Launch day feels like the end of the project. It is closer to the start of the part nobody plans for: from the moment a site goes live it begins drifting away from the business it describes, and almost none of that drift announces itself.
Most of it is small — a renewal date, a price that changed, a form quietly posting into nowhere. Left alone for two years it adds up to a website that embarrasses you, or occasionally one that is not there at all. Here is what needs doing, how much of it you can do yourself, and how to tell a fair maintenance plan from a padded one.
Maintenance is four separate jobs
The word covers four different kinds of work, bundled together in a way that makes plans almost impossible to compare. Keeping the site online is hosting, the domain and the certificate. Keeping it safe is updating whatever software the site runs on. Keeping it working is the moving parts — forms, bookings, payments, anything wired to a service you do not control. Keeping it true is the content: whether what the site says about your business is still accurate.
They carry very different risks and costs, and your platform decides how much of each you need. Separating them is the quickest way to tell whether a monthly fee is buying you something real.
The renewals that take a site off the internet
The most complete failure — the site simply gone, replaced by a parking page or a browser warning — is usually administrative rather than technical.
Three dates matter: your domain renewal, your hosting subscription and your SSL certificate, the thing behind the padlock in the address bar. Certificates renew themselves on most modern hosting, and domains usually do too — right up until the card on file expires or the notice goes to an inbox nobody reads. A domain billed to a cancelled card is a common and entirely avoidable way to lose a website over a weekend.
Check where those notices go, once, and make sure they land somewhere more than one person can open. If you are not certain who holds the domain at all, that is a larger question worth settling first.
How much updating you need depends on what you built on
Security updates are what most maintenance plans are sold on, and the part where the honest answer varies most by platform.
- —WordPress and other self-hosted systems: core, theme and plugin updates are genuine, recurring work. Known vulnerabilities in popular plugins get scanned for automatically, and an abandoned plugin is the usual way in
- —Website builders such as Wix, Squarespace and Shopify: the platform updates itself. There is no core to patch and no plugin to fall behind, so a security plan for a Squarespace site is mostly wrapping
- —Custom-built sites: dependencies still need updating, but with no public login page and no plugin marketplace there is less to attack, and the work is periodic rather than weekly
- —Anything taking payments or holding customer accounts: treat updates as non-negotiable whatever it is built on
Backups only count if someone has restored one
Backups belong in the same conversation, because they matter most where a site can be broken from the inside — a bad update, a plugin conflict, someone editing a page at eleven at night. Two questions settle whether yours are real: how often do they run, and when did anyone last restore one to check it works? A backup nobody has ever tested is a belief rather than a safety net.
The failure nobody notices: your contact form
The most expensive maintenance failure on a small business site is also the quietest. A contact form that has stopped delivering looks exactly like one nobody is using: no error, no bounce, no alert — just a slow month you put down to the season.
It happens more often than people believe. Mail routing changes when you move email provider. An update changes how the form sends. The address it posts to belongs to someone who left. Your confirmations start landing in spam. None of that requires anyone to touch the website.
The fix is a habit rather than a product. Send yourself a real enquiry from a phone, on mobile data, once a month, and confirm it arrives in the inbox somebody actually watches. If you take bookings or payments online, push a real one through every so often too.
Things that break because somebody else changed something
A modern small business site leans on services it does not control: an embedded map, a booking widget, a chat box, a payment provider, a review feed. Each is a dependency with its own roadmap.
Those suppliers change pricing, retire features, expire keys and occasionally close down. When one does, the failure appears on your website rather than theirs — usually a blank rectangle where the booking calendar used to be. Nothing on your side changed, which is precisely why it can sit there for months.
Analytics is the same story from the other direction: tracking code is the most common casualty of a site edit, and losing it costs nothing today and everything on the day you want to know what worked last year.
Content decay costs more than it looks
The unglamorous majority of maintenance is not technical at all. Opening hours that changed. A price list from two years ago. A service you no longer offer, on the page that still ranks for it. A team page listing someone who left last year.
None of it breaks anything, and all of it does the same quiet damage: it tells a visitor that nobody is home. Worse, when the hours or the prices are wrong you still get the enquiry, and then you have to correct it — which costs more goodwill than never receiving it would have.
It is also the part you are best placed to do yourself, because it needs knowledge of the business rather than of the site. If your website cannot be edited in-house without an invoice, fix that before you buy a plan to work around it.
A twenty-minute check you can do yourself
Once a month, in roughly this order:
- —Open the site on your own phone, on mobile data rather than the office wi-fi, and click through the pages a customer would use
- —Send a real enquiry through the contact form and confirm it arrives where someone will see it
- —Check the padlock is showing and that no browser warning appears on any page
- —Read your opening hours, prices, services and team details, and fix whatever is now wrong
- —Click every link in the main navigation and the footer, including the ones to your social accounts
- —Load anything embedded from elsewhere — the map, the booking calendar, the review feed — and confirm it still appears
- —Glance at Google Search Console for new errors, and check your Google Business Profile still matches the site
When a plan is worth paying for, and when it is not
A five-page brochure site on a managed platform, changed twice a year, may genuinely not need a monthly arrangement. If someone will do the check above and the platform handles its own updates, a plan is buying reassurance rather than work.
A plan earns its keep when the site is self-hosted and carries plugins, when it takes payments or bookings, when downtime costs you money the same day, or when nobody in the business will realistically do any of it. That last one is the most common honest reason, and there is nothing wrong with it.
Be wary, too, of a plan made mostly of monitoring. Uptime checks, an automated scan and a monthly PDF report cost a supplier almost nothing and change nothing about your site. The part with real value is time — someone who will make the change you ask for, this week, without a separate quote.
When you compare plans, ask what is actually inside them:
- —What the fee covers and what is billed on top, small content edits in particular
- —How quickly something broken gets looked at, and how you report it outside working hours
- —Where backups are kept, how far back they go, and whether a restore has been tested
- —Whether the hosting, domain and accounts are in your name or the supplier's
- —What happens to the site if you cancel, and how much notice you have to give
How we handle it
Every site we build launches with hosting, SSL, backups and uptime monitoring in place, and is built so the content you change most often can be changed without us.
If you want us to look after it afterwards, that is a month-to-month arrangement — 30 days' notice, no minimum term — and the site, the code, the domain and the accounts are in your name from day one, so leaving is a handover rather than a negotiation.
If somebody else built your site and you are not sure what state it is in, we are happy to run the checks above and tell you plainly what we find. Often the answer is a renewal date to sort out and an afternoon of content updates rather than a monthly fee, and we would rather say so.