Launch day is not the finish line. Without regular care, a website or app slowly collects security holes, broken integrations and outdated dependencies until something fails at the worst moment.
A good website and app maintenance plan should include security and dependency updates, tested backups, uptime and error monitoring, bug fixes, performance checks, hosting and infrastructure care, and clear response times for issues. It should also state what is not included, so you know when work becomes a new project.
Why do websites and apps need ongoing maintenance?
Software depends on things that keep changing: frameworks, libraries, browsers, operating systems, app store rules, payment gateways and third-party APIs. Each change can introduce bugs or security issues. Maintenance keeps your product working, secure and compliant while you focus on the business.
What should a maintenance plan include?
Security updates
Regular updates to frameworks, packages, CMS core and plugins, plus prompt patching when a serious vulnerability is announced. This includes renewing SSL/TLS certificates and reviewing access for former staff or contractors.
Backups and restore tests
Automated backups of databases and files, stored separately from the main server, with a defined retention period. Just as important: a periodic test restore, because an untested backup is only a hope.
Monitoring
Uptime checks, error tracking (for example with Sentry), server or cloud resource alerts and, for apps, crash reporting such as Firebase Crashlytics. Our guide to application monitoring and incident response explains how to set this up.
Bug fixes
Investigating and fixing defects in existing features. The plan should say how bugs are reported, prioritised and confirmed as fixed.
Performance checks
Regular reviews of page speed and Core Web Vitals, slow database queries and app start-up time. See Core Web Vitals explained for what to measure.
Hosting and infrastructure care
Operating system patches, database version upgrades, scaling adjustments, domain and DNS management, and a periodic review of cloud costs.
Mobile app store compliance
For mobile apps, updating to the target API levels Google Play requires, building with the SDK versions Apple requires, keeping privacy disclosures accurate and responding to review issues. Our article on mobile app maintenance covers this in more detail.
Small improvements
Many plans include a bank of hours for content changes, minor features or UI tweaks, so small requests do not need a new contract.
Reporting
A short monthly report: what was updated, incidents and their causes, performance trends and recommendations.
Maintenance plan checklist
| Area | What to ask your provider |
|---|---|
| Security updates | How often are dependencies updated, and how fast are critical patches applied? |
| Backups | Where are backups stored, how long are they kept, and when was a restore last tested? |
| Monitoring | Which tools are used, and who receives the alerts? |
| Response times | What are the response and resolution targets for each severity level? |
| Support hours | Which time zones and days are covered? Is there out-of-hours cover for critical issues? |
| Included hours | How many hours of changes are included, and what happens to unused hours? |
| Exclusions | What counts as new development rather than maintenance? |
| Access and ownership | Do you own the code, hosting accounts and domain, with documented access? |
| Reporting | What do you receive each month? |
What response times should a maintenance plan promise?
It depends on how critical the system is to your revenue and operations. A common approach is to define severity levels: for example, a site-down or data-loss issue gets the fastest response, a broken but non-critical feature gets a slower one, and cosmetic issues are scheduled. The important thing is that the levels and targets are written down and agreed, not assumed.
How much should a maintenance plan cost?
There is no single price because it depends on the size and complexity of the system, the number of integrations, the platforms involved (web, iOS, Android), the support hours you need and how many change hours are included. Ask for a plan that matches your risk: a marketing site needs less than an e-commerce store or a SaaS product that customers rely on daily.
How do you choose a maintenance provider?
Look for a team that understands your technology stack and is willing to review the system before quoting, rather than offering a one-size-fits-all package. A short audit at the start usually reveals outdated dependencies, missing backups or monitoring gaps that should be fixed first. Ask how they document changes, how they hand over if you ever move to another provider, and whether the same people will work on your system month after month. Continuity matters, because a developer who knows your codebase fixes problems faster and makes fewer risky changes.
It also helps to agree on a single channel for requests, such as a ticketing tool or shared board, so nothing gets lost in email threads or chat messages.
What is usually not included?
- New features or major redesigns beyond the included hours.
- Fixing issues caused by changes made by other parties without coordination.
- Third-party licence, hosting or app store fees, unless stated.
- Large framework or platform migrations, which are usually quoted as projects.
Key takeaways
- Core maintenance covers security updates, tested backups, monitoring, bug fixes and performance.
- Agree severity levels, response times and support hours in writing.
- Make sure you own your code, accounts and domain, and know what counts as new work.
Need someone to look after your website or app properly? Request a maintenance and support quote from AppifyDevs, or contact us to discuss your current setup.