Website Maintenance

Website maintenance is the ongoing work that keeps a website safe, working and current after it launches. For a typical small business site, that means updating the software, watching for security problems, keeping backups you can actually restore, checking that the site stays online and loads quickly, and making the content and small changes the business needs. A site is not finished on launch day. It is a piece of software sitting on a server connected to the internet, and both the software and the internet keep changing around it.

The real question for most owners is not whether the site needs maintenance, but who does it and what that person should be responsible for. This guide walks through what maintenance covers, what tends to happen when nobody does it, how to decide between doing it yourself and paying for it, what to ask a provider, and why the site and its accounts should always stay in your name. Each part links to a more detailed article if you want to go deeper.

What website maintenance covers

Maintenance is easier to judge when you break it into its parts. Some tasks are weekly, some monthly, some yearly, and a few only matter when something goes wrong. Here is what a complete arrangement includes, whether you do it yourself or pay someone.

Software updates

On WordPress, there are three layers to keep current: WordPress core, the theme, and the plugins. WordPress applies minor core releases (maintenance and security fixes) automatically on most sites by default, but major versions, themes and plugins are a different story. Plugin and theme auto-updates have been available since WordPress 5.5, yet they are off by default and have to be switched on one by one. Updating is not only clicking a button; it means checking afterwards that forms still send, pages still look right and checkout still works.

The server software matters too. WordPress.org currently recommends PHP 8.3 or greater, and the PHP project stops security support for each version on a published schedule. PHP 8.2, for example, receives security fixes only until December 31, 2026. A site that has not had its PHP version reviewed in years is often running on software that no longer gets security patches.

Security

Security work is mostly prevention: updates, strong passwords, two-factor login for administrators, removing plugins and user accounts nobody uses, and watching for signs of trouble. It also includes knowing what to do if the site is compromised, and having a clean backup to return to.

Backups

A backup is a copy of your site’s files and its database stored somewhere other than the server it runs on. The WordPress documentation suggests weekly backups for smaller sites with few changes and daily backups for busy sites, with copies kept in more than one place. The part that gets skipped most often is testing that a backup can be restored. A backup you have never restored is a hope, not a plan. Our article on website backup explains how to set this up properly.

Uptime monitoring

Uptime monitoring means a service checks your site every few minutes and alerts someone if it stops responding. Without it, the first person to notice an outage is often a customer, or nobody at all. The monitoring is cheap; what matters is who receives the alert and what they do next.

Speed and performance

Sites slow down over time as images get uploaded at full size, plugins pile up and hosting plans stay the same while the site grows. Google measures real visitors’ experience through Core Web Vitals, and its published targets for a good experience are a Largest Contentful Paint within 2.5 seconds, an Interaction to Next Paint of 200 milliseconds or less, and a Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads. Checking these a few times a year catches problems before they become noticeable.

Content and small changes

This is the part owners care about most day to day: new staff photos, updated prices, holiday hours, a new service page, a fixed typo. It also includes checking that contact forms deliver, that links still work, and that old pages with wrong information are updated or removed. Many maintenance plans include a set amount of time each month for these changes.

Accounts, renewals and records

Domains, hosting plans, SSL certificates and premium plugin licenses all renew on their own schedules. Someone needs to know when each one renews, which card pays for it, and who has the login. A missed domain renewal can take a business offline and, if nobody notices in time, can put the domain itself at risk.

What happens when nobody does it

Most neglected sites do not fail in one dramatic moment. They drift: a plugin stops getting updates, a form quietly stops sending, the site gets slower, until something breaks badly enough that someone notices.

Security is the biggest risk. Patchstack, a company that tracks WordPress vulnerabilities, reported 11,334 new vulnerabilities in the WordPress ecosystem in 2025. Of those, 91% were in plugins and 9% in themes, while WordPress core had only six, all low priority. The same report found that 46% of vulnerabilities were not fixed by their developers in time for public disclosure, and that the median time to mass exploitation for heavily exploited vulnerabilities was five hours. For an owner, the practical lesson is that the plugins you install are where the risk sits, and that unused or abandoned plugins should go.

If a site is compromised, Google can flag it. According to Google’s Search Console documentation, pages affected by a security issue can appear with a warning label in search results, or visitors can see a warning page in the browser before reaching the site. That is a hard thing to recover from with customers who were about to call you.

The quieter failures cost money too. A broken quote form can lose inquiries for weeks before anyone checks, and outdated prices or hours create awkward conversations. All of it is avoidable with a regular routine.

Doing it yourself vs paying for it

There is no single right answer here, and I would not tell every business to pay for maintenance. The decision depends on how complex the site is, how much business runs through it, and how much time and comfort you have with the work.

