CMS maintenance keeps the system behind your website safe and working after launch. Every content management system depends on a stack of code that changes constantly: the CMS core, plugins or modules, the language runtime (PHP or Node.js), the database, the front-end framework and the server. Each releases security fixes on its own schedule. Skip a few months and you have a site running known vulnerabilities, a backlog of updates that now conflict with each other, and no tested backup to fall back on.
Our CMS maintenance and support plans are part of our CMS development services. They cover Drupal, Craft CMS, Strapi, Sanity, Contentful, Ghost, headless front ends built with Next.js, Nuxt or Astro, and custom CMS builds. We also run our own: the PHP and SQLite CMS behind this website and Boiler Decoder is maintained by our team, so we follow the same routine we sell. WordPress sites have a dedicated plan on our WordPress maintenance services page.
What Our CMS Maintenance Plans Cover
| Task | What we do | Why it matters to you |
|---|---|---|
| Core and security updates | Apply CMS core, plugin and module updates, with security releases handled as a priority. | Most CMS compromises exploit vulnerabilities that already have a published fix. |
| Dependency updates | Update Composer and npm packages, and plan PHP and Node.js version upgrades before they reach end of life. | Hosting providers eventually drop old runtimes, and outdated packages block future updates. |
| Backups | Daily backups of the database and uploaded files, stored off the server, with a restore test every quarter. | A backup that has never been restored is a guess, not a backup. |
| Uptime monitoring | External checks every few minutes, with alerts to our team when the site or API stops responding. | Outages are caught by us, not by your customers. |
| SSL and domain checks | Certificate renewal and DNS monitoring. | Expired certificates show browser warnings that stop visitors cold. |
| Performance checks | Core Web Vitals from field data, slow database queries and cache behavior. | Slow pages cost conversions and search visibility over time. |
| Error monitoring | Review server, application and JavaScript error logs. | Many bugs never get reported by users who simply leave. |
| Small fixes and changes | Development hours on the Plus and Pro plans for bugs, new fields, template tweaks and integrations. | One team handles both upkeep and improvements. |
| Headless front-end upkeep | Framework updates, build pipeline checks and API changes on the Pro plan. | The front end of a headless site needs updates as much as the CMS does. |
A Practical CMS Maintenance Schedule
A CMS maintenance schedule turns "we should update the site" into a routine. This is the one we follow, adjusted per platform.
| Frequency | Tasks |
|---|---|
| Continuous | Uptime monitoring, error alerts, security advisory feeds for your CMS and its major plugins. |
| Daily | Database and file backups stored off the server. |
| Within days of a critical security release | Patch applied, tested on staging and released, outside the normal cycle. |
| Monthly | Routine core, plugin and dependency updates, broken link and form checks, error log review, maintenance report. |
| Quarterly | Backup restore test, user account and permissions review, performance review, unused plugin cleanup. |
| Yearly | Major version planning for the CMS, PHP or Node.js, and a review of licenses and renewals. |
How CMS Support Works Once You Join a Plan
- Onboarding audit (week 1). We take access to hosting, the repository, the CMS admin and DNS. We record versions of everything, list plugins and modules, check backups and note anything already out of support.
- Baseline fixes (weeks 1 to 3). We bring the site to a known good state: overdue updates applied on staging first, backups configured, monitoring added and credentials moved out of the codebase where needed. Large catch-up work, such as a major version upgrade, is quoted separately before we start.
- Staging and release process. On Plus and Pro plans, every update goes to a staging environment, gets checked against a list of key pages and forms, and is released to production with a rollback ready.
- Requests and fixes. You send requests by email or your shared ticket board. We confirm scope and timing before using development hours, and urgent issues such as a site outage go to the front of the queue.
- Monthly report. What we updated, what we fixed, uptime, backup status, hours used and anything we recommend you plan for.
- Quarterly review. A short call on upcoming end-of-life dates, performance and the next improvements worth making.
CMS IT Support and Maintenance for Your Editors
CMS IT support and maintenance is not only about servers. Much of the day-to-day value comes from helping the people who publish. Editors ask why an image looks blurry, why a page will not save, how to schedule a post or how to add a new team member with the right permissions. On our plans, those questions go to the same team that maintains the code, so the answer is a fix rather than a guess.
