What to include in a monthly website maintenance report.
A good monthly maintenance report is what makes a retainer feel worth paying for. Below is the section-by-section checklist we use, followed by a live sample rendered from one anonymous probe of a real public site. Same shell your agency would send. No account. No fabricated numbers.
- HTTP_STATUS
- 200
- STACK
- unknown
- TLS_DAYS_LEFT
- UNKNOWN
- FINAL_HOST
- open.spotify.com
- GENERATED_UTC
- 2026-10-29 18:16
SAMPLE STRIP · open.spotify.com▸ live probe
Your agency
Website Care Snapshot
This is a point-in-time public check of open.spotify.com generated from one public probe.
Reachability
HTTP200
ResponseUNKNOWN ms
Redirectedyes to open.spotify.com
Certificate
RenewsUNKNOWN
Days LeftUNKNOWN
FlagUNKNOWN
DNS
A Records1A record(s)
wwwresolves
Security headers
strict-transport-securityPRESENTmax-age=31536000
content-security-policyPRESENTscript-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account/*/ad/*/details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account/*/ad/*/details https://local.spotify.net/preview/* https://app.smartly.io/*;
x-frame-optionsMISSINGMISSING
Hardening opportunities: x-frame-options MISSING, x-content-type-options not nosniff, referrer-policy MISSING
Stack
unknown
Eight sections. Skipping any of them is what turns a retainer into a bill.
Order matters less than completeness. A monthly report that lacks any of these will be read as filler by a careful client.
- 01 · COVERAGE
What we monitored this month
List the surfaces in scope: apex, www, app subdomain, admin path, the staging mirror. A reader who doesn't know what was being watched will distrust the percentages that follow.
- 02 · UPTIME
Uptime, with timestamps
Uptime percentage plus the start and end timestamps of every outage. Anything less is a marketing number.
- 03 · INCIDENTS
Incidents, in plain language
What broke, when we noticed, what we did, when it came back. Plain sentences, no jargon. The client's CFO should be able to read it without a translator.
- 04 · PERFORMANCE
Performance & latency
TTFB, LCP, TLS days remaining, header health. Real measurements named as ours. Trends across months beat single numbers — say which direction we're moving.
- 05 · MAINTENANCE
Maintenance performed
Plugin and dependency updates, backups taken, security scans run, content edits shipped. Itemised with dates so the retainer reads as labour, not a line item.
- 06 · BACKUPS & RESTORES
Backups taken, restores tested
A backup you have not restored is a rumour. State how many backups ran, when the last restore test happened, and what it covered.
- 07 · SECURITY
Security posture
Failed-login volume, blocked IPs, WAF events, dependency CVEs we patched or triaged. The point is to show stewardship, not to scare anyone.
- 08 · SEAL
Seal & share link
The report is finalised, sealed with a SHA-256 chain, and shared as an opaque link the client can verify. No login, no portal, no "trust us".
ANTI-PATTERNS
What a monthly report is not.
A monthly maintenance report is not a sales email. It is the single document that justifies the retainer, so the worst thing it can do is sound like marketing. Cut these patterns on sight:
- Screenshots of green dashboards with no underlying numbers.
- Percentages with no denominator and no timestamp.
- Bundling last month's incident into "ongoing stability".
- Stock photography where the incident log should be.
- Calls to action in the same email as the report body.
BEFORE / AFTER
Before:“Your site was 99.97% available this month. Our team kept everything running smoothly.”
After:“Coverage: apex, www, app.example.com from 2026-08-01T00:00Z to 2026-08-31T23:59Z. Uptime 99.97%. One incident, 2026-08-14, 17:02Z–17:38Z, 200 GB boundary cache eviction triggered 503s; cache rule tightened, no recurrence this month.”
Both are 99.97%. Only one survives a careful read.