Website maintenance
Technical website maintenance covers updates, backups, monitoring and fixing problems. Content, development and SEO can also be part of the package, but only if they are explicitly agreed. The monthly price depends mainly on the platform, the integrations, the amount of checking involved and the agreed response time.
In short
- Technical maintenance covers three things: updates and security, backups, and monitoring with a response when something breaks. New pages and features are usually separate work unless they are agreed as part of the package.
- A backup that has never been restored in a test is unverified. What matters is not whether a backup exists, but whether a working site can be brought back from it.
- An online store with payments and integrations usually costs more to maintain than a company website with the same number of pages, because there are more points where something can break.
- PHP 8.2 stops receiving security fixes on 31 December 2026. A site still running PHP 8.1 or older already has no such fixes.
Contents
- What technical maintenance includes
- Outside maintenance: development, content and SEO
- Retainer, hours or one-off work
- What drives the monthly price
- When nobody maintains the site
- How to check what you are getting
- Frequently asked questions
What technical maintenance includes
Technical maintenance keeps the site working, secure and recoverable. Each of the three tasks below has a clear result you can check, and that is what separates it from a vague promise to “look after the site”.
Updates and security
The content management system, the theme and every plugin receive updates, and some of them close security holes. Updating is not a single click: a backup is taken, the update is applied, and then someone checks that forms, payments and the main pages still work. This also covers the PHP version on the server, which ages regardless of the site itself.
On an online store, updates go to a test copy of the site first. A payment or delivery plugin that breaks after an update stops orders. Without a check after the update, the problem can go unnoticed until the first customer complaint. A test copy is usually a small extra cost compared with the risk of orders stopping.
Backups and recovery
A backup should include both the files and the database, be stored away from the site's server and keep several versions. If the site and its only backup sit in the same environment, a shared outage or breach can affect both, so ask for a copy in independent storage. Good maintenance restores a backup to a test address at least once every few months, to confirm that it actually works.
The frequency depends on how much data you can afford to lose. If a store cannot lose the orders from the last 24 hours, the database has to be backed up more often than once a day. A company website that changes once a month can be backed up weekly.
Monitoring and response
Monitoring checks at short intervals whether the site responds and when the certificate and the domain expire. When the site goes down, someone should get an alert and respond within an agreed time, rather than the owner hearing about it from a customer. Continuous website monitoring is what makes a timely response possible: without it, problems are found only when someone happens to notice them.
Outside maintenance: development, content and SEO
Anything that adds something new to the site is usually separate work, unless it is explicitly included in the package. This is where misunderstandings can arise, because “maintenance” sounds like “everything to do with the website”.
- New pages, sections and features are development.
- Writing and updating text, images and products is content.
- Work on search rankings is SEO.
- Campaigns in Google and on social media are advertising.
Training is a separate matter. If you know how to change a text, an image or a price in the admin panel yourself, you do not pay for every small change or wait for the provider to make it. A short training session when the site is handed over can save many small orders.
Some packages include a few hours of small changes each month, such as updating a phone number or uploading a document. That is convenient, as long as the contract states how many hours are included and what happens to unused ones: whether they roll over to the next month or expire.
Retainer, hours or one-off work
A monthly retainer suits a site that generates enquiries or sales. Paying per task is an option for a site with few technical dependencies, provided updates, backups and monitoring are already covered some other way. Prepaid hours sit in between.
| Criterion | Monthly retainer | Prepaid hours | Per task |
|---|---|---|---|
| Predictable cost | Yes | Yes, until used up | No |
| Regular updates and backups | As per the contract, ask for them to be included explicitly | If requested | Only when ordered |
| Response time when the site is down | Agreed | Usually agreed | No guaranteed time |
| Suitable for | Online store, site with forms and integrations | Company website with occasional changes | Site with few technical dependencies |
If the site earns money, paying per task becomes expensive the moment something breaks, because the repair turns into an urgent job. The provider first has to understand how the site is built, then find the cause, and only then fix it. Under a retainer, the first step has already been done.
