What Does Website Maintenance Actually Include?
Website maintenance is one of those line items nobody explains before invoicing it. Here is what the work actually consists of, and how to tell if yours is happening.
"Website maintenance" is one of those phrases that appears on an invoice long before anyone explains it. It sounds like tidying. It sounds optional. And because the work is invisible when it goes well, the natural assumption is that nothing is being done.
Here is what the job actually consists of, so you can tell whether yours is happening — and decide honestly whether you need somebody doing it.
Why a website needs anything at all
A website is not a printed brochure that sits still. It is software, running on a server, connected to the internet, built out of parts that other people keep changing.
Your site's platform releases updates. So does every plugin and theme on it. So does the language it runs on. Many of those updates exist specifically because somebody found a way to break in, which means the gap between an update being published and you applying it is a published description of how to attack your site.
Meanwhile the certificate expires, the backups may or may not be running, and the forms quietly stop sending because a mail setting changed somewhere upstream.
Nothing here is exotic. It is the ordinary entropy of anything connected to the internet.
The actual job, in six parts
Updates, applied carefully. Platform, plugins, themes. The care matters more than the updating — an update that conflicts with something can take a site down, which is why this is done with a restore point in hand and a look at the site afterwards rather than by clicking a button and walking away.
Backups that are verified. Taken daily, stored somewhere other than the server itself, covering both files and database, with enough history to reach back past a problem nobody noticed for a fortnight. And checked, because backups fail silently by nature.
Security watching. Failed login attempts, unexpected file changes, a firewall in front of the site. The realistic threat to a small business site is not a targeted attack; it is an automated one that tries every site it can find for a known weakness.
Certificate and uptime. Renewing the certificate before it lapses, and knowing the site is down before a customer tells you.
Performance. Caching, image sizes, the accumulated weight of five years of plugins. This is the part that most affects whether visitors stay.
Someone to ask. The genuinely useful part, and the hardest to itemise. A form breaks, a page looks wrong on a phone, an email says your site has been flagged for something. Maintenance is largely the answer to "who do I send this to."
How to tell whether yours is happening
Four questions. Ask whoever currently looks after the site — or yourself, which is often the real answer.
- When were the plugins last updated? If nobody knows, that is the answer.
- How far back do the backups go, and has one ever been restored?
- When does the certificate expire, and does it renew on its own?
- Who finds out first when the site goes down?
You can settle two of those in about a minute without asking anyone. The Tune-Up grades your domain across mail authentication, certificate, blocklists and security headers in one report. The Hosting Checker tells you who is actually hosting the site, which is worth knowing if the answer is currently vague. Both are complimentary and neither wants a signup.
What it is not
Two honest caveats, because this phrase gets stretched.
Maintenance is not redesign, and it is not new pages. A maintenance arrangement keeps the site you have working. Changing what it says or how it looks is separate work, and anyone bundling the two is likely doing neither properly.
And maintenance does not make a site immune. It makes it current, backed up and watched — which turns most incidents from disasters into a restore and an afternoon. That is a real promise. "Nothing will ever go wrong" is not one anybody can make.
Do you actually need to pay for it?
Sometimes not, and it is worth saying so.
If your site is a handful of static pages, does not take payments, does not collect personal information, and lives on hosting that handles the platform for you, the honest maintenance requirement is close to zero. Not everything needs a monthly arrangement.
You need somebody on it when the site takes money, holds customer data, runs a booking or membership system, carries meaningful search traffic, or when its going down for two days would cost you real business. If two or more of those are true and nobody is currently doing the six things above, that is a gap rather than a preference.
Where this sits with us
The position we take is that most of this should not be a line item at all. It should just be running.
On our hosting, from $10 a month, daily backups with one-click restore, auto-renewing SSL, server-level firewall and brute-force protection, and a managed CDN are included rather than sold on top. The uptime commitment is 99.9%, backed by service credits, and there is a public status page you can check yourself rather than having to ask anyone.
The pricing does not change at renewal either, which is relevant to this subject specifically: the reason so many sites go unmaintained is that the maintenance arrangement got cancelled when it got more expensive, and then nobody did the work.
One thing to do this week: run the Tune-Up on your own domain and read the findings. It is the fastest way to convert "I think someone is looking after it" into a list you can either action or hand to somebody.