What Website Maintenance Actually Involves

Nobody notices maintenance when it's done well, which is exactly why it gets cut from budgets. Picture a company whose contact form quietly stopped sending email in spring. Enquiries kept "arriving" on the visitor's side, a polite thank-you page appeared every time, and nothing reached the inbox for months. Nothing was hacked. Nobody was careless on purpose. Nobody was looking.

Short answer: Website maintenance is the recurring work that keeps a site secure, fast, backed up and working. In practice that means software updates, security checks, backups you've actually tested restoring, uptime and contact form monitoring, domain and certificate renewals, and regular performance and search checks. For a typical business site, some of it happens weekly, more of it monthly, and the rest once a quarter or once a year.

Why does a website need maintenance at all?

Because a website isn't a printed brochure. It's software running on a server, talking to other software, and all of that keeps moving even when your content doesn't.

PHP versions stop receiving security fixes a few years after release. Frameworks and plugins publish updates, some of them security patches. Payment gateways and other third-party services change their APIs. Browsers change how they handle cookies, fonts and forms. Even a site that never changes a word of text can break simply because the ground under it shifted.

Then there's the human side. Staff leave but their admin accounts stay. Pages go stale. A promotion that ended in January is still on the homepage in July. A site that looks abandoned makes visitors wonder if the business is.

What should happen every week?

Weekly work is mostly looking, and it should take minutes, not hours.

• Confirm the site is up from outside your own network, ideally with an uptime monitor that alerts you by email or message instead of relying on someone to notice.
• Submit your own contact form and check that the message arrives. Do the same for any order or booking flow.
• Check that last night's backup actually ran, and that its size is sensible.
• Read security alerts from your hosting provider, your CMS or framework, and your monitoring tool. Apply critical security patches promptly rather than waiting for the monthly round.

If you only do one item on this list, make it the form test. A broken form is the most common silent failure we can think of, because everything on the site looks fine.

What should happen every month?

Monthly is where updates happen. Update the framework or CMS, plugins and packages, but do it in a copy of the site first when the site matters to your revenue. Check the pages that matter after the update: forms, checkout, login, search, the language switcher on a bilingual site.

Also review the numbers that point to hidden problems. Search Console will tell you about pages that dropped out of the index, new 404 errors and mobile problems. Your analytics will show whether visits to key pages suddenly fell. A speed test on the homepage and one deep page every month catches the slow creep that comes from adding one more script at a time.

Finally, look at who has access. Every admin account is a door. Remove people who've left, and check that whoever still has access uses a strong, unique password, and two-factor sign-in wherever it's offered.

What belongs in the quarterly and yearly checks?

Some jobs are too slow-moving for the monthly list but too important to skip.

• Restore a backup into a test environment. A backup you've never restored is a hope, not a plan. Quarterly is a sensible rhythm for a business site.
• Check renewal dates for the domain, hosting, SSL certificate and any paid services. Free certificates such as Let's Encrypt renew every 90 days, normally by themselves, and the failure mode is automatic renewal silently stopping. Domains lapse yearly, and a missed renewal can take your website and your email down at the same moment.
• Review the PHP version and server software. Move to a supported version before the old one stops getting fixes.
• Audit the content. Prices, team members, addresses, opening times, outdated claims, old case studies, links that now lead nowhere.
• Review privacy and consent. If you added new tracking tools or forms during the year, the privacy page and cookie notice must match what the site actually does.

What does a good backup setup look like?

Most people ask "do I have a backup?" The better question is "can I get my site back, and how long would it take?"

A solid setup follows the old three-two-one idea: three copies of your data, on two different kinds of storage, with at least one copy somewhere else entirely, away from the server. The backup must include the database and the uploaded files, because losing either one leaves you with a half site. Frequency should match how often the content changes. A brochure site that changes monthly can live with daily backups. A store taking orders all day needs the database backed up much more often.

A backup stored only on the same server as the site doesn't count. If the server fails, gets hacked or is shut down, both disappear together. Shared hosting backups can help, but treat them as a bonus, not as your plan.

Does the platform change the workload?

Yes, and it's worth knowing before you choose. A WordPress site tends to carry more moving parts: the core, a theme, and often a dozen or more plugins, each one with its own update schedule and its own security record. That isn't a reason to avoid WordPress, since many business sites run on it happily. It means maintenance there is mostly about keeping plugins current and removing the ones you don't use.

A custom Laravel site has fewer third-party pieces, so there's less to update, but the updates that do exist need someone who can read code and test the result. Our comparison of Laravel and WordPress goes into where each approach costs you time. Either way, the work needs to be assigned to a person, not to "whoever has a minute".

Who should do it, and what should it cost?

You have three real options: someone on your team, the studio that built the site, or a hosting plan that includes managed care. The right one depends on how much the site matters to revenue. A small informational site can be looked after by a technically comfortable staff member with a checklist like this one. A store or a custom system needs a developer who knows the code.

Whoever does it, ask for the scope in writing. What's checked and how often, how fast they respond to an urgent problem, what counts as a small fix and what counts as new work, and where reports go. We don't put prices in a blog post because they depend on the size and risk of the system, but the right question to ask any provider is "what exactly do I get each month?"

None of this works unless you can actually get in. Make sure you hold the hosting login, the domain account, the admin access and the documentation, which is the same point we make in who owns the code of your website. On our side, a Full Platform project includes three months of support after launch, and ongoing maintenance is available for custom and SaaS work.

Frequently asked questions

How often should I update my website's software?

Apply security patches as soon as you can after they're released, and run a regular update round once a month. Test the important paths after each update, and keep a copy of the site to roll back to.

How do I know my backups really work?

Restore one. Put a recent backup into a separate test environment and open the site, log in, and place a test order or submit a test form. Do it at least quarterly. Until you've done it once, you only know the backup file exists.

Is maintenance necessary if my site has no login or shop?

Yes, though the list is shorter. The hosting, PHP version, SSL certificate, domain renewal and contact form still need attention, and a static-looking site can still be a target if its software is out of date.

Make it someone's job

If your site is already live and you aren't sure who is watching it, start with the weekly list above and put the renewal dates in a calendar today. If you want a clear maintenance scope for a custom build, talk to us or look at how our projects are delivered and supported.