- User and role management. Adding and removing editors, and keeping permissions to the minimum each role needs.
- Editor guidance. Short written or recorded walkthroughs for recurring tasks, kept with your documentation.
- Content model tweaks. A new field, block or content type when editors keep working around a gap.
- Publishing problems. Preview links that stop working, scheduled posts that never go live and caches that serve old content.
CMS Maintenance Reports and What Good Upkeep Looks Like
Good CMS website maintenance is mostly invisible, so the report is how you see it. Each month you receive:
- A list of every update applied, with version numbers before and after.
- Security advisories that affected your stack and when each was patched.
- Uptime for the month and details of any incident, its cause and the fix.
- Backup status and the date of the last successful restore test.
- Core Web Vitals and error log trends.
- Development hours used and what they were spent on.
- Upcoming risks, such as a PHP version reaching end of life or a plugin that is no longer maintained.
The signs that maintenance is working are measurable: no versions in production with known unpatched vulnerabilities, restore tests that succeed, incidents caught by monitoring before customers report them, and a site that is never more than one release cycle behind.
CMS Maintenance Pricing
CMS maintenance runs on a monthly plan. CMS Care covers updates, backups and monitoring. CMS Care Plus adds a block of development hours with a staging environment and tested releases, and CMS Care Pro adds more hours plus upkeep of a headless front end and its APIs. What drives cost is the number of sites, how many plugins and integrations need testing, whether the front end is headless, and how much development you expect each month. Major version upgrades and rebuilds are quoted as separate projects.
CMS Care
$249 /month
Billed monthly
- Drupal, Craft, Strapi, Sanity, Contentful or our CMS
- Core, module and security updates
- Daily backups and uptime monitoring
- Up to 2 hours of edits or fixes
- Response within 1 business day
- Minimum term
- Month to month
CMS Care Plus
$549 /month
Billed monthly
- Up to 6 hours of development
- Everything in CMS Care
- Staging environment and tested releases
- Content model and editor tweaks
- Monthly speed and security report
- Response within 8 business hours
- Minimum term
- Month to month
CMS Care Pro
$1,100 /month
Billed monthly
- Up to 15 hours of development
- Everything in CMS Care Plus
- Headless front end and API upkeep (Next.js, Nuxt, Astro)
- Major version upgrade planning
- Monthly call and roadmap
- Same-day response on business days
- Minimum term
- Month to month
- Add-on
- Extra hours: $45/hour. Major version upgrade (for example Drupal or Strapi): quoted as a fixed project. WordPress sites: see WordPress maintenance
All prices in USD. Need something different? Ask for a custom quote.
Running several sites or a platform not listed here? Ask us for a custom quote.
Security and Maintenance by CMS Platform
Each platform has its own release rhythm and its own ways of breaking. These are the specifics we plan for.
Drupal
Drupal publishes security advisories on a regular weekly window, usually Wednesdays, so we watch that window and patch quickly. Drupal 7 reached end of life on January 5, 2025, so any site still on it no longer receives community security fixes and should be planned for migration. Updates run through Composer and Drush, with database updates and configuration exports checked on staging. Deeper Drupal work is covered by our Drupal maintenance services.
Craft CMS Maintenance
Craft CMS maintenance follows Craft's update model: updates are applied through Composer or the control panel and then deployed with project config, so changes made in production can conflict with those in the repository. Commercial Craft licenses include a year of updates, after which a renewal is needed to keep receiving them, so we track renewal dates along with plugin licenses.
Strapi
Strapi is a Node.js headless CMS, so maintenance covers both Strapi releases and the Node.js version underneath. Minor updates are routine. Major upgrades, such as Strapi 4 to Strapi 5, change APIs and need code changes, and Strapi provides an upgrade tool that handles part of that work. See our Strapi developers page for upgrade projects.
Sanity and Contentful
Sanity and Contentful host the content for you, so there is no CMS server to patch. Maintenance shifts to the Sanity Studio (a React app you deploy and update), content model changes run as scripted migrations, API version dates, webhook health and usage against plan limits.
