The site is live, the design is signed off, the contact form works. At that point many business owners assume the job is done. A few months later they call in a panic: the site is down, showing a blank page, or Google has started warning visitors that the page is unsafe.
The cause is almost always the same. Nobody looked after the site after launch.
Website maintenance is not an abstract service agencies invent to secure recurring revenue. It is a concrete list of technical tasks that protect your investment. This article covers what belongs on that list, how often each task should run, and how to decide whether you need a plan or can handle it yourself.
What website maintenance actually means
Every website sits on several layers of software: the server, PHP or another language, a database, a CMS such as WordPress, a theme and dozens of plugins. Each layer updates independently, on its own schedule, maintained by different people around the world.
Leave everything untouched and the layers slowly drift apart. A plugin written for WordPress 6.4 starts behaving oddly on 6.9. A library that was safe a year ago now has a publicly known vulnerability. The server moves to a newer PHP version and older code stops running.
Maintenance is the process that keeps those layers in sync and watches for breakage before a customer finds it first.
Maintenance versus hosting
These two are often confused. Hosting is where the site lives: server, disk space, bandwidth. The hosting company is responsible for keeping the server powered and reachable.
Maintenance is the care of the site itself: code, content, plugins, backups and security. If hosting is renting a flat, maintenance is the repairs, the new lock and clearing the drain before it blocks.
Good hosting with a neglected site still leaves you exposed. If you are still choosing where to host, look at our hosting services, but do not stop there.
What a serious maintenance plan includes
CMS, theme and plugin updates
This is the most frequent task and the dullest sounding. WordPress and popular plugins ship updates almost weekly. Some are cosmetic, but a meaningful share close security holes.
The catch is that updating is not automatically safe. A plugin updated without checks can break the homepage layout or kill the order form. So the order matters: back up, update a copy or staging environment, verify the key pages, and only then update live.
Frequency: weekly checks, a full cycle monthly for smaller sites.
Backups that actually restore
Every host claims to run backups. Few people have ever checked whether those backups are worth anything.
A working setup looks like this:
- automated daily backup of files and database
- a copy stored off the site's own server, so it survives a server failure
- at least 30 days of history, because problems are often noticed weeks later
- periodic restore testing
That last point is the one most people skip. A backup that has never been tested is a promise, not a guarantee.
Security and malware monitoring
Attacks on small sites are rarely personal. Bots scan the internet for known vulnerabilities and hit anything that answers. A local company site with 200 visitors a month is just as interesting to them as a large store, because it can be turned into a spam machine.
The practical minimum: an active firewall, limited login attempts, two-factor authentication for admins, a file change scanner and an SSL certificate that does not expire without warning.
Uptime monitoring
If the site goes down on Friday evening and you find out Monday morning, you have lost three days of visibility. Uptime monitoring tools check the site every few minutes and alert you the moment something breaks.
It is a cheap and fully automatable measure, yet it is missing from a surprising number of sites.
Speed and technical health
Speed rarely collapses overnight. It degrades slowly, while someone uploads 4 megabyte photos, adds a fourth analytics script and installs a plugin that loads its own library on every page.
A quarterly review of Core Web Vitals and load times usually brings a site back within acceptable ranges without a rebuild. If speed has already dropped badly, the topic connects directly to SEO and GEO optimisation, because Google measures real user experience.
Content care
The technical side is half the job. The other half is whether the information on the site is still true: prices, opening hours, team members, services you no longer offer, and pages with expired promotions.
That check takes half an hour per quarter and has a direct effect on trust.
What happens without maintenance
| Neglected task | What happens | Typical cost of the fix |
|---|---|---|
| Plugin updates | A known vulnerability is exploited, the site gets hacked | Cleanup and restore, often days of downtime |
| Backups | Nothing to restore from after a failure | Rebuilding the site from scratch |
| SSL certificate | The browser shows a "not secure" warning | Low, but traffic drops immediately |
| Uptime monitoring | The site is down for days and nobody knows | Lost enquiries and sales |
| Speed | Slow loading, lower rankings | Optimisation, sometimes a rebuild |
| Content | Wrong prices and outdated information | Lost trust, hard to measure |
The right-hand column is deliberately descriptive rather than a fixed figure. The cost depends entirely on the damage and how quickly it was spotted.
