What does a website maintenance service include? The jobs that keep an old plugin from becoming a Law 25 problem

Your website looks exactly the way it did the day it launched, and now someone wants a monthly fee to maintain it. The fair question is what a website maintenance service does for a site that never seems to change. The answer: the site changes underneath you every week, in add-ons and server software you never see. Some of that work can't wait for a monthly visit, and in Quebec, a form that leaks your customers' details comes with legal duties attached.

What does website maintenance include?

A complete website maintenance service covers eight jobs, and only one of them, the small content edits, is something you'd notice. Google's security guidance for site owners starts with the least glamorous job: make a list of all the software and plug-ins your website uses, and keep track of the version numbers and updates. Every other line below depends on that list existing. Plug-ins are the add-ons that run your booking form, your photo gallery or your contact page.

Website maintenance checklist, job by job

Each row below gives one maintenance job, how often it should run, the failure it prevents and the source behind it.

| Job | How often | What it prevents | Source | |---|---|---|---| | Keep a list of every plug-in, theme and version | With every change | Not knowing what to patch when a flaw is announced | Google Search Central | | Install security fixes for plug-ins and themes | Within hours of the fix | A public flaw being used against your site | Patchstack, 2025 data | | Disable or replace a plug-in that has no fix yet | The day the flaw goes public | The 46% of 2025 flaws with no fix at disclosure | Patchstack, 2025 data | | Update the core site software | Monthly, sooner for security releases | Falling behind on the platform everything runs on | Google Search Central | | Confirm the host patched its servers | Monthly | An up-to-date site on an unpatched server | Google Search Central | | Back up the site and test a restore | Back up on a schedule, test monthly | A backup that fails the day you need it | Our recommendation | | Send a test message through every form | Monthly and after every update | Leads vanishing into a broken form | Our recommendation | | Log every security incident | When it happens | A gap in the register Quebec law requires | Quebec P-39.1, s.3.8 |

To compare against a real scope, our Hosting + Maintenance page lists what ours covers.

How fast do attackers exploit an unpatched plugin?

Patchstack's 2025 data puts the weighted median time from a WordPress vulnerability going public to its first exploit at 5 hours. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up from 7,966 in its 2024 count. Plug-ins held 91% of them and themes 9%, while WordPress core had six, all low priority. Worse, 46% had no developer fix by the day the flaw went public, compared with 33% in the 2024 data.

Two cautions keep these numbers honest. Patchstack sells WordPress security protection, so read this as one company's count from its own vulnerability database, not an industry census. The figures also describe WordPress sites only; a site built another way has a different list of moving parts.

The practical point survives both cautions. The risk sits in the add-ons, and the clock starts the moment a flaw is announced. A plan that installs updates once a month leaves weeks of exposure against a clock measured in hours.

What happens to a website nobody maintains?

An unmaintained website keeps running add-ons that get older every week, and each newly announced flaw in one of them stays open until someone closes it. The owner usually finds out last. Google says that if it detects malware on a site, the owner sees a notification in Search Console, which helps only if someone set up Search Console and reads it. Google's Safe Browsing system also protects users by showing warnings on dangerous sites, so a customer can meet the problem before you do.

Some failures aren't attacks at all. An update can break your contact form without showing you an error: messages simply stop arriving. On most small-business sites that form is the main way a visitor becomes a lead. Three quiet weeks look like a slow season.

The usual objection is that a small business isn't worth attacking. The exploit targets the plug-in, not the business, so a flaw in a booking add-on is the same flaw on a bakery's site and on a hotel chain's.

Why a hacked contact form is a Law 25 problem in Quebec

In Quebec, unauthorized access to the personal information your website collects is a confidentiality incident under the private-sector privacy act, sections 3.5 to 3.8, added by Law 25. The names, emails and phone numbers sitting in a form inbox or a booking database count. Once a business has cause to believe an incident happened, the act asks for the following:

1. Take reasonable measures to reduce the risk of injury and to prevent it from happening again.
2. If there is a risk of serious injury, promptly notify the Commission d'accès à l'information and the people affected.
3. Record the incident in a register, which the business must keep for every confidentiality incident, serious or not.

Judging whether the risk is serious means weighing how sensitive the information is, the likely consequences and how likely it is to be misused, and section 3.7 requires consulting the person in charge of personal information in your business. For a real incident, that person and your lawyer make the call. Patching on time is the cheapest Law 25 measure a website has, because every exploit it prevents is a register entry you never write. A chatbot that collects customer details falls under the same rules; our post on what an AI chatbot for a small business actually does covers that side.

What a small site doesn't need from a maintenance plan

A website maintenance service should be sized to your site, and a small site needs less of it. If your site is five pages, runs a handful of plug-ins and changes twice a year, you don't need a plan built around unlimited edits or a monthly redesign. You need the list, the security fixes, a backup someone has restored and a form someone has tested.

Start by counting before you compare any website maintenance service. Ask whoever built your site how many plug-ins it runs and who installs their security fixes today. Every plug-in is a line on the patch list, and a shorter list means less to maintain and less to pay for.

Two questions to ask before you sign

Website maintenance was never about tidying a finished site. It's patching, on the attacker's clock.

If someone's selling you a website maintenance service, ask them two things. When a security fix comes out for a plug-in on my site, how many hours until it's installed? And if my contact form is ever breached, who helps me write the entry in my Law 25 incident register? A vendor who answers "at the next monthly visit" and "what register?" is selling you a backup and a monthly email.