A monthly invoice that says “website maintenance” does not explain what happened to your website. A useful report should help you understand completed work, unresolved issues and decisions that need your approval. The right scope depends on the technology and agreement, but the evidence should be understandable without being a developer.
Ask for completed work and its result
Request a short record of changes: what was updated, why it was needed and whether verification passed. A long list of version numbers is less useful than knowing that a booking integration was updated and its main flow still works. Include the date so changes can be connected with later issues.
Separate routine maintenance from requested improvements. Replacing a photograph, redesigning a page and investigating a third-party outage may have different costs and response times. Make those boundaries clear in the agreement rather than discovering them during an urgent request.
Ask how recovery is verified
A backup being present does not prove that the site can be restored successfully. Ask what is backed up, where it is held, how long it is retained and when recovery was last tested. The appropriate method varies between a static site, a hosted builder and a database-driven store.
Australian cyber security guidance recommends backups and MFA as important basic protections. Your report should describe the arrangements relevant to your website, not claim that a backup eliminates every risk. Ask who can perform a recovery and what business input they would need.
Check customer-facing functions
The report should cover the functions your business depends on. For a service site, that may mean the phone link, contact form and booking route. For a store, it may include product selection and checkout testing within an agreed safe test process. Identify the exact checks instead of accepting an unexplained “all working”.
Confirm how a failed check is handled. Is there an alert, an owner and a response process? A provider cannot control every external service, but they should explain what was observed and what action is being taken.
Review open issues and upcoming renewals
The remaining two proof points are unresolved issues and future dependencies. Ask for a short list of risks, decisions and renewals that need attention, with clear responsibility. A renewal reminder should identify the service and consequences of letting it lapse.
Use the report to make one or two practical decisions each month. You may approve a necessary update, replace an unsupported integration or decide that a requested feature is not worth maintaining. The value of maintenance is in reliable operation and informed decisions, not in the length of the activity log.
Put this into practice
Share the affected page and what happened so a website review can focus on the actual failure. Explore how CodeMax can help, or send us your website and the problem you want to solve.
Sources and further reading
Australian Cyber Security Centre: Small business basics. Checked 30 September 2026.