Situation	Doing it yourself is usually fine	Paying someone usually makes sense
Type of site	A few pages, a contact form, no store	A store, bookings, memberships or custom features
Plugins	A small number of well-known plugins	Many plugins, premium plugins, custom code
Role in the business	Occasional source of inquiries	Main source of leads or sales
Your time	You can set aside an hour or two a month	Your time is better spent elsewhere
Comfort	You are willing to learn updates and restores	You do not want to touch the technical side

If you choose to do it yourself, the work is manageable with a routine. Turn on automatic updates where it is safe, use a reputable backup plugin that sends copies off the server, set up a free uptime monitor, and block out time each month to check everything. Our website maintenance checklist lays out what to do weekly, monthly, quarterly and yearly.

If you are on a hosted builder such as Squarespace or Wix, much of the technical maintenance (software updates, server security, hosting) is handled by the platform. Your job there is mostly content, accounts and checking that forms and integrations still work. That is one of the honest advantages of those platforms, and for some businesses it is the right trade-off.

If you choose to pay, you are buying two things: the routine work, and someone accountable when something goes wrong.

What maintenance costs

Prices vary widely because “maintenance” can mean anything from running updates once a month to a team on call for a busy online store. Published guides give broad ranges. GoDaddy’s guide puts small to medium business maintenance at $50 to $500 a month, and Hostinger’s guide puts small to medium business sites at $35 to $500 a month, with professional maintenance services more broadly at $200 to $4,500 a month. Both also list freelance or developer hourly rates, from $25 to $150 an hour in Hostinger’s guide and $50 to $150 or more in GoDaddy’s.

Those totals include fixed costs you pay regardless of who maintains the site: the domain, hosting, any premium plugins or themes, and security tools. Our article on website maintenance cost breaks the numbers down and explains what drives a quote up or down.

Care plans and what they should include

Many providers sell maintenance as a monthly care plan: a fixed fee for a defined set of tasks, often with some time for content changes. Care plans make the work predictable on both sides, but they can also be vague, with phrases like “regular updates” that mean little until something goes wrong.

A good plan states how often updates run, whether they are tested, where backups are stored and for how long, how quickly someone responds to an outage or a hack, and how many minutes or hours of changes are included each month. Our guide to website care plans covers how plans are usually structured and how to compare them.

What to ask a maintenance provider

These questions separate a real maintenance arrangement from a vague promise. A good provider will answer them without hesitation, and the answers are worth having in writing.

1. How often do you update WordPress, themes and plugins, and do you check the site after each update?
2. How often do you back up the site, where are the backups stored, and how long do you keep them?
3. When did you last test restoring a backup, and will you test mine?
4. Do you monitor uptime, and who gets the alert at night or on weekends?
5. If the site is hacked, is the cleanup included or billed separately?
6. How much time for content changes is included each month, and what happens to unused time?
7. Do you review the PHP version and hosting setup, and how often?
8. What do I get when I leave: a full backup, a list of plugins and licenses, and all logins?
9. Whose name are the domain, hosting and plugin licenses registered in?

The last two questions matter more than they seem. A provider who is comfortable with you leaving is usually a provider you can trust while you stay.

Keep the site and accounts in your name

This is the part of maintenance that is not about software at all, and it is the one I would insist on. The domain registration, the hosting account, the premium plugin and theme licenses, Google Search Console, Google Analytics and Google Business Profile should all be in your name or your company’s name, paid with your card or invoiced to you, with your email address as the owner.

Your maintenance provider can still do the work. WordPress has an Administrator role, which its documentation describes as somebody with access to all the administration features within a single site, and you can give your provider their own administrator login while keeping yours. Google Search Console works the same way: you can add your provider as a user while remaining the verified owner. Google’s documentation notes that a property must have at least one verified owner, or no users will have access to it, so that verified owner should be you.

The reason is simple: providers change. If the domain is registered to a former developer, or the hosting sits under an agency’s login, changing providers turns into a negotiation instead of a handover. When everything is already yours, switching means creating one login and removing another.

Where to go from here

If you plan to do the work yourself, start with the checklist and the backup guide. If you are comparing providers, read the cost and care plan articles first. And if the site is old enough that maintenance feels like patching a leak, read about a website redesign before paying to maintain something you plan to replace.

• Website Maintenance Cost explains what owners typically pay, what is fixed versus variable, and what pushes a quote up.
• Website Care Plans covers how monthly plans are structured, what should be in one, and how to compare them.
• Website Maintenance Checklist gives a practical weekly, monthly, quarterly and yearly routine you can follow yourself or hand to a provider.
• Website Backup explains what to back up, how often, where to store copies and how to test that a restore works.

If you would rather hand the routine work to someone and keep full ownership of your site, our website management service is set up that way.