What drives the monthly price
The monthly price depends mainly on the platform, the integrations, the amount of checking involved and the agreed response time. The number of pages alone is not a reliable guide: a hundred pages built on one template may need fewer checks than ten pages with different plugins.
- Platform and plugins. A WordPress site with thirty plugins needs more checks after every update than the same site with five.
- Payments and integrations. Connections to stock management, couriers, accounting or a payment provider mean more points to check after every change.
- Response time. A one-hour response on working days and a one-hour response around the clock are different services at different prices.
- Hosting. If hosting is included in the package, the price is higher, but responsibility sits in one place.
Check whether a low price includes testing after updates, monitoring and a response when something goes wrong. Automatic updates alone do not cover these tasks: the updates run, but nobody checks whether the form still sends and the basket still works.
To compare two offers, bring them to an annual figure and the same scope. Multiply the monthly fee by 12 and note what it covers: how often backups are taken, the response time, how many hours of changes are included and whether hosting is included. For hourly billing, multiply the expected number of interventions by their average length in hours and by the hourly rate. Add any surcharges for urgent work, licences and other costs outside the service. A lower price may simply reflect a narrower scope, so compare the amounts only after you have aligned what is included.
Maintenance is one of the running costs after launch, alongside hosting, the domain and content. How these costs are spread over the first year is covered together with the cost of building a website, because the two are planned in one budget.
When nobody maintains the site
A site without maintenance rarely stops all at once. It ages quietly until one day a form, a payment or the whole site stops working, and the repair has to be done urgently.
- Outdated PHP. According to the official PHP support schedule, version 8.1 has received no security fixes since the end of 2025, and 8.2 stops receiving them on 31 December 2026. Moving to a newer version often requires plugin updates as well.
- Vulnerable plugins. An outdated plugin is one possible way in for an attack. The system, the theme, access credentials and the server environment need checking too.
- Silent failure. The enquiry form stops sending emails and nobody notices for weeks, because the site looks fine.
- Expired certificate or domain. The browser shows a warning and visitors leave before they see anything. For publicly trusted TLS certificates issued from 15 March 2026 the maximum validity is 200 days, for those issued from 15 March 2027 it is 100 days, and from 15 March 2029 it is 47 days. Renewal has to be automatic, and expiry has to be monitored.
When the platform is so old that every update breaks something, a rebuild usually costs less than constant patching. There are clear signs that a website needs a redesign, and an outdated platform is one of them.
How to check what you are getting
Maintenance that leaves no trace cannot be checked. Ask for the following in the contract and in the monthly report.
- List of updates: what was updated, when, and whether it was checked afterwards.
- Backups: where they are stored, how many versions are kept and when a restore was last tested.
- Availability: how long the site was unavailable during the month and what was done about it.
- Response time: written into the contract, with a clear distinction between working hours and out of hours.
- Access: the domain, the hosting and the admin access are in the company's name, not the provider's.
- Termination: how backups and access are handed over if you change provider.
Agree the handover of backups and access when you sign. If the provider holds the domain and hosting in their own name, changing provider becomes a negotiation rather than a handover of keys.
See the terms for support and training, and check whether the offer also includes monitoring through SiteWatch, which is offered as an add-on to maintenance.
Frequently asked questions
Does a website need maintenance if it never changes?
Yes, if the site generates enquiries. The content may stay the same, but the system, the plugins and the PHP version age and need updating regardless.
Are hosting and the domain included in the fee?
It depends on the package. What matters is that the contract says so and that the domain is registered in the company's name, even when the provider renews it.
What happens when the site goes down?
The provider investigates the cause and restores service within the agreed time and scope. A backup is used when necessary, after assessing which newer data, such as orders, could be lost. Without a contract, the repair is an urgent job, and the price and timing are agreed on the spot.
Back
