Website maintenance: what it includes and why it matters
Website maintenance is the updates, backups, monitoring, renewals and fixes that keep a site working. What it covers per platform, and what to skip.
By Sohail Hussain29 October 20268 min read
Website maintenance is the ongoing work that keeps a site secure, working and current after launch: applying software updates, taking and testing backups, monitoring uptime and forms, renewing the domain and certificate, fixing what breaks, and making content changes. It matters because websites decay even when nobody touches them. Software develops known flaws, certificates expire, browsers change, integrations update their APIs, and forms stop delivering without anyone noticing. A maintained site keeps earning enquiries; an unmaintained one fails quietly, usually at a bad moment.
How much maintenance a site needs depends almost entirely on the platform it runs on. A static site may need an hour a quarter. A WordPress site with twenty plugins needs attention every week. This guide covers what maintenance includes, how it differs by platform, what it costs as of October 2026, and the parts you can safely do yourself.
What does website maintenance include?
| Task | How often | What goes wrong without it |
|---|---|---|
| Uptime and form monitoring | Continuously | The site or contact form is down for days before a customer mentions it |
| Backups, stored off-site | Daily, with a restore tested quarterly | A hack, a bad update or a hosting failure becomes a rebuild |
| Security updates to the platform, theme, plugins or dependencies | Weekly for WordPress; monthly for most custom sites | Known flaws get exploited; WordPress sites are attacked automatically |
| SSL certificate renewal | Automatic, but checked | Browsers show a full-page security warning and visitors leave |
| Domain renewal and DNS | Yearly, with auto-renew on | The site and email disappear; in the worst case someone else registers the domain |
| Content changes | As needed | The site shows old staff, old prices and last year's news |
| Speed and Core Web Vitals check | Monthly | New images and scripts slowly make the site slow |
| Search Console review | Monthly | Indexing errors and broken pages go unnoticed |
| Broken link and redirect check | Quarterly | Visitors and crawlers hit dead ends |
| Analytics and tracking check | Quarterly | Decisions are made on data that stopped recording months ago |
| Access review | Twice a year | Former staff and agencies still have admin logins |
The first five are about keeping the site alive. The rest are about keeping it useful. Most cheap maintenance plans cover the first five and nothing else, which is fine if that is what you need and you know it. Our website care and maintenance service covers all eleven, and for some sites we tell owners that the first five are all they should pay for.
Why does a site need maintenance if nothing on it changes?
Because the world around it changes.
Software ages. Every platform, plugin and library eventually has a security flaw found in it. Once a flaw is public, automated scanners try it against every site they can find within days. A WordPress site running a plugin version with a known flaw is not at risk of being hacked; it is waiting to be. WordPress security lists the measures that stop most of it, and your website got hacked: a recovery plan covers what happens when they were skipped.
Certificates expire faster than they used to. As of October 2026, publicly trusted SSL certificates can be valid for at most 200 days, under a schedule agreed by the CA/Browser Forum that shortens the limit further in 2027 and 2029. Manual renewal is no longer realistic; renewal must be automated, and someone must notice when automation fails. SSL certificates explained covers the details, and Let's Encrypt's documentation is the primary reference for automated renewal.
Integrations change. Payment gateways, CRMs, map embeds and analytics tags all update their APIs and retire old versions. A form connected to a CRM through an old method keeps looking fine while the leads stop arriving.
Ownership drifts. The person who set up the domain leaves. The hosting account is on a former employee's card. The agency that built the site stops replying. Who owns your website sets out what you should hold in your own name, and how to get control of your domain back covers the recovery when you do not.
