A business website launches beautifully. Two years later it is hacked through an outdated plugin, the backup is six months old, and the developer who built it has moved on. Recovery costs more than two years of maintenance would have. This is the standard lifecycle of unmaintained websites, and website maintenance exists to prevent it: the ongoing care that keeps a site secure, fast, backed up and working.
Good website maintenance covers software updates, security monitoring, regular backups, uptime monitoring, performance checks, and small content changes. It is insurance plus improvement: preventing the disasters that cost real money while keeping the site current. Every business website needs it; the only question is what the plan covers.
This guide covers what happens without maintenance, what good plans include, pricing models, red flags and choosing a partner.
What happens without maintenance
Unmaintained websites decay predictably. Software goes outdated and vulnerabilities accumulate; one in every wave of sites gets compromised eventually. Backups stop working silently until the day they are needed. Performance degrades as content grows and nothing is optimised. Small issues compound: a broken form here, a slow page there, until the site actively loses business.
The costs are lumpy and large: emergency recovery, lost leads during downtime, and reputation damage from a hacked or broken site. Good upkeep converts these into small predictable payments; it is the cheapest insurance a business buys. Ask any owner who has paid for emergency recovery: the invoice always exceeds years of prevention.
Website maintenance: the essentials
Website maintenance breaks into six duties. Updates: core software, plugins and themes patched promptly. Security: monitoring, malware scanning and hardening. Backups: automated, tested, off-site. Uptime monitoring: someone notices outages before customers do. Performance: periodic speed and error checks. Content: small text and image updates as the business changes.
Each duty is simple; the value is that someone reliably does all of them. Owners underestimate maintenance because each task sounds trivial; agencies overpromise because selling it is easy. The checklist below separates the real from the vague.
What a good plan includes
| Included in good plans | Often extra or absent in weak plans |
|---|---|
| Scheduled updates with testing | Updates without testing, or never |
| Daily automated off-site backups | Backups on the same server, untested |
| Security monitoring and response | Nothing until you report a hack |
| Uptime monitoring with alerts | You discovering the outage |
| Monthly report of work done | Silence and a monthly invoice |
| Small content changes included | Every change billed as a project |
Demand the monthly report. A plan without reporting is a subscription to hope; the report is how you verify the updates, backups and scans actually happened. Related discipline is in our website performance guide, our technical SEO checklist, and speed specifics in our speed optimisation post.
Pricing models
Maintenance pricing comes in three shapes. Monthly retainers cover routine care with defined inclusions; fair and predictable. Annual contracts discount the retainer with committed terms. Pay-per-incident handles emergencies without a plan but costs the most per event and guarantees nothing proactive. For active business sites, retainers beat incidents on both cost and outcomes.
Price correlates with responsibility: the cheapest plans update plugins and disappear; real plans monitor, respond and report. Compare inclusions line by line, not prices, and ask what happens at 2 AM when the site goes down. The answer reveals the plan's true tier, and hesitation in the answer reveals even more.
Red flags in maintenance offers
Walk away from: no defined response times, backups that are never tested, updates applied without staging or testing, no monthly reporting, every small change billed extra with no allowance, and contracts that lock you in without service guarantees. The worst pattern is the plan that charges for insurance but delivers nothing until you complain.
Also beware the builder who will not maintain: a developer who ships and vanishes signals the code's true quality. Maintenance willingness is a proxy for build quality; vendors confident in their work offer to stand behind it.
Choosing a maintenance partner
Choose for responsiveness and transparency: defined SLAs, named contacts, real reports, and the ability to explain what they did in plain language. Prefer partners who built or deeply understand your stack; inheriting an unknown codebase costs extra everywhere. Start with a trial quarter and review the reports before committing annually.
The service side is cloud monitoring and optimization and DevOps services. Our local-business perspective is on the local businesses industry page.
The monthly report: your proof of value
A serious plan reports monthly, and the report is how you verify the work happened. It should list: updates applied and their results, backup status with the latest successful restore test, security scan results and any threats blocked, uptime figures, and content changes made. Vague summaries like all systems fine tell you nothing; specifics tell you everything.
Read the report like an auditor for the first three months. Are backups actually completing? Were updates tested before going live? How fast were incidents resolved? If the provider resists specifics, that is your answer about the plan's real tier. Good providers welcome the scrutiny because the report proves their diligence; weak ones hide behind jargon. After the trial period, keep skimming every report; the habit takes five minutes and keeps everyone honest.
Frequently asked questions
Can we maintain the website ourselves?
Small static sites, sometimes; anything with a CMS, plugins or transactions, rarely well. The risk is not the updates but the response: when something breaks at the worst moment, expertise on call beats tutorials. Most owners' time is better spent on the business.
How often should backups run?
Daily for active sites, with off-site copies and periodic restore tests. A backup that has never been restored is a hope, not a backup. Ask your provider when they last tested a restore.
What counts as a small content change?
Text edits, image swaps, adding a page from an existing template: minutes of work. Redesigns, new functionality and structural changes are projects. Good plans define the boundary in writing; get it before signing.
Should maintenance include SEO?
Ongoing technical health, yes; active SEO campaigns, no. Maintenance keeps the site crawlable and fast; growing rankings is separate work. Do not let a maintenance plan sell you SEO it cannot deliver.
What happens if we switch providers?
You should own everything: code, hosting accounts, domains, backups. A clean handover needs documentation and credentials; require both in the contract from the start. Hostage accounts are a contract failure, not bad luck.
Protect the asset you already paid for. Talk to our team about a maintenance plan that actually maintains, with reporting you can verify.