What website maintenance actually involves (and why 'set and forget' fails)

“It’s been fine for years. Why would I start paying for maintenance now?”

I hear this a lot, and it’s a fair question. Your site has sat there quietly doing its job. Nothing has broken. So the idea of paying someone a monthly fee to look after something that isn’t misbehaving feels like paying for a problem you don’t have.

I want to be honest with you about what’s really going on underneath a website that “just works”, what it quietly needs, and — importantly — how to do a lot of it yourself for nothing if money is tight. By the end you’ll know what maintenance actually is, when it’s worth paying for, and how to judge any care plan (including mine) so you don’t get charged for thin air.

What a website quietly needs every month

A small business website is not a printed brochure that stays the same forever. It’s software, running on a computer somewhere, connected to the internet. Software needs looking after. Here’s what that means in practice.

Updates, done carefully

Most small sites run on something like WordPress, plus a handful of add-ons (plugins) and a theme that controls how it looks. All of these release updates — sometimes to add features, very often to fix security holes that attackers already know about.

Here’s the part people get wrong: updates need to be applied carefully, not blindly. There’s a setting that auto-updates everything the moment a new version appears. It sounds convenient, and for small things it’s usually fine. But a bad update can break your site — a plugin update stops playing nicely with your theme, and suddenly your contact form vanishes or your homepage shows an error. If that happens automatically at 3am and nobody’s watching, your site can be broken for days before you notice.

Doing it properly means backing up first, updating one thing at a time, and checking the site still works after each one. Tedious, yes. But that’s the actual work.

Backups that are actually tested

Nearly everyone has “backups” in the sense that their hosting company mentions them somewhere. Very few people have ever checked that those backups can actually be restored.

An untested backup is not a backup. It’s a hope. I’ve seen backups that were silently failing for months, backups that only saved half the site, and backups stored on the same server as the site itself — so when the server died, the backups died with it. A real backup is one you’ve actually restored at least once, kept somewhere separate from the site, and know how to use.

Uptime and security monitoring

Monitoring just means something automatically watching your site and telling you the moment it goes down or starts behaving oddly. Without it, the first person to notice your site is offline is usually a customer — or you, days later. Basic monitoring is cheap or free and worth having.

Watching the renewals

Three things quietly expire in the background: your domain name (your web address), your hosting (the space the site lives in), and your SSL certificate (the padlock that makes browsers trust your site). If any of these lapse, your site can vanish or start showing scary security warnings — and a lapsed domain can, in the worst case, be snapped up by someone else. These renewals often sit on an old email address nobody checks. Knowing when they’re due is a genuine part of maintenance.

“It’s been fine for two years” is survivorship bias, not safety

This is the important bit, so let me be straight with you.

The reason your neglected site has been fine isn’t that neglect is safe. It’s that the failure, when it comes, is sudden rather than gradual. An out-of-date site doesn’t slowly get worse. It works perfectly right up until the exact day an attacker finds the known hole, or an update breaks something, or a renewal lapses. Then it fails all at once.

Think of it like an old, un-serviced car. It starts every morning, so it feels reliable — until the day the timing belt snaps on the motorway. It was never actually safe; you just hadn’t hit the failure yet.

“It’s been fine for two years” is the story told by every site that hasn’t been hit yet. The sites that were hit don’t get mentioned, because their owners are too busy dealing with the mess. That’s survivorship bias: you’re only hearing from the survivors. If the worst does happen, my guide on what to do in the first hour after a hack walks through the emergency steps — but the whole point of maintenance is to make that day far less likely.

What a good care plan includes — and what’s just padding

I’ll be honest: some care plans charge a decent monthly fee for very little. A “report” that’s an automated email nobody reads. “Unlimited support” that quietly excludes anything you’d actually want. Updates ticked off in bulk without anyone checking the site afterwards.

A good plan does the real work described above: careful, tested updates; backups that are genuinely tested and stored separately; monitoring that reaches a human; and someone keeping an eye on renewals. It also means that when something breaks, a real person who knows your site fixes it quickly. That’s the thing you’re really buying — not the routine tasks, but a fast, competent response on your worst day.

The honest DIY version — a monthly 30-minute routine

If budget is tight, you can do a lot of this yourself. Here’s a realistic routine that takes roughly half an hour a month. Do it with a cup of tea and don’t rush the checks.

Back up first. Before touching anything, make a fresh backup and download a copy to your own computer or cloud drive — somewhere that isn’t the website itself. If your hosting or a plugin does this, great; just make sure the copy actually lands on your device.
Update carefully, one thing at a time. Look at what updates are available. Do them one at a time, not all at once. After each single update, open your site in a fresh browser tab and check the homepage and one or two key pages still look right. If something breaks, you’ll know exactly which update did it.
Test the backup — at least occasionally. You don’t need to do a full restore every month, but do it at least once so you know you can. At minimum, open your latest backup file and confirm it’s a sensible size and not empty or an error message. A backup you’ve never opened is a guess.
Check the important things actually work. Load your site as a visitor. Then use the bits that make you money: send yourself a message through the contact form, or run a test purchase through the checkout if you sell online. Broken forms and checkouts are the most common silent failure I see — everything looks fine, but enquiries have quietly stopped arriving.
Check for security notices. Look for any warnings in your site’s dashboard about plugins that are outdated, abandoned, or have known vulnerabilities. If a plugin hasn’t been updated by its maker in a year or more, consider replacing it.
Note the upcoming renewals. Once a month, glance at when your domain, hosting and SSL are due. Put the dates in your calendar with a reminder a fortnight before. Make sure they’re pointed at an email address you actually check.

If you’d like a broader once-over of the whole site, I’ve written a separate 10-minute website self-audit that pairs nicely with this routine.

When paying makes sense

Doing it yourself is completely legitimate. But paying for an ongoing care plan genuinely makes sense in three situations:

Your site earns money. If a day offline or a broken checkout costs you real income, the maintenance fee is cheap insurance against a much bigger loss.
Your time is worth more than the routine. Thirty minutes of fiddly technical checks, every month, forever, is thirty minutes you could spend on the work only you can do. For a lot of business owners, that’s an easy trade.
You know you won’t actually remember. Be honest with yourself. If the routine above is going to slip to “I’ll do it next month” and never happen, an unmaintained site is worse than one someone is quietly looking after. There’s no shame in outsourcing the discipline.

How to judge any care plan — including mine

Whether you’re weighing up my plan or anyone else’s, ask these questions. Good answers should be specific, not vague.

What, exactly, is included each month? You want a real list of tasks, not “peace of mind”. If they can’t tell you what they’ll do, they may not be doing much.
Are backups tested, and where are they stored? The right answer involves backups kept separately from the site and restored or checked periodically — not “the host handles it”.
How are updates tested? Listen for “one at a time, with a check afterwards” or “on a staging copy first”. Be wary of anyone who just switches on blanket auto-updates and calls it maintenance.
What’s the response time if something breaks? This is what you’re really paying for. Get a straight answer on how fast a real person will act when your site is down.
Do I keep access to everything? You should always own and be able to reach your domain, hosting, and site login. If a provider keeps you locked out of your own website, walk away.

If you’d like a no-obligation look at how your site is doing right now, I offer a Free Site Check — you can ask for one on the contact page. Either way, whether you hand it to someone or do it yourself, the goal is the same: a site that’s genuinely looked after, not just one that hasn’t failed yet.