clean-up that misses those lets the attacker straight back in.
Read the fine print: is the guarantee limited to certain plans, and does it cover a site that was already infected when you signed up?
6. How quickly do you respond, including after hours?
Ask for response times in writing, for normal requests and for emergencies. Sites rarely break at 10am on a Tuesday. Good answer: a named emergency number, its hours and what it costs to use.
7. Who does the work, and where are they based?
Some companies resell work done by overseas contractors. That isn’t always a problem, but you should know. Under the Privacy Act, a business can stay accountable for how an overseas provider handles personal information it discloses to them (OAIC). A shop or booking site holds plenty of it. A team in your time zone also means help during your business day.
8. How do you log in to my site?
Good answer: their own named admin account, protected by two-factor login, with passwords kept in a password manager. Red flag: asking you to email your own password, or one shared login for the whole team.
Questions about the fine print
9. What isn’t included, and what does extra work cost?
Every plan has edges. Ask about content changes, repairs after a broken update, new features and hack clean-ups. Find out the hourly rate before you need it.
10. What will you report to me each month?
A useful report lists the updates done, backups taken, scan results, uptime and anything that needs your attention. If a report is just a logo and a green tick, ask what’s behind it.
11. Who owns the accounts, licences and backups?
Your domain, hosting, premium plugin licences and admin access should be in your business’s name, or at least handed over on request. If the company holds them all, leaving gets hard.
12. What’s the contract, and how do I leave?
Check the minimum term, the notice period and any setup or exit fees. Ask what they hand over when you go, such as a final backup and a list of logins.
How do we answer these questions?
Our Maintain & Protect website care plans are built around this list:
- Updates: monthly, with high-risk security updates applied weekly. Advantage and Elite add visual and form checks after updates, and repairs if an update breaks something.
- Backups: daily, four times a day or hourly, depending on the plan, kept for 30 days and stored off-site.
- Security: an audit and lockdown at setup, a firewall, login protection and daily malware scans.
- Hacks: sites on Maintain & Protect are hack-free, or we fix them free.
- Emergencies: a 24/7 line on 0426 833 422.
- Price: $40, $80 or $120 a month + GST, plus a one-off setup fee. It doubles if the site is already compromised, because that means a clean-up first.
Frequently asked questions
How much does a website maintenance company charge?
It depends on what’s included. Compare the list of tasks, backup frequency, response times and what extra work costs, not just the monthly fee. Our plans are $40, $80 or $120 a month plus GST, with a one-off setup fee.
Is my web host already maintaining my website?
Usually not. Most hosts look after the server and leave WordPress, plugin and theme updates to you. Ask your host directly which updates they do, and whether they check the site afterwards.
Should I choose an Australian maintenance company?
It helps. A local team works your business hours, understands Australian privacy obligations and is easier to reach in an emergency. If you choose an overseas provider, check how they handle customer data and after-hours support.
What is a hack-free guarantee?
It’s a promise to clean up your site at no extra cost if it’s hacked while on the plan. Check what it covers, whether it applies to every plan and whether the site must be clean when you start.
Can I switch maintenance companies easily?
Yes, if you own your accounts and licences. Ask your current provider for a full backup and a list of logins and premium licences, then remove their access once the new company has set up.
Sources
- State of WordPress Security in 2026, Patchstack
- The 3-2-1 backup strategy, Backblaze
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- APP Guidelines, Chapter 8: Cross-border disclosure of personal information, OAIC, October 2025