Website Maintenance: What It Actually Involves
Website maintenance is the work that keeps a site secure, current and working after launch. It is invisible when it is done and extremely visible when it is not — usually as an outage, a compromise or a form that has been silently failing for a month.
This guide covers what maintenance actually includes, what it costs, what a retainer should specify, and how to verify you are receiving it.
What the work is#
Maintenance splits into routine work on a schedule and responsive work when something happens. A retainer that only covers the second is not maintenance, it is support.
| Area | Frequency | Why |
|---|---|---|
| Security patches | As released, within days | Known vulnerabilities are exploited automatically |
| Platform and plugin updates | Monthly, tested on staging | Falling behind makes upgrading harder every month |
| Backup verification | Monthly restore test | An untested backup is not a backup |
| Uptime monitoring | Continuous | You should not learn about downtime from a customer |
| Error log review | Weekly | Silent failures — broken forms, failed payments |
| Performance check | Monthly | Page weight rises quietly as content is added |
| Broken link check | Quarterly | External links rot at a steady rate |
| Content review | Quarterly | Stale prices and dead phone numbers cost more than bugs |
| Dependency audit | Quarterly | Abandoned libraries need replacing before they break |
What it costs#
A useful planning figure is 10–20% of the build cost per year for a CMS-based site, more for a store or an application. Below that you are usually buying availability rather than actual work.
| Site type | Typical monthly | Includes |
|---|---|---|
| Small brochure site | $50 – $200 | Updates, backups, uptime monitoring, minor edits |
| Mid-size business site | $200 – $800 | The above plus staging tests, performance and error review |
| Online store | $500 – $3,000 | The above plus payment and stock monitoring, faster response |
| Web application | $1,500+ | The above plus release management and on-call |
A cheap retainer with no report is difficult to distinguish from no retainer at all. The report is what you are actually buying.
What a retainer should specify#
Vague retainers cause disputes at exactly the wrong moment. These points should be written down before you sign.
- Exactly which routine tasks are performed and how often.
- Response time targets, split by severity: site down, feature broken, cosmetic.
- Cover hours, and what happens outside them.
- How many hours of changes are included, and whether unused hours roll over.
- What counts as a change versus a new project, with examples.
- Who has access to what, and how that is revoked when the arrangement ends.
- What you receive monthly: an actual report, not an invoice.
- Notice period and what happens to your data and access at the end.
Doing it yourself#
For a small site this is entirely reasonable, provided it is scheduled rather than intended. Put it in a calendar with a named owner, because maintenance done "when we remember" is not done.
- Weekly: check the site loads, submit the contact form, glance at error logs.
- Monthly: apply updates on staging first, then production. Verify a backup restores.
- Monthly: check Search Console for new coverage errors and manual actions.
- Quarterly: run a link checker, a performance test and an accessibility scan.
- Quarterly: review content for prices, dates, staff names and dead links.
- Annually: review domain and certificate renewals, and audit who still has access.
Set calendar reminders with a named person, not a team. Shared responsibility for a recurring chore reliably becomes nobody’s responsibility.
Frequently asked questions
What happens if I skip maintenance?
For a while, nothing visible — which is why it gets skipped. Then one of three things happens: a known vulnerability is exploited by an automated scanner, an update becomes impossible because you are several major versions behind, or something has been broken for weeks and nobody noticed. All three cost more than the maintenance would have.
Can I use my hosting provider’s maintenance package?
Managed hosting usually covers the server, and often core platform updates and backups. It rarely covers your plugins, your custom code, your error logs or your content. Read what is included; the gap between "managed hosting" and "site maintenance" is where most incidents happen.
How do I know maintenance is being done?
Ask for a monthly report: what was updated, what was patched, uptime, errors found and fixed, and the date of the last successful backup restore. If a retainer produces no report, you cannot distinguish good maintenance from none — and you usually find out which it was during an incident.
Should updates be applied automatically?
Security patches for the core platform, generally yes — the risk of delay usually exceeds the risk of breakage. Plugin and major version updates should be tested on staging first, because those are the ones that break layouts and custom code. The right split depends on how much the site is worth per hour of downtime.
website maintenancewebsite maintenance costmaintenance retainerwebsite updateswebsite backupssite monitoring
