A website is not a purchase. It is something you own.
Websites do not sit still. Hosting expires, certificates lapse, plugins fall out of date, the contact form silently stops delivering, and a browser update quietly breaks a layout that worked for three years. None of it announces itself. You find out when a customer mentions it, or when you notice the enquiries stopped a month ago.
Most of the sites I am called in to rescue were not badly built. They were built well and then left alone for four years. The rescue almost always costs more than the maintenance would have — and it is paid in lost enquiries first, invoices second.
This series is what actually needs attention, how often, and what it is reasonable to pay for it.
What needs looking at, and how often
The realistic versionDo it yourself, or pay someone?
The first three items above take about ten minutes a month and need no technical skill. Do those yourself — they catch the faults that cost real money.
Pay for the rest if the site earns you anything: updates that can break a live site, backups you can prove work, and speed work that needs judgement. A care plan is cheap insurance against the version of this where you call someone in a panic.
Be sceptical of a retainer that only produces a monthly PDF report. You are paying for someone to notice things, fix them, and tell you plainly what they did.
What good looks like
Maintenance done properly is boring and almost invisible — which is exactly why it gets dropped. These five things separate a site that is being kept alive from one that is merely still online.
Someone owns it, by name
Not "the web guy" and not "we both look at it". One person is responsible for the monthly check and knows who to call when something is beyond them. Sites decay in the gap between two people who each assumed the other was watching.
The backup has been restored at least once
Everyone has backups. Almost nobody has ever tried using one. Restore a copy to a test address once and you find out in an afternoon whether you are actually protected — rather than during the week your site is down.
The enquiry form is tested on a schedule
Send yourself a real enquiry on the first of the month. Forms fail silently after updates, hosting changes and expired mail settings, and customers never write to tell you the form is broken. They just conclude you did not bother replying.
Updates happen on a copy first
Anything that can break a live site gets applied to a staging copy, checked, then pushed. This is the single difference between a site that updates uneventfully for years and one that is offline on a Friday afternoon.
Content has a quiet expiry date
Prices, opening hours, staff, service areas, and any year printed on the page. A quarterly read-through catches the details that make a working business look abandoned — and stops people turning up when you are closed.
What breaks, when, and who should handle it
Nothing here is urgent on any given day, which is why it all gets postponed. The right-hand column is what postponing costs — and almost none of it announces itself.
| What | How often · who | What skipping it costs |
|---|---|---|
| Enquiry form | Monthly · you | Weeks or months of lost enquiries you never knew arrived. The most expensive failure on this list, and the easiest to check. |
| Domain and SSL renewal | Diarised yearly · you | A site that vanishes, or a browser warning telling every visitor the page is not secure. Recovery of a lapsed domain can take weeks. |
| Platform and plugin updates | Monthly · paid help | Known security holes left open, then a hacked site, a blacklist warning in search results, and a cleanup that costs more than years of upkeep. |
| Backups, plus one test restore | Monthly backup · yearly test · paid help | Rebuilding from scratch and paying for the site twice. An untested backup usually fails at the moment you need it. |
| Mobile page speed | Quarterly · paid help | A slow slide in enquiries that nobody attributes to the site. Images added over time are the usual culprit. |
| Content accuracy | Quarterly · you | Customers arriving to closed doors, quoting old prices, or asking for staff who left. Reads as a business that has stopped caring. |
Put the yearly items in a calendar today, with a reminder a month ahead. Renewal dates are the only thing on this list that can take the whole site offline in one step.
Read these
Live now
Technical
Website speed optimization for small business
The five real causes of a slow site, which fixes are free and safe to do yourself, and which are worth paying for.
7 min read · August 2026
Checklist
The 14-point website checklist
Useful as a maintenance sweep too — run it against your own site once a year.
7 min read · August 2026
Coming in this series
Next few weeksWhat website maintenance actually costs
Real monthly figures, and what should be included at each level.
What breaks on a website, and when
A timeline of the faults that appear at year one, three and five.
Choosing hosting for a small business in Malaysia
Local versus overseas, shared versus managed, and what matters for speed.
Backups, SSL and the boring essentials
The unglamorous setup that saves you from a very bad week.
Questions owners ask about upkeep
What should website maintenance cost?
The monthly checks that catch most disasters — test the form, confirm the site loads, check renewal dates — cost nothing but ten minutes of your attention. Paid upkeep covers the parts that can break a live site: updates, backups you can prove work, and speed. Judge any quote against one lost customer a year; if the plan costs less than that, it has paid for itself the first time it catches something.
Can I maintain the site myself?
The first three checks, yes, and you should — nobody notices a dead enquiry form faster than the person waiting for enquiries. Hand over anything that can take the site down while you are not watching: platform and plugin updates, backups, and server-side work. The split is not about skill, it is about who is around when something breaks at 9pm on a Saturday.
How often do I need backups, and where should they live?
Monthly for a site that rarely changes, weekly if you publish or take bookings, and never only on the same server as the site — a compromised or suspended account takes both. The part almost everyone skips is testing one restore, once. An untested backup is a belief, not a backup.
What actually happens if I do nothing for two years?
Usually nothing dramatic, then everything at once. The certificate lapses and browsers start warning visitors away; the form quietly stops delivering after a plugin update; the content still lists last year's prices and a member of staff who left. None of it announces itself — you just notice the phone ringing less and blame the market.
My site has not changed. Why does it need updating?
The site sits still; everything under it moves. Browsers change, hosting moves to newer software versions, and any plugin or theme you use gets security patches that matter whether or not you edited a page. Unchanged sites are the ones that break hardest, because two years of updates arrive in one go.
Who should own my domain and hosting?
You, in your own account, with your own login — always. Plenty of small businesses discover during a dispute that their domain is registered to a former designer, and recovering it is slow, expensive, and sometimes impossible. Your builder