What website maintenance actually covers, and why it matters
Maintenance is sold as a monthly line item and understood as insurance. It is really the difference between a site that quietly keeps working and one that fails at the worst moment.
Contents
Maintenance is the least glamorous thing a studio sells and the one clients query most, because nothing visible happens. That is exactly the point. A good month of maintenance looks identical to a month in which nobody did anything, right up until the month where it does not.
Here is what the work actually consists of, so you can judge what you are being offered.
Updates, applied with judgement
Every site runs on software that changes: the content system, its extensions, the theme, the language runtime underneath, the server packages beneath that. Updates arrive constantly, and they are not optional, because the security fixes arrive in the same stream as everything else.
The work is not clicking update. It is deciding, for each one, whether it is a routine patch or a change likely to break something, testing the risky ones on a copy of the site first, applying them in a sensible order, and checking the pages that could plausibly be affected afterwards.
Sites that are never updated do not degrade gradually. They stay exactly the same until a known vulnerability is exploited, or until an update becomes impossible because too many versions have passed and the only route forward is a rebuild.
Backups you have actually restored
Nearly every host offers backups. Far fewer people have ever tested one. A backup is not a backup until you have restored it somewhere and confirmed the site came back complete, database and files together, with the right permissions.
A sound arrangement has three properties. Backups run automatically and often enough that losing the gap between them would be tolerable. They are stored somewhere other than the server they came from, because a compromised server takes its backups with it. And somebody has restored one recently enough to know the procedure works.
Security, which is mostly hygiene
Small business sites are rarely targeted by name. They are found by automated scanners looking for known weaknesses across the whole internet, which means the defence is not sophistication, it is not being an easy target.
In practice that means keeping software current, removing plugins and themes that are installed but unused, enforcing strong authentication with a second factor on every account that can change the site, giving each person only the access they need, and keeping the certificate and its renewal working. Add monitoring that notices when a file changes unexpectedly, because the gap between a compromise and its discovery is what determines how bad it becomes.
Monitoring, so you are not told by a customer
Uptime checks from more than one location, so a fault is distinguished from a local network problem. Alerts when the certificate is approaching expiry, because an expired certificate makes a site look dangerous in every browser at once. Checks on the pages that earn money, not only the home page, since a working home page and a broken checkout is a very expensive combination.
Error logging matters too. Most sites generate warnings nobody reads, and somewhere in that noise is usually the first sign of a real problem.
Performance, kept rather than achieved
A site launches fast and gets slower, because content is added, images are uploaded at whatever size they came in at, and a marketing tool is installed. Maintenance should include periodically measuring the key pages, comparing against how they performed at launch, and dealing with the regression while it is still small.
Content and small changes
Most maintenance plans include an allowance of time for small changes: new staff, revised prices, a seasonal banner, a page that needs rewording. This is the part clients value most day to day, and it is worth being precise about how it is measured and whether unused time carries forward.
It is also where the relationship earns its keep. Somebody who knows the site can make a change in minutes that would take a stranger an afternoon to work out.
The quiet housekeeping
Databases accumulate revisions, expired sessions and orphaned data, and slowly get heavier. Broken links appear as other people reorganise their sites. Forms stop delivering because a mail provider changed something. Redirects go missing after a page is renamed, and search engines lose a page that used to rank.
None of these are dramatic. All of them cost something, and all of them are cheap to catch early.
What good looks like in a plan
Judge a maintenance offer on whether it answers these plainly:
- What is updated, how often, and is it tested before it goes live?
- How often are backups taken, where are they stored, how long are they kept, and when was one last restored?
- What is monitored, and who gets alerted at two in the morning?
- What is the response time for an outage, as opposed to a routine request?
- How much change time is included, how is it counted, and does it roll over?
- Is there a report, and does it say what was done rather than only that something was?
- Who owns the hosting, the domain and the code, and what happens to all three if we part company?
That last one matters more than people expect. A maintenance arrangement you cannot leave is not a service, it is a hostage situation.
Why it matters more than it looks
The cost of maintenance is predictable and modest. The cost of not having it arrives all at once, usually at an inconvenient time, and usually in a form that is more expensive than the work that would have prevented it: a compromised site to clean up, a failed restore, a rebuild forced by software too old to update, or simply weeks of lost enquiries from a contact form that stopped delivering and nobody noticed.
A website is not a thing you finish. It is a thing you run. Maintenance is what running it looks like.