Do you need a website maintenance plan?

What a website maintenance plan actually covers

A website isn't a brochure you print once and forget. It's software that keeps running on the internet, made of parts that change underneath it: the platform it's built on, the plugins or apps bolted onto it, the server it sits on, and the security certificate that keeps it on HTTPS. Left alone, a site doesn't stay exactly as you launched it. It slowly drifts out of date, and the gap between "live" and "looked after" is where most problems start.

Maintenance is the work that keeps what you already have secure, backed up and working. It's worth separating that from new work, like adding pages, redesigning a section or building a new feature, which is a project with its own scope and cost. Mixing the two is how a simple "can you just update this" turns into a surprise bill, so it helps to know which side of the line a request sits on before you agree to it.

For a small business, a sensible plan doesn't need to be elaborate. It covers a handful of things that genuinely matter: security updates, backups you can actually restore, the certificate and uptime that keep the site reachable, the enquiry form still landing in your inbox, and the small content edits you'll want along the way. The rest of this guide walks through each one, then helps you decide who should do it.

Keep the software patched

The single most important reason to maintain a website is security. Most sites run on software that other people maintain, and over time flaws are found in that software. The fix is a patch, an update the vendor releases to close the hole. Applying those updates promptly is not busywork. Australia's cyber security agency puts it plainly: "Applying patches to applications and operating systems is critical to ensuring the security of systems."

The catch is timing. Once a flaw is public, it's public to attackers too, and automated tools scan the web looking for sites that haven't updated yet. That's why an out-of-date plugin or an old platform version is a common way small sites get defaced or hijacked to send spam. Keeping things current, and removing plugins and add-ons you no longer use, closes off most of that risk before anyone tries the door.

No plan makes a site unhackable, and honest maintenance doesn't promise that. What it does is keep you on supported, patched versions, so you're not the easy target left behind while everyone else has moved on. If you can't stay on top of updates yourself, that's the first thing a maintenance arrangement should take off your plate.

Back it up, and test the restore

Updates can go wrong, servers fail and mistakes happen, so a maintenance plan needs a way to put things back. That's what backups are for. The same agency's advice is simple: "Backing up and having backups mean you can restore your files if something goes wrong," and "We recommend backing up your files regularly."

Two details make a backup actually useful. First, keep it somewhere separate from the live site, so a problem on the server doesn't take the backup down with it. Second, and this is the part people skip, test that you can restore from it. A backup you've never restored is a hope, not a safety net, and the worst time to discover it's broken is the day you need it.

How often to back up depends on how often the site changes. A brochure site that barely moves might be fine with a weekly copy, while a site with regular bookings, orders or new content wants something more frequent. Whoever holds the backups, make sure your business can get to them; backups locked inside an account you can't reach aren't much use if you ever part ways with the person who set them up.

Keep readingKeep the logins and backups in your own name

Certificates, uptime and forms that still work

Some upkeep is about keeping the site reachable and trustworthy rather than changing anything on it. The clearest example is the security certificate that shows the padlock and keeps your address on HTTPS. These certificates are deliberately short-lived and getting shorter, which is exactly why renewal should be automated rather than left to memory. Let's Encrypt, which issues a large share of the web's certificates, explains it chose "90-day lifetimes for our initial offering because ninety days was short enough to strongly encourage automation, but long enough to make it possible to do things manually," and notes that "Once certificate management is automated, shorter lifetimes aren't any less convenient than longer ones." A lapsed certificate throws a scary browser warning that turns visitors away, so this is one to set up properly and check.

It's also worth knowing when your site is down. You don't need anything fancy: a free uptime monitor that pings the site and emails you if it stops responding is enough to hear about an outage from a tool rather than from a customer. The point of maintenance is to find these things before they cost you an enquiry.

The most business-critical check is the quietest one: is the enquiry form still working? Forms break in ways that leave the page looking perfectly fine, so a message can vanish without any error a visitor would see. Send yourself a test enquiry now and then, and after any change to the site, to confirm it still lands where it should. A site that looks great but silently swallows leads is worse than no site at all.

Small edits, and staying fast

Beyond keeping the lights on, most sites need a steady trickle of small content changes: updated prices, a new service, current opening hours, a fresh photo, a fixed typo. None of these is a redesign, but they add up, and a site whose details have quietly gone stale reads as a business that isn't quite paying attention. Agreeing up front what counts as a routine edit, versus new work, saves friction later.

Performance is the other thing that drifts. Sites tend to get slower over time as images, plugins and third-party scripts pile up, and speed affects whether visitors stick around long enough to enquire. A light, regular check keeps that in hand rather than letting it creep until the site feels sluggish and you're wondering why enquiries dropped off.

This is also a good moment for the small housekeeping that keeps a site tidy: fixing broken links, clearing out plugins you no longer use, and making sure images are sized sensibly. Individually minor, together they're the difference between a site that feels cared for and one that feels abandoned.

Keep readingKeep your site fast after launch

DIY, fix-it-when-it-breaks, or a managed plan

There are really three ways to handle all this, and the right one depends on your time, your platform and how much the site matters to your enquiries. Doing it yourself works if you're comfortable with the platform and will genuinely keep up with updates and backups. "Fix it when it breaks" feels cheaper but usually isn't, because the breakage often arrives as a security incident or lost leads rather than a tidy scheduled task. A managed plan hands the routine work to someone who does it on a schedule, for a monthly fee.

If you go the managed route, the value is in the details being clear, not in the label "maintenance." Before you sign a retainer, get these in writing:

• What's actually included: updates, backups, uptime monitoring, security checks, and how many content edits per month.
• Response times: how quickly they act on a routine request versus something urgent, like the site being down.
• Who owns the logins, domain and backups. These should stay in your name, so you keep control if you ever move on.
• Where content edits stop and new work starts, so a "quick change" that's really a new feature is priced honestly.
• What you'd get if you leave: an export or handover of the site, its content and its backups, without a fight.