Do it yourself or hire a plan
Not every site needs external maintenance. Here is an honest way to judge.
You can handle it yourself if
You run a simple WordPress brochure site with few plugins, you can spare an hour a month, you understand what each update does, and you have the habit of backing up before touching anything. In that case a plan would be an unnecessary cost.
It is worth delegating if
The site generates enquiries or sales and every hour of downtime has a price. You run an online store where orders come in around the clock. You have integrations with external systems, accounting software or payment providers. Or you simply have no time, and the cost of a mistake exceeds the cost of the plan.
There is a middle path too: outsource monitoring and backups, keep content updates in house. That is a sensible compromise for many small companies.
How to choose a maintenance provider
Ask five questions before signing anything.
What exactly is included. If the answer is "we maintain the site", that is not an answer. Ask for a task list and a frequency for each item.
How many hours of work are included. Most plans include a fixed number of hours for changes. Beyond that you are billed extra, and you should know how.
Who holds the credentials. Hosting, domain and admin access should be yours. If a provider refuses to hand them over, that is a serious reason to walk away.
What is the response time in an emergency. The difference between a two hour response and a two working day response is enormous for a store.
Do you get a report. A short monthly summary of what was updated, what was noticed and what is coming is standard practice.
At WEBPROGRESS, plans are assembled around the specific site, because maintaining a five page brochure site and a store with a thousand products cannot reasonably cost the same. We send an individual quote within 24 hours once we have seen what is under the hood. Reach us through the contact page.
What is different about online stores
A store is a website with money inside, and that changes everything.
Every minute of downtime is a directly lost sale. There are more plugins and more integrations: payment provider, courier, accounting system, product feed to Google Merchant Center. An update that breaks checkout can go unnoticed for hours if nobody test-orders after a change.
That is why store maintenance must include a staging environment rather than updates applied straight to production. If you are still planning a store, see what goes into building an online store and budget for maintenance from the start, not a year later.
Automating part of the work
Not everything needs a human. A large share of routine checks can be automated:
- backups run on a schedule and upload to separate storage
- uptime monitoring pushes an alert to Slack or email
- a file scanner notifies you of any change
- speed reports generate automatically every month
People are still needed where judgement is required: whether a given plugin should be updated, whether a change broke something, what to do during an incident. If that sounds useful beyond the website itself, look at what can be automated in your business.
Frequently asked questions
How often should a WordPress site be updated
Check for available updates weekly, run a full cycle with backup and testing at least monthly. When an update closes an actively exploited vulnerability, act immediately rather than waiting for the schedule.
My host runs backups, do I need another set
It depends on two things: how far back the backups go and where they are stored. If the copies sit on the same server and history is three days, that does not help with an infected site compromised a week ago. An off-site copy with longer retention solves this.
Can a site run for years without maintenance
It can, especially if it is static and has no CMS. With WordPress or another plugin-driven CMS, going a year without incident is realistic, but the odds of being hit rise every month. The question is not if, but when and how much it will cost.
What do I do if the site is already hacked
First, delete nothing. Take a copy of the current state, including the logs, because they show how the attacker got in. Then restore a clean backup from before the incident, update everything, rotate every password and confirm the hole is closed. Restoring without closing the entry point leads to reinfection within days.
Is maintenance worth it for a small brochure site
Yes, but in a reduced form. Backups, updates and SSL are the minimum even for a five page site. A full plan with change hours is probably unnecessary if you rarely touch the content.
Conclusion
Website maintenance is boring right up until it becomes urgent. The difference between a site that runs into its fifth year without drama and one that has to be rebuilt is almost never the original build. It is whether anyone was watching after launch.
If you are unsure what state your site is in right now, we will review it and tell you honestly what we find: updates, backups, security, speed. Based on that review you get an individual quote within 24 hours. And if you are still thinking about a new site, see our web development services and put maintenance in the plan from day one.
Get in touch and start with the review.
