On this page
- 01
Work out what the standard asks of you
- 02
Compare what you have with what a supplier covers
- 03
What does Lexcel accreditation ask of a practice’s website?
The Law Society’s Lexcel standard lists information management among its sections, and the standard expects a practice to have an information management and security policy. That sits under Information Management and Security.
The Law Society’s public Lexcel page lists the sections as client care, risk management, people management, structure and strategy, financial management, information management, and file and case management. It does not mention websites.
So whether and how the policy reaches the website is for the practice to read from its own copy of the Lexcel standard, and to ask its assessor or Lexcel consultant. The Law Society’s application page names v6.1 as the version for England and Wales. The same reading shows whether the website sits in the existing policy or in a separate document, such as a website management policy, where a practice holds one.
The SRA Transparency Rules are a separate duty, and they are kept apart from Lexcel here. Under the Solicitors Regulation Authority Transparency Rules, an authorised body publishes certain things on its website:
- its SRA number and the SRA digital badge, in a prominent place
- cost information for listed services
- details of its complaints procedure
These are content duties, not maintenance duties. A replaced theme or template is one way a badge or a cost information page could drop off a site. That describes how it could happen, not a documented case.
What does WordPress maintenance involve?
Updates and monitoring
Maintenance keeps WordPress, plugins and themes current. Known holes are blocked within hours. The site is scanned for malware every 12 hours, checked every minute, and sits behind a firewall at the edge. How security monitoring is scoped is set out on NoDrama’s security page.
Backups and restore tests
Backups are held offsite and kept 90 days. How often they run depends on the plan: daily, every 12 hours, or every change, as it happens. Restore testing runs once a year, twice a year or every 3 months, by plan. How backups and restores are handled is covered on NoDrama’s backups page.
Reporting
Every plan includes reporting. This page does not describe its contents, frequency or format.
To confirm any of this, ask the supplier, NoDrama included, what the report shows and when the last restore test was run. Keep the answer with the policy.
Who has operated your policy since it was written?
The practice already has the policy, and that is the right starting point. The one question the policy alone cannot answer is who has acted on the website since it was written, and when.
Owning a website is a set of tasks. Someone applies updates. Someone checks that backups restore. Someone is told when the site is down. Whether each task has a named person is the firm’s decision to make.
| Task | Owner | Date |
|---|---|---|
|
Applies updates
|
||
|
Checks that backups restore
|
||
|
Is told when the site is down
|
The person or agency that built the site may or may not still do these tasks, and either answer is ordinary. For a policy to be true as well as filed, each task needs an owner and a date.
What can a maintenance supplier show you, and what is left out?
Criteria come first: what is included, how often each task runs, how quickly the supplier commits to respond, and what is excluded. The table shows what NoDrama’s three plans cover and quote, from the pricing page as checked on 5 October 2026. Prices are in US dollars and are the same monthly or yearly.
| The Standard | The Higher Standard | The Highest Standard | |
|---|---|---|---|
|
Price per month
|
$129/month | $249/month | $479/month |
|
Backup frequency
|
Daily | Every 12 hours | Every change, as it happens |
|
Response commitment
|
4 hours | 2 hours | 1 hour |
|
Small jobs at once
|
One | Two | Three |
|
Restore testing
|
Once a year | Twice a year | Every 3 months |
- “WordPress, plugins and themes kept current”
- “Scanned for malware every 12 hours”
- “A firewall at the edge, before your site”
- “DDoS and bot protection”
- “Known holes blocked within hours”
- “Backed up offsite, kept 90 days”
- “Checked every minute”
- “Global CDN”
- “Page and browser caching”
- custom development, redesigns, feature builds and complex integrations
- malware remediation on an already-infected site, unless agreed in writing
- a guarantee of 100% uptime, and a guarantee of immunity from zero-day vulnerabilities
Liability is capped at the amount paid in the previous three months.
A practice that already has a named person updating WordPress, with records, does not need a plan. Visual regression testing and tested updates are also offered by other providers, including ManageWP, WP Umbrella and WP Remote, so they are not a reason to choose one supplier. How the care plans and ongoing work are scoped is on NoDrama’s maintenance page.
How do you put the website under your own policy?
- 01
Read your own copy of the Lexcel standard and ask your assessor or Lexcel consultant where the website sits.
- 02
Add the website to your own Lexcel checklist as a named system with a named owner. This is the practice’s checklist, not a published one.
- 03
Find out what is installed now. NoDrama’s free WordPress audit is one place to start.
- 04
Ask each supplier what its plan includes and what its reporting shows.
- 05
Set a review date in the policy for the website, so it is reviewed on the same cycle as everything else.
After each step, the practice can answer three questions:
If any answer is missing, the step is not finished.
Does a maintenance plan make a practice Lexcel compliant?
No. A plan supports the practice’s own policy. Policy, ownership and review stay with the firm, and the assessor decides what satisfies the standard.
One misconception is worth naming: that a supplier’s badge or statement stands in for the practice’s own record. It does not. The record of who looked after the website, and when, belongs in the practice’s files.
Put a dated record of the website in the firm’s file.
NoDrama’s maintenance for law firms sends a dated report every month of what was checked, changed and fixed, ready to sit beside your policy.
What does this page not settle?
- Which Lexcel section covers the website, and what an assessor will accept as evidence. Both need the standard’s text and the assessor. This page does not quote that text.
- Whether the practice’s SRA Transparency Rules obligations are met. This page is not legal advice.
- Custom work, and cleaning an already-infected site, which sit outside the plans under NoDrama’s Terms of Service unless agreed in writing.
Where to start with Lexcel accreditation and the website
Maintenance gives the website an owner for its tasks, and several carry a stated interval: checks every minute, a malware scan every 12 hours, and backups and restore tests by plan. It supports the practice’s own policy and leaves the question of what satisfies the standard with the practice and its assessor. The first step is to read the firm’s own copy of the standard, and to ask the assessor where the website sits.