What a monthly website report should show you, and the red flags if it doesn't

If you pay someone to look after your website, the monthly report is the only part of the work you ever see. Everything else happens out of view. So the report carries a lot of weight. It's your receipt, your early warning and your way of knowing the money isn't just disappearing.

A real monthly website report tells you in plain words what was updated, whether backups were proven with a test restore, any downtime, whether every form was tested end to end, how the site's speed and security looked and what's coming next. A report that's mostly traffic charts and big scan counts, with none of those answers, is a red flag. You should be able to read it in five minutes and know exactly what you paid for.

Why the report matters more than it seems

Good care is mostly invisible. When updates go smoothly and nothing breaks, the owner sees nothing at all. That's the goal, but it creates a problem. From the outside, a vendor doing careful work every week and a vendor doing nothing look exactly the same, right up until something fails.

The report is what separates them. It should be specific enough that you could check any line of it. If it isn't, you can't tell the difference either.

What a real monthly report contains

Here's what I'd expect to see every month, in roughly this order:

1. Updates applied. Which plugins, theme and platform versions were updated, and on what date. A plugin is an add on that gives your site a feature, like a form or a booking calendar. Anything held back should be named with a reason.
2. Backups, with a restore test. Confirmation that backups ran, where they're stored and when a restore was last tested, with the result.
3. Uptime incidents. Any time the site was down, when it happened, how long it lasted and what caused it. "No downtime recorded" is a fine answer.
4. Form tests. Each form listed, the date it was tested and confirmation the message reached the right inbox or CRM, not just that a thank you screen appeared.
5. Speed check. A phone speed check against last month, with a note if something got slower and why.
6. Security events. Blocked login attempts worth knowing about, any malware found and removed, and anything that needed action.
7. Certificates and renewals. When the SSL certificate (the padlock in the browser bar) next renews, and when the domain is up for renewal.
8. Content edits done. The small changes you asked for, and when they went live.
9. What's coming next. Anything on the horizon, like a plugin being retired or the server's PHP version needing an upgrade.

That last item is the one that shows someone is thinking ahead. For example, the PHP project, which maintains the programming language WordPress runs on, lists security support for PHP 8.2 ending on December 31, 2026 (php.net, Supported Versions). A good report mentions a deadline like that months before it arrives, not after.

Backups: "ran" is not the same as "work"

Almost every report says backups ran. Very few say one was restored. Those are different claims. A backup can run every night for a year and still be useless if it's missing the database, stored on the same server that failed or corrupted in a way nobody noticed.

The federal cybersecurity agency puts it bluntly. Businesses should "regularly test the availability and integrity of backups in a disaster recovery scenario." (CISA #StopRansomware Guide) Your report should tell you when that last happened. If the answer is "never," you don't have a backup plan yet. You have a backup habit.

What a vanity report looks like

A vanity report is built to look busy. It's usually long, colorful and generated automatically. You'll recognize a few of these:

• Pages of traffic charts, with no mention of whether leads came in.
• Huge numbers like "thousands of threats blocked," with no context about what that means for you.
• A green checkmark next to "backups" and nothing about a restore.
• A performance score with no explanation of what changed or what's being done.
• The same report every month, where only the dates change.

Traffic data isn't useless. It just belongs in a marketing conversation. A care report should answer one question first: is the site working, and what did you do to keep it that way?

Red flags checklist

Pull up your last three reports and check them against this list. Any one of these is worth a conversation with your vendor:

• No list of which updates were applied, just "updates completed."
• No date for the last test restore of a backup.
• No mention of form testing, or form testing that stops at the thank you page.
• Downtime that you noticed yourself but that isn't in the report.
• No renewal dates for your certificate or domain.
• Nothing under "what's coming next," month after month.
• No report at all unless you ask for one.
• Your vendor can't explain a line of the report in plain words when you ask.

If you want the full list of what the work itself should include, I wrote that up in what website maintenance should include. For the problems that tend to hide between reports, see six silent website failures.

If you look after the site yourself

Keep your own report. Honestly, it's the best habit a DIY owner can build. It doesn't need to be fancy. A shared document with one entry per month works fine.

Write down what you updated, the date you last restored a backup, the date you tested each form and where the message landed, and your certificate and domain renewal dates. It'll take you ten or fifteen minutes on top of the work itself. The hard part is doing the restore test and the form test every single month, and noticing when you skip them. If you ever hand the site to someone else, that log is worth more than you'd think.

What our monthly check covers

Our website care plan includes a monthly check that everything still works, and the report that comes with it is written for a busy owner, not a developer. We handle updates and security patches, monitor for downtime and broken forms, run daily backups with restores we actually test, renew your SSL certificates and make small content edits when you need them. Because we also run the servers through our hosting, one team can tell you what happened and why. Your contact forms get the same attention through our forms and tracking work. You get the exact monthly price in writing before you sign.

Ask us about a care plan.