Website Maintenance: Scope and Priorities

The maintenance needs of a website that has gone live are often a topic of debate. Part of the maintenance line is genuinely mandatory and neglecting it has costly consequences; another part consists of optional services presented as if they were mandatory.

Is website maintenance really necessary?

Part of it is genuinely mandatory: security updates, regular backups, SSL and domain renewals and uptime checks. When these are neglected the site can be taken over or suddenly go down completely. Monthly content updates and reporting, on the other hand, are optional; if you don't need them they can be dropped from the maintenance package.

What is really necessary

Security updates

This is the undisputed first item on the list. WordPress, plugins, server software and the SSL certificate must be updated regularly.

What happens on a site that isn't updated is not theoretical: a vulnerability is found in a widely used plugin, automated scanners scan every installation on the internet, and your site starts publishing spam pages after malicious code is injected. You usually notice this when Google shows the warning "this site may be harmful" — meaning your customers have seen it too.

Cleaning up costs many times more than updating, and regaining search engine trust takes weeks.

Backups

Regular, automatic backups whose restore has been tested. The last part gets overlooked: a backup taken and never tested doesn't count as a backup. In case of server failure, a faulty update or accidental deletion this is your only guarantee.

The backup must be kept somewhere other than the server itself. It's no use if the backup goes when the server goes.

Domain and SSL tracking

If the domain expires the site goes down completely. If the SSL certificate expires browsers show a "not secure" warning and most visitors turn back.

Both can be renewed automatically; but someone must check that auto-renewal is working. When the payment card expires, auto-renewal fails silently.

Uptime checks

Regularly verifying that the site is up and the forms work. The silent failure we encounter most often is the contact form stopping working: the page opens, the form is submitted, a "thank you" message appears, but the email never arrives. It can go unnoticed for months.

Doing a real test submission once a month solves this.

Useful but not essential

• Monthly performance report. Informative, but contributes nothing to the site working.
• Small content updates. If there's a panel you can do them yourself.
• Ongoing design touch-ups. Not needed if the site wasn't badly designed.

These aren't bad services; they just shouldn't be presented as mandatory under the "maintenance" heading.

Things sold without being needed

• Nothing concrete being done under the name "SEO maintenance". Sending the same report every month is not work. What was done must be written concretely.
• Licences for unused plugins. Review once a year.
• An unnecessarily high hosting package. If your traffic hasn't grown there's no benefit in upgrading the package.

What should be done how often

You can apply this table yourself; the point of buying a maintenance service is that someone does it without forgetting and can intervene when something goes wrong.

What you can check yourself

Even without a technical team you can do a few checks yourself:

• Broken link scan: enter your address into the Link Checker tool.
• Speed measurement: see mobile and desktop performance with the Site Speed Test.
• Search appearance: check how your page looks on Google and in shares with the Meta Tag Preview.
• Email health: measure the risk of your outgoing email landing in spam with the Email Health Check.

These are free and require no registration.

The real cost of neglect

The price paid later for saving on maintenance:

A hacked site. Cleanup, restoring from backup, a security audit and regaining search engine trust. The total cost is far above annual maintenance.

Lost enquiries. A form that doesn't work, email that doesn't arrive. You never notice this loss; you just say "business is slow".

An expired domain. A site that's gone down, email cut off. In some cases the domain is taken by someone else.

A slowing site. Unupdated plugins and a growing database weigh the site down over time; you lose both visitors and ranking.

What to ask in a maintenance agreement

• Which tasks are done every month? Have them written as a list.
• Where are backups taken, is restoring tested?
• What's the response time in an emergency?
• If the site is hacked, is cleanup included or charged separately?
• Is the work done reported?
• If the agreement ends, are access and backups handed over to you?

If you'll do the maintenance yourself: a monthly routine

If you don't want to buy the service externally, set aside an hour a month and follow this order:

1. Take a backup and check the backup's size. If the size has suddenly shrunk, something has gone wrong.
2. Apply updates. Backup first, then update — this order must never change.
3. Browse the site by eye. Home page, a service page, the contact form, the cart flow if there is one.
4. Do a real form submission. Does the email arrive?
5. Measure speed. Is there a noticeable slowdown compared to last month?
6. Scan for broken links.
7. Check the certificate and domain expiry.

Taking the backup before updating is critical. If an update breaks a plugin, that's your only way out.

Hosting choice is part of maintenance

Part of the maintenance cost actually arises from the wrong hosting choice:

• Shared hosting is cheap but you're affected by the load of neighbouring sites. Sufficient for small brochure sites.
• A virtual server (VPS) gives more control, in return for requiring management knowledge.
• Managed hosting is expensive but comes with updates, backups and security included; for businesses without their own team it can work out cheaper in total.

What to look at when choosing: is there daily automatic backup, is SSL included, is the PHP version current, does support actually respond.

What to do when something goes wrong

When the site is hacked or suddenly breaks, panicked interventions make things worse. The order should be:

1. Put the site in maintenance mode. So visitors don't encounter harmful content.
2. Take a backup of the current state. Even the broken state is needed as evidence and for comparison.
3. Change the passwords. Panel, hosting, database, FTP.
4. Restore from a clean backup. Determine after which date things broke.
5. Close the hole. If the same vulnerability remains, it gets entered again the same day.
6. Request a review from Search Console. If Google is showing a warning, this step is essential.

The most skipped item on this list is the fifth: the cleanup is done but the entry route isn't closed.

How to tell whether maintenance is really being done

If you're buying the service, ask for:

• A dated list of work done (which plugin was raised to which version)
• Where backups are kept and when they were last tested
• Problems detected during the month and interventions made

If these can't be provided, regular work probably isn't being done.

The question to ask when evaluating a maintenance quote isn't "is it necessary" but "which items are necessary". Security updates and backups aren't up for negotiation; the rest can be dropped according to your needs.

If you'd like to discuss your site's current state, get in touch.