How does maintenance differ by platform?
| Static or Next.js site | Self-hosted WordPress | Shopify, Wix, Squarespace | Web app or portal | |
|---|---|---|---|---|
| Who updates the platform | You or your developer, a few times a year | You or your developer, weekly | The platform | Your developer, on a schedule |
| Security exposure | Very low; no public admin or database | High; plugins are the usual way in | Low; handled by the platform | Medium; depends on the build |
| Backups | Code is in a repository; content in the CMS | Essential, daily, off-site | Partly handled; exports advisable | Database backups with tested restores |
| Typical monthly effort | 0 to 1 hour | 2 to 6 hours | 0 to 2 hours, mostly content | 10 hours and up |
| Main risk | Nobody can make changes when the developer is gone | Hacks and broken updates | Price rises and app sprawl | Dependencies falling behind |
The table explains why we build most company sites on Next.js: the maintenance column for a static or pre-rendered site is nearly empty. It also explains why a WordPress site without a maintenance arrangement worries us more than any other kind. The monthly WordPress maintenance checklist is the routine for that platform.
What does maintenance cost?
As of October 2026, for most company websites:
- Hosting only: server, CDN, SSL and domain, with no human work. $0 to $40 a month, or ₹0 to ₹3,000 in India.
- Basic care: updates, backups, uptime monitoring and security patches. $50 to $150 a month, or ₹3,000 to ₹10,000.
- Standard care: basic care plus a few hours of content changes and fixes. $150 to $500 a month, or ₹10,000 to ₹35,000.
- Retainer: ten or more hours of development and design each month, for sites and apps that keep changing. $1,000 a month and up, or ₹50,000 and up.
How much does website maintenance cost explains each tier and how to compare two quotes. For the hosting part on its own, the hosting cost calculator estimates a monthly figure from your traffic and page size.
The tier you need follows from the platform table, not from the size of the business. A large company with a static site may need only hosting and a quarterly check. A small business on WordPress with a booking plugin needs basic care at least. If the work is closer to ongoing development than upkeep, a monthly team arrangement usually costs less than buying hours one at a time; dedicated development team vs project pricing compares the two.
Which parts can you do yourself?
More than most agencies admit.
Monitoring. A free uptime monitor that checks your homepage and contact page every five minutes and emails you when either fails takes ten minutes to set up. Uptime monitoring: how to know when your site is down shows how. Add a monthly test enquiry through every form, sent by a person, because a monitor sees that the page loads, not that the email arrives.
Renewals. Turn on auto-renew for the domain, check that the card on file is a company card that will not expire this year, and set a calendar reminder a month before. Keep the registrar login in the company password manager, not in someone's personal inbox.
Email and DNS. Business email records, once set correctly, rarely change. Checking them yearly costs nothing. How to set up business email with your domain, DNS explained for business owners and SPF, DKIM and DMARC cover the setup and the checks.
Analytics and consent. Log in once a quarter and confirm data is still arriving. GA4 for small businesses lists what to track, and cookie consent: what you actually need covers the banner; consent rules differ by country, so confirm the requirement for your markets with your lawyer.
Content. On any platform with a decent editor, your own team should make routine content changes. Paying an agency to change a phone number is a sign the site was built without a usable editor.
What you should not do yourself, unless someone on the team has done it before: WordPress core and plugin updates on a site that matters, restores from backup, and anything involving DNS during a live migration. These are the tasks where a mistake takes the site down, and they are where paid care earns its fee.
What should a maintenance agreement say?
If you pay for care, the agreement should state, in writing:
- Which of the eleven tasks in the first table are included, and how often each is done.
- How quickly they respond when the site is down, and how quickly for routine requests.
- Where backups are stored, how long they are kept, and when a restore was last tested.
- How many hours of changes are included, and the rate beyond that.
- What you receive each month: a short report on uptime, updates applied, issues found and changes made.
- That the domain, hosting, code and all accounts are in your name, with the agency as a user, and what they hand over if the agreement ends.
The last point matters most and is checked least. A care agreement that ends with your agency holding your domain is not a maintenance arrangement; it is a dependency. How to hand over a website to a new agency lists what a clean handover includes, and it is worth asking for that list on day one, not when you are leaving.
If you are starting from nothing, begin with the three things that prevent the worst outcomes: auto-renew on the domain, daily off-site backups, and an uptime monitor on the homepage and contact form. Website backups: what good looks like covers the second. Everything else on this page can follow over the next month.
Was this guide useful?