Key Takeaways
- Website maintenance is seven jobs: security updates, backups, uptime monitoring, performance checks, content changes, broken-link and form checks, and platform or dependency upgrades.
- The genuinely necessary parts are security updates, tested backups and upgrades. These protect you from problems that are expensive and sometimes unrecoverable.
- The padding to watch for: “monitoring” billed as a service when it is an automated alert, and hosting rebadged as maintenance.
- The test of a backup is a restore. A backup nobody has ever restored is a belief, not a backup.
Website maintenance is the ongoing work of keeping a site secure, working and current: applying security updates, taking and testing backups, watching uptime, checking speed, making content changes, catching broken links and dead forms, and upgrading the platform and its dependencies before they become a problem. Some of that protects you from genuinely expensive failures. Some of what gets billed under the same heading is a hosting invoice with a service name on it. The difference is worth knowing.
The Seven Jobs
| Job | What it involves | Necessary? |
|---|---|---|
| Security updates | Patching the platform, plugins, themes and dependencies as fixes are released | Yes. Most site compromises exploit a known vulnerability that had a patch available |
| Backups | Automated, off-site, versioned — and periodically restored to prove they work | Yes, and the restore test is the part that matters |
| Platform & dependency upgrades | Major-version upgrades, deprecations, end-of-life packages | Yes. Deferring these turns a routine upgrade into a rebuild |
| Uptime monitoring | An alert if the site goes down | Yes, but it is a cheap automated service, not skilled labour |
| Performance checks | Core Web Vitals on real-user data, image weight, caching | Quarterly is usually enough unless the site changes constantly |
| Link, form & integration checks | Broken links, forms that silently stopped sending, expired API keys and certificates | Yes — and a dead contact form is the most expensive item on this table |
| Content changes | Text edits, new pages, image swaps | Only if you want someone else doing it. This is billable work, not maintenance |
What Happens If You Skip It
- You get compromised through a known hole. Automated scanners find unpatched sites within days. The result is usually injected spam links or a redirect — damaging to rankings, embarrassing to customers, and slow to clean.
- You discover the backup does not work on the day you need it. This is the single most common serious failure we see, and it is entirely preventable by restoring one occasionally.
- A routine upgrade becomes a rebuild. Three major versions behind, with plugins that no longer have maintained equivalents, is a project rather than an afternoon.
- A form stops sending and nobody notices. Weeks of enquiries, gone, and it looks exactly like a quiet month.
- A certificate expires and every browser warns visitors away from your site. Cheap to prevent, painful for the hour it lasts.
The pattern is worth noticing: none of these is gradual. Maintenance is not about slow decline, it is insurance against sudden, avoidable events.
What It Should Cost, and How to Compare Quotes
We do not publish our own fees, and any figure quoted without seeing your site would be invented. What you can do is make two quotes comparable, which most people never manage because the quotes describe different things. Ask every supplier for the same six answers:
- Is hosting included, and at what spec? A retainer that is mostly hosting should cost about what hosting costs.
- How often are security updates applied, and who tests them? “Automatically” without testing is how sites break on a Tuesday morning.
- Where are backups stored, how many versions, and when did you last restore one? The third part is the real question.
- How many hours of changes are included, and what is the rate beyond that?
- What is the response time if the site goes down, and does that include out of hours?
- If we leave, what do we take? Codebase, database, DNS, and whose accounts everything sits in.
That last one decides whether you have a supplier or a landlord. If the hosting account, the domain and the repository are all in their name, leaving is a negotiation rather than a decision.
What You Can Reasonably Do Yourself
- Test your own contact form monthly. Send one. Confirm it arrives. This takes a minute and catches the most costly failure on the list.
- Keep a note of renewal dates — domain, certificate, licences. Diary them a month early.
- Check your own site on a phone occasionally, on mobile data rather than office wifi.
- Watch Search Console coverage once a month for a spike in errors. It is free and it is the earliest warning you get.
Leave the security patching, the upgrades and the restore testing to whoever maintains it. Those are the parts where being wrong is expensive, and where doing it properly needs someone who does it often. See UK web development for how we structure it, and redesigning without losing SEO for when maintenance turns into a rebuild.
Frequently Asked Questions
What does website maintenance include?
Seven jobs: security updates to the platform and its plugins, automated off-site backups that get restore-tested, platform and dependency upgrades, uptime monitoring, periodic performance checks, checks on broken links, forms and integrations, and content changes. The first three are the genuinely necessary ones.
How much does it cost to maintain a website?
It depends on the platform, how much of the retainer is hosting, and how many hours of changes are included — which is why two quotes at the same price often describe very different work. Ask every supplier the same six questions about hosting spec, patch testing, backup restores, included hours, response times and what you keep if you leave.
What happens if I do not maintain my website?
The failures are sudden rather than gradual: compromise through an unpatched known vulnerability, discovering the backup does not restore on the day you need it, a routine upgrade becoming a rebuild, a contact form silently stopping, or a certificate expiring and browsers warning visitors away.
Is website maintenance the same as hosting?
No, though they are often billed together in a way that hides the split. Hosting is where the site runs. Maintenance is the work of keeping it secure, current and functioning. If a retainer is mostly hosting, it should cost roughly what hosting costs — ask for the split.
How often should a website be updated?
Security patches as soon as they are released and tested. Platform major versions on a planned schedule rather than when forced. Performance and link checks quarterly for a stable site, monthly if it changes often. Content whenever the content is out of date, which is a business decision rather than a maintenance one.
Want a straight answer on your own site?
Book a free strategy call. We look at what you have, tell you what is worth changing and what is not, and the audit is yours to keep either way — including the times the answer is that your site is fine.
Book a Free Strategy Call