Website maintenance
Website maintenance that keeps your site secure, fast and current
Updates, backups you can restore, forms that arrive and a look at Google, so nothing breaks without you knowing.
Most sites do not crash. They decay.
Website maintenance is noticed only when it is missing. Nothing dramatic happens: the contact form quietly stops sending, the certificate lapses and browsers warn visitors away, a plugin with a known hole gets found by a bot, last year's prices stay up. Each costs you clients, and nobody tells you.
What a site needs depends almost entirely on how it was built. Below: the monthly work for a WordPress site against a static one, the security numbers that explain why plugins are the weak spot, why certificates must be renewed far more often from 2026, the EU rules that change under a live site, and what to ask anyone who offers to maintain yours.
A year of maintenance, task by month
- Jan
- Feb
- Mar
- Apr
- May
- Jun
- Jul
- Aug
- Sep
- Oct
- Nov
- Dec
An example plan. What your site really needs depends on what runs on it: a form needs less than a booking calendar or a webshop.
WordPress or static: the monthly work
| Task | WordPress with plugins | Static custom site |
|---|---|---|
| Core, theme and plugin updates | every month, tested on a copy first | none on the public site |
| Security monitoring | needed: plugins are the usual way in | little to patch; hosting and forms only |
| Backups | files and database, daily for shops | the code lives in version control; back up form data and content |
| Speed | drifts as plugins and images pile up | stays where it was built, unless images grow |
| Content changes | you or your provider in the admin | your provider, or a light editing tool |
The numbers behind the first two rows: in 2025, 11,334 new vulnerabilities were reported across the WordPress ecosystem, 42 percent more than the year before. 91 percent were in plugins and 9 percent in themes; WordPress core itself had six, all low priority. WordPress is not the risk; what you install on it is. Read is WordPress safe for your own site, and why is WordPress so slow if speed is the problem. How the two ways of building compare is in custom website or WordPress.
- Maintain it yourself ifyour site sits on a hosted builder such as Wix: the builder handles updates, you handle the words. What a builder costs a year is in Wix pricing.
- Maintain it yourself ifyour WordPress site has few plugins and someone has an hour a month, can restore a backup and knows what to do when an update breaks a page.
- Hand it over ifany of those three is missing, or if a shop, a booking calendar or a client portal runs on the site. An evening of repairs costs more than the upkeep.
What quietly breaks
The padlock in the address bar needs renewing ever more often
Issued before 15 March 2026
398 daysonce a year
From 15 March 2026
200 daysat least 2 times a year
From 15 March 2027
100 daysat least 4 times a year
From 15 March 2029
at least 8 times a year
Anyone who renews a certificate by hand will do it eight times a year from 2029. Automatic renewal, with an alert when it fails, becomes the only workable route.
Certificates that expire faster every year
Browser makers and certificate authorities agreed in 2025 that a public https certificate will be valid for ever shorter periods: at most 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. With most hosts the certificate renews itself and you notice nothing. If yours was ever installed by hand, or bought for several years at once, check now how your host handles it; manual renewal eight times a year is a job someone will forget. What a certificate does is explained under SSL certificate.
Backups only count once you have restored one
Almost every host says it takes backups. The real questions are whether you can restore one and how old it will be. Keep a copy somewhere other than the server itself, so a compromised server does not take both. Back up the content and the database, not only the files. And once a year, restore an old version to a test address and time it. Taking over a site from a developer who stopped answering? Read my web designer disappeared first.
How that backup saves you when things go wrong is set out hour by hour in website hacked, what to do.
Content upkeep: the part that brings visitors
Technical maintenance keeps a site alive; content upkeep keeps it found. Every quarter, look at which pages climb and which slip in Search Console, update prices and facts that changed, and add a page where people search for something you do not cover yet. Growing traffic on purpose is the work of SEO; our SEO checklist has the checks in order of impact.
EU rules that change under a live site
A site that was in order at launch can drift out of order without a word changing, because the rules around it move. Online shops in the EU must offer a button to withdraw from a purchase online since 19 June 2026; see the EU withdrawal button. The European Accessibility Act has applied to many shops and online services since June 2025; what a year of it brought is in the EU accessibility law, one year on. Consent rules shift with each change at Google and in Brussels: the Consent Mode change and the Digital Omnibus and cookies. Good maintenance reads these once a year, not only the software.
What to ask before you hand your site to anyone
| Ask | Why it matters | A good answer |
|---|---|---|
| Whose name are the domain and hosting in? | whoever holds the login controls the site | yours; they work with access you grant |
| When did you last restore a backup? | a backup nobody tested may not work | a date, and how long the restore took |
| What happens when an update breaks something? | updates on a live site break things | tested on a copy first, with a way back |
| How do you know the form still works? | a silent form is the most expensive failure | a test enquiry on a fixed schedule |
| What is not included? | small changes and new pages are where bills grow | a plain list, before you sign |
What a site costs per year once it runs, hosting and domain included, is in website cost per year. Moving to a better host without losing your rankings is in moving a website to a new host.
What owners ask about upkeep
- What does website maintenance cost a month?
- It depends on how the site is built and what runs on it. A static site without plugins needs far less than a WordPress site with a shop. Ask what is included: updates, backups, tests, small changes, and how fast someone responds.
- How often should a WordPress site be updated?
- At least monthly, and at once when a plugin you use has a reported vulnerability. Test the update on a copy first and take a backup before.
- Do I need maintenance for a static site?
- Less, not none. Forms, hosting, the certificate, content and Search Console still need a regular look, and the rules around the site still change.
Website design
How VBS keeps sites healthy after launch
Most sites we build are static sites on AWS, with no plugins on the public side and so far less to patch. Their forms run through our own form service for eleven client domains, with a hidden field for bots, an origin check and a filter on gibberish that stopped a spam wave at Business Centrum. And we keep working after launch: on the Business Centrum site, the pay scales per joint committee are checked against the official database every week. Our build process is on website design. Book a call and send us your site's address.
Never think about updates again
Send us your site's address. We say what it needs.
Rather get in touch right away?