Most businesses pay something monthly for their website and could not say precisely what it buys. Sometimes it is a genuine maintenance arrangement. Sometimes it is hosting with a friendly name.
Here is what the term should mean, and how to find out what yours actually covers.
The non-negotiable parts
Updates, applied and tested
Website software receives security updates continuously. Applying them is the single most important maintenance task, and the one most often deferred because an update once broke something.
"Applied and tested" is the phrase that matters. Auto-updating a plugin and never loading the site afterwards is not maintenance — it is a scheduled risk. A real arrangement updates on a staging copy, checks the pages that matter, then applies to the live site.
Backups that are held elsewhere and have been restored
Backups stored on the same server as the site are not backups. If that server is compromised or fails, both copies go.
The question worth asking is not whether backups exist but when one was last restored. An untested backup is a hypothesis. We make the argument at length in backups that actually restore.
Monitoring
Uptime monitoring so somebody knows the site is down before a customer tells you. Ideally also certificate expiry monitoring, because an expired SSL certificate produces a full-page browser warning that stops traffic dead, and it is entirely preventable.
Someone accountable
A named route to a person who will act when something is wrong, with a stated response time. This is what you are really buying, and it is the part least often written down.
The parts worth having
Security hardening and scanning. Login protection, file change detection, and a check against known malware signatures.
Performance checks. Sites slow down as content accumulates. A quarterly look at image weight and script count prevents the slow drift covered in why your website is slow.
Broken link and form checks. Contact forms fail silently more often than anyone expects — a mail server change, an expired API key, a spam filter. Testing your own enquiry form monthly is a five-minute job that has saved businesses months of missing leads.
A short report. What was updated, what was found, what needs attention. Not a dashboard nobody reads — a few lines a month.
What is usually not included
Be clear about this before you assume otherwise.
- Content changes. New pages, edited copy, uploaded photographs. Often charged separately or capped at a small monthly allowance.
- Design changes. Anything that alters layout rather than text.
- New functionality. A booking system, a new integration, a members area.
- SEO work. Maintenance keeps the site running; it does not improve rankings.
- Recovery from a compromise. Some plans include clean-up, many do not. Worth knowing in advance rather than during.
Hosting keeps the server running. Maintenance keeps the site working. Businesses conflate the two and discover the difference at the worst possible moment.
Questions that reveal what you have
Ask your current supplier these five. The answers are more informative than any list of features.
- When were the last software updates applied, and how were they tested?
- Where are backups stored, how far back do they go, and when was one last restored?
- If the site goes down at 4pm on a Friday, who do I contact and what response time am I entitled to?
- If the site is compromised, is the clean-up included?
- Do I have access to the hosting account and the code, or do you hold them?
That last question matters disproportionately. A maintenance arrangement you cannot leave is not a service, and it is covered properly in who owns your website.
The false economy
Businesses cancel maintenance because nothing has gone wrong. Nothing going wrong is what maintenance produces, so this is a little like cancelling insurance on the grounds of never having claimed.
The realistic downside is not an inconvenience. An unpatched site that gets compromised typically means emergency clean-up, a period of downtime during trading, a Google security warning shown to visitors, and a recovery of search visibility that takes months. That cost dwarfs several years of a maintenance fee.
Our maintenance team covers updates, tested backups, monitoring and a named contact for UK businesses, with the exclusions written down rather than implied. Ask us what your current plan covers — we will tell you honestly, including when it is fine as it is.
