The maintenance work nobody quotes for, and what breaks without it

A website quote covers design and build. It ends at launch. What almost no quote describes is the work that keeps the thing alive afterwards, because that work is invisible when it is being done well and only becomes visible when it stops.

If you have never owned a website through its second and third year, here is what that period actually involves.

Software underneath the site keeps moving

Your site sits on a stack: a server, a language runtime such as PHP, a database, a content platform, a theme, and a set of plugins or extensions. All of those release updates. Some are security fixes. Some change how things behave.

Two failure modes, and both are common:

• Nothing is ever updated. Known vulnerabilities stay open. Automated scanners find sites like this constantly, and they are not targeting you personally.
• Everything updates automatically and nobody looks. One morning the booking form silently stops sending emails, or the layout of every service page collapses on mobile. You find out weeks later, from a customer.

The work is applying updates deliberately, checking the important pages afterwards, and being able to roll back when an update goes wrong.

Backups you have never tested are not backups

Most hosts include backups. Fewer people have ever restored one. A backup that has never been restored is a belief, not a safeguard.

Things worth knowing before you need them: how far back the backups go, whether they include the database as well as the files, where they are stored, whether they survive the hosting account itself being compromised, and how long a restore takes. If nobody can answer those from memory, assume the answer is unfavourable.

Forms break quietly

This is the failure that costs real money, and it is the least dramatic.

Contact forms depend on email delivery, which depends on mail configuration, spam filtering, and the address the notification is sent to. Staff leave and their mailbox is closed. A filtering rule changes. A plugin update alters the notification setting. The form still shows a cheerful confirmation message to the person filling it in. Nobody receives anything.

You do not get an alert for this. You find out when someone mentions they emailed twice and heard nothing. Submitting a test enquiry once a month takes two minutes and is the single highest-value habit on this page.

Certificates, domains and renewals

Security certificates expire, usually on a short cycle. When one lapses, browsers show a full-page warning telling visitors your site is unsafe. Domains expire too, and a lapsed domain takes your email down with the website. Paid plugin licences expire, which usually means updates stop arriving, which quietly returns you to the first problem on this list.

All of it is preventable with a calendar and a card on file that has not itself expired. Almost every emergency of this type traces back to an old card or an old address.

Content decays without anyone touching it

The site is technically fine and still wrong. A staff member who left last year is still on the team page. The prices are last year’s. An event from March is still promoted on the home page. A PDF links to a form that no longer exists.

Visitors read this as a signal about the whole organisation, and they are not being unfair. A stale website suggests nobody is minding the shop.

Performance drifts downward

Sites get slower over time, and it is nearly always accumulation rather than a single event. Images uploaded straight from a phone at full resolution. A plugin added for one page that loads its scripts on every page. Tracking tags added for a campaign that ended and never removed. None of it is a mistake at the time. Together they add seconds.

What a maintenance arrangement should actually name

“Maintenance included” means nothing on its own. Ask for the specifics:

• How often updates are applied, and whether they are checked afterwards.
• Where backups are stored, how far back they go, and how often a restore is tested.
• Whether uptime is monitored, and who gets the alert at two in the morning.
• How much content editing time is included per month, and what happens to unused time.
• What counts as an emergency, and how quickly someone responds to one.
• Whether you receive a record of what was done.
• What is explicitly excluded.

That last one matters most. A clear exclusion list is a sign of an honest arrangement, not a stingy one.

The cheapest version of this

If you cannot fund a maintenance arrangement this year, do not do nothing. Put four recurring items in a calendar: submit a test enquiry through every form, confirm a backup exists and can be downloaded, apply and check updates, and read the home page and contact page as though you were a stranger. Give it an hour a month and one named person.

That will not catch everything. It catches the failures that quietly cost you enquiries, which are the ones that matter. If you would rather it was somebody else’s hour, our plans describe what is covered and what is not.