Ghost
Self-hosted Ghost needs a supported Node.js version, MySQL 8 in production and regular updates through Ghost-CLI. Those are the core Ghost CMS maintenance requirements, along with backups of both the database and the content folder, because uploaded images live outside the database.
Headless Front Ends
Next.js, Nuxt and Astro release security fixes too. In March 2025, for example, Next.js patched a middleware authorization bypass (CVE-2025-29927) that affected self-hosted sites relying on middleware for access control. A maintenance plan that covers only the CMS and ignores the front end leaves half the stack unwatched.
Custom CMS Maintenance: Taking Over an Undocumented Build
Custom CMS maintenance is often the hardest kind, because the original developer has moved on and nobody knows how releases worked. When we take over a custom CMS, we start by getting the code into a repository you own, recording the server setup, writing down how to deploy and roll back, and adding backups and monitoring before changing anything else. Then we list the outdated libraries and runtime versions and plan updates in small, tested steps. If the system turns out to be too fragile to maintain sensibly, we tell you and compare the cost of rebuilding with our custom CMS development service against the cost of keeping it running.
Is There a Zero Maintenance CMS?
No CMS is zero maintenance. Hosted platforms such as Contentful, Sanity, Webflow, Squarespace and Shopify remove server patching, which is a real saving. You still maintain the content model, user accounts, integrations, front-end code if the CMS is headless, redirects, and the third-party scripts added over time. Choosing a hosted CMS moves maintenance from the server to the edges, it does not remove it.
CMS Maintenance: In-House, Freelancer or Support Plan?
| Option | Works well when | Watch out for |
|---|---|---|
| In-house developer | You have a developer with time set aside for upkeep. | Maintenance slips when product work gets busy, and knowledge leaves when the person does. |
| Freelancer | A small site with few plugins and low change volume. | No cover during holidays, and response times are rarely guaranteed. |
| Hosting provider's managed plan | You only need server-level patching and backups. | Hosts rarely test plugin updates against your templates or fix application bugs. |
| CMS support and maintenance services plan | You want updates, testing, monitoring and fixes handled by one team with a written schedule. | Check exactly what is included and how out-of-scope work is billed. |
Signs Your CMS Maintenance and Updates Have Slipped
- The admin dashboard shows a long list of pending updates nobody wants to click.
- Your host has warned that your PHP or Node.js version will soon be unsupported.
- Nobody can say when the last backup was restored, or where backups are stored.
- Plugins installed for a past campaign are still active.
- Admin accounts exist for staff or contractors who left long ago.
- Forms occasionally fail and nobody knows how many leads were lost.
- The only person who knows how to deploy the site is a freelancer you cannot reach.
Why Choose 95 Solutions for CMS Maintenance
- We maintain our own CMS in production. This website and Boiler Decoder run on a CMS our team wrote, so backups, monitoring and releases are part of our own week.
- Front end and back end together. Headless sites get one team for the CMS, the APIs and the Next.js, Nuxt or Astro front end.
- Senior oversight. Mustafa reviews the maintenance plan and upgrade decisions, with 11+ years in digital marketing and a BS in Computer Science.
- You own access. Hosting, repositories, domains and backups stay in your accounts, and we work through user accounts you can remove.
- Useful hours. Our working hours overlap the full US business day and UK business hours.
Who Our CMS Maintenance Plans Suit
A good fit
- Business sites on Drupal, Craft, Strapi, Sanity, Contentful or a custom CMS with no one assigned to upkeep.
- Headless sites where the CMS and the front end were built by different teams.
- Companies inheriting a site from an agency or freelancer who is no longer available.
- Teams that want a small monthly block of development time for ongoing changes.
Probably not a fit
- Shopify stores, which are covered by our Shopify maintenance service.
- Sites that need round-the-clock on-call engineers with contractual response times measured in minutes.
- Owners who want updates applied directly on the live site with no staging step to save cost.
Maintenance often leads to bigger decisions. If your platform is out of support, our CMS migration services can move you somewhere current, and if systems around the CMS need connecting, see our CMS integration services.