Website Maintenance Packages: What Should One Include, and What Is Padding?

A website maintenance package should include six things: software updates, backups that are tested and stored away from the server, security and uptime monitoring, hosting (or a plain statement that hosting is not part of it), a set allowance for small changes, and a named person who answers when something breaks. Everything else on a plan's feature list is either one of those six described in more detail, or an extra that you may or may not need.

Packages are sold under several names: maintenance package, support package, care plan, website management. They are the same product. What differs is how much of the list each one covers, and that is rarely obvious from the price. This guide sets out what each item should look like, what Australian providers, ours included, publish as their prices, and the questions that separate a real plan from a padded one.

The six things a maintenance package should cover

The Australian Signals Directorate, the government's cyber security agency, publishes a guide for business owners called "Secure your website". One of its four key actions is to "Regularly back up website data and keep software, devices and plugins up to date." Most of what a good package does follows from that sentence.

1. Software updates

A website runs on software: the content management system, its theme, its plugins and the server underneath. The ASD guide says "Cybercriminals exploit weaknesses in software to gain access to your network. Updates contain fixes for these weaknesses."

WordPress's own security documentation is just as direct: "you should always keep up to date with the latest version of WordPress", and "make sure your plugins are always updated." It also warns that "Older versions of WordPress are not maintained with security updates."

A package should say who applies updates, how often, and what happens when an update breaks something. The better plans take a backup first and can roll the site back.

2. Backups you can restore from

A backup is only useful if it is recent, complete and somewhere other than the server that just failed. WordPress's documentation says a backup has two parts, the database and the files, and "You need both to be able to fully restore a typical WordPress site."

On frequency, the same page says "For smaller websites with fewer posts, backups should be made once a week" and "For high-activity websites with a lot of posts, backups should be made daily." It recommends keeping "at least 3–5 recent WordPress backups", with copies in different locations. The ASD guide agrees on location: "Storing backups offsite is a more secure method."

So the plan should state how often backups run, how many are kept, where they are stored, and whether restoring one is included or charged as extra work.

3. Security and uptime monitoring

The ASD guide advises website owners to review their site often: "The sooner you notice it, the quicker you can intervene and restore your website." In a package, that job is done by monitoring: a check that the site is online, a scan for malware or changed files, and an alert to a person when either fails.

Ask who receives the alert and what they do next. Monitoring that only emails you a warning has told you about a problem without fixing it.

The guide also tells owners to "Turn on MFA for all accounts with administration privileges for your website." A provider that manages your site should use multi-factor authentication on its own logins and help you set it up on yours.

4. Hosting, or a clear statement that it is separate

Some packages include hosting. Others maintain a site that is hosted elsewhere. Neither is wrong, but you need to know which you are buying, because a plan without hosting is not the full monthly cost of the website.

If hosting is included, the ASD guide lists what to check with any host: how they back up data and how often, whether they detect malware, and where they are located. It notes that "providers outside Australia may be subject to different legal obligations." Our guide to website hosting in Australia compares local providers.

The domain name is a related item. The ASD guide says to "Renew your domain before it expires" and to have more than one person listed for renewal notices. Whoever manages the renewal, the name should be registered to you. Our guide to domain name costs explains the fees.

5. An allowance for small changes

A new phone number, a staff photo, a price change, an extra paragraph: small edits are most of what a small business asks of its website after launch. A package should say how many are included, how they are counted (by request or by time) and what a "minor" change means. It should also say what a larger job costs when you need one.

6. A person to contact, and a response time

A support address is not the same as support. Look for the response time in writing, the hours it applies, and whether an outage is handled faster than a routine request.

What Australian providers publish as prices

Many providers do not publish prices at all. Below is our own Essential plan beside three published entry plans priced at about $100 a month or more, as read on each provider's own page in November 2026. The first row is ours, so check it against the packages page as you would any provider's claim.

Ours is the only entry plan of the four that includes hosting, changes to the site each month and SEO, at a price within a few dollars of the two nearest and well under the fourth. It also includes software and security updates, an SSL certificate and a CDN.

The gap widens one step up. Our Advanced SEO plan is $149 a month plus GST and adds unlimited minor revisions, a domain name, Google Search Console monitoring and monthly SEO reporting. Redback's next plan starts from $220 a month plus GST, and Five by Five's is $460.

Cheaper plans exist. HELP4BIS publishes one at $49 a month excluding GST and UpTime Web Hosting one at $79.00 including GST. Both are maintenance only: UpTime's does not include hosting and quotes content updates separately, and HELP4BIS's includes edits only on its $99 plan. Add a hosting bill and a few paid changes before comparing either with a plan that includes them. Some prices include GST and some do not, so line them up on the same basis too.

For what businesses typically budget across a year, see our guide to website maintenance costs in Australia.

What is padding, and what is worth paying extra for

Some lines on a feature list cost the provider nothing, or repeat another line in different words. Read these carefully:

• "SSL certificate included." HTTPS matters: the ASD guide tells owners without it to "ask your website host or developer to set it up." It is a normal part of hosting. Expect it, but do not count it as a reason to choose one plan over another.
• "Monthly report." A report is useful if it tells you what was updated, what was restored and what needs a decision. A page of automated charts is not maintenance.
• "Security hardening" and "performance optimisation" with no detail. Ask what is done and how often. If the answer is a plugin that was installed once, it is a setup task, not a monthly service.
• "Unlimited support." Check whether this means unlimited advice or unlimited work. One provider above offers unlimited advice and quotes content updates separately, which is fair as long as you know it.

Other extras do real work, and are worth paying for if your business depends on search:

• Search Console monitoring. Google describes Search Console as a way to "Receive alerts when Google encounters indexing, spam, or other issues on your site." Someone has to read those alerts.
• Speed checks. Google says "Core Web Vitals are used by our ranking systems", and adds that "There is no single signal." A plan that watches page speed is doing something useful. A plan that promises a ranking from it is overselling.
• Developer hours. If your site changes often, included hours cost less than ad hoc quotes.

Nine questions to ask before you sign

1. Is hosting included? If not, what will hosting cost on top?
2. How often are backups taken, how many are kept and where? Is a restore included?
3. Who applies updates, and what happens if one breaks the site?
4. What counts as a minor change, and how many do I get?
5. What is the response time for an outage, and during what hours?
6. Is the price quoted with or without GST?
7. Is there a minimum term, and how much notice do I give to cancel?
8. If I leave, do I get a full copy of my website and keep my domain name?
9. What is the rate for work outside the plan?

A provider with a real package can answer all nine from its own terms. Vague answers to questions 2 and 8 are the ones to worry about.

Which package suits which business

• A small brochure site that rarely changes needs items one to four and a short allowance for edits. An entry-level plan covers it.
• A site that brings in most of your enquiries needs faster response times, daily backups and someone watching Search Console.
• An online shop or booking site changes daily, so it needs daily backups at a minimum and a clear arrangement for urgent fixes.

If you are still deciding on the website itself, our website cost guide covers the build and the running costs together, so the monthly plan is not a surprise after launch.