The site launched. It looked good, it loaded fast, everyone was pleased. Twelve months later the contact form has quietly stopped emailing anyone, the admin takes eight seconds to load, and 23 plugin updates are waiting that nobody dares click.
Nothing went wrong on any single day. A website rarely breaks in one dramatic event — it drifts, while everyone assumes that "it's live, so it's finished".
To maintain a website long-term you need six jobs done on a schedule: update on a staging copy, keep tested off-site backups, patch the server and language underneath, monitor uptime and SSL, measure speed monthly, and write down what changed. Below is what each one means, how often it needs doing, and what it costs to have someone else do it.
Because everything underneath it keeps moving. Your site sits on a stack — the server's operating system, the language it runs on, the database, the CMS core, plugins, third-party scripts — and all of that changes without asking you.
None of this announces itself. That is why maintenance has to be scheduled rather than triggered.
Six jobs. Everything else is optional.
Update on a staging copy, not live. Updates break things — that is not an argument against updating, it is an argument against updating in front of customers. Copy the site, update there, click through whatever makes you money, then push live. Auto-updates with nothing watching them are the most common reason a working site breaks on a Friday night.
Back up off-site, and restore one on purpose. A backup on the same server as the site is not a backup. A backup nobody has ever restored is a guess. Restore one into staging twice a year.
Patch the layer below the site. Most owners think maintenance means plugins. The server counts too: OS packages, web server, database version, SSH and firewall rules. On shared hosting the host does some of this. On a VPS, nobody does it unless you name someone.
Monitor uptime, SSL and domain expiry. You should never learn your site is down from a customer, or lose a domain because the renewal notice went to a former employee.
Measure speed monthly, not once at launch. Sites add roughly half a second per quarter. Nobody perceives that, so nobody reports it, and by year two you are at six seconds and losing visitors who simply leave. Track the same Core Web Vitals numbers every month.
Write down what changed. One page in plain English: what was updated, what broke, what was fixed. Ten minutes a month, and the entire difference between a clean handover and paying someone to reverse-engineer your site later.
| Job | How often | Skipping it means |
|---|---|---|
| Plugin, theme and dependency updates | Weekly or monthly, on staging | Known exploits stay open |
| Off-site backup | Daily, automated | Recovery is a guess |
| Test-restore a backup | Twice a year | You find out it was broken during an outage |
| Server and OS patching | Monthly | The hole is below the site, where you cannot see it |
| Uptime, SSL, domain checks | Continuous, automated | Customers tell you first |
| Speed measurement | Monthly | Slow creeps in unnoticed |
| Paid licence renewals | Yearly | Updates silently stop |
| Major version upgrades (PHP, Node, core) | Yearly, planned | An emergency on the host's timeline |
| Content and price review | Yearly | Wrong prices, staff who left |
Three realistic routes.
| Route | Monthly cost | Covers | Falls short |
|---|---|---|---|
| Do it yourself | $0 plus 2–4 hours | Plugin updates, a backup plugin, your own eyes on it | Nothing gets tested before going live, server patching is invisible, and it gets skipped in busy months |
| Host's "managed" plan | $20–$60 | Server uptime, automatic updates, a nightly account backup | Untested automatic updates are what breaks sites; nobody checks your checkout, forms or speed |
| Agency retainer | $150–$750 | Staged and tested updates, off-site backups, security patching, monitoring, monthly report, small changes | A real line item — more than a rarely-changing brochure site needs |
Our maintenance plans are $150/month for brochure sites, $350/month for stores and busier sites, and $750/month for custom applications and servers. One-off work — a speed audit and fix, a malware cleanup, a rescue when the site is already down — starts at $300.
Set that against what neglect costs. A malware cleanup with blocklist removal runs a few hundred to a couple of thousand, and arrives with days of lost traffic attached because Google shows a red warning screen while it happens. A store that cannot take payments for a weekend loses whatever a weekend is worth. Maintenance is the cheaper half of a bill you receive either way.
Not always, and we will happily talk people out of one. If your site is a simple brochure build, changes twice a year, takes no payments, and you are comfortable clicking updates and checking pages afterwards — pay for good hosting, set up free uptime monitoring, keep an off-site backup, and keep your money.
It changes at a specific point: when the site makes money, when a day of downtime would hurt, or when it has outgrown what one non-technical person can hold in their head. A store is in that category from day one. So is a custom application, where there is no plugin screen showing you what is out of date.
The split that works for most people: you handle content and small edits, someone else owns updates, backups, security and the server. About half the sites we maintain we did not build — a developer disappeared, an agency folded, or the owner wanted someone who replies to emails.
Between $0 and $750 depending on who does it. Doing it yourself costs 2–4 hours a month. A host's managed plan is $20–$60 but does not test anything. Agency retainers run $150–$750 a month, with stores usually landing around $350.
On a simple site, usually yes. On anything that takes payments or bookings, no — auto-updates apply straight to live with nothing checking the result afterwards, which is exactly how checkouts break at the weekend.
Hosting keeps the server on. It does not test your updates, watch your checkout, or notice your site has slowed to six seconds.
Full backup first, then a staging copy, then work through the updates there in batches so you can tell which one broke what. Never update everything at once on live.
Get it audited before spending anything. We do a free health check that takes about an hour and returns a plain list of what is broken, slow and exposed — whether you hire us or not.
The websites still fast and secure in year five are rarely the ones built best. They are the ones where somebody was clearly responsible for them every month.
Tell us what you are building. We reply within 24 hours — no sales team, no follow-up sequence.
Bots do not choose you — they scan for one vulnerable plugin version and hit whatever answers. Here is the checklist we work through on client sites, the security theatre you can skip, and what to do if you are already hacked.
RAG answers from your content at query time for around $35–$70 a month; fine-tuning bakes knowledge into the model and isn't even offered as a self-serve option on Claude. What your business actually needs, and why it's usually not what you'd guess.
Gumroad takes 10% and Lemon Squeezy roughly 5%, both with no monthly fee; Sellfy and Podia flip that to a $29–$150 monthly charge with 0% cut. What you actually keep on a $79 sale, once a month and at $5,000 a month, decides which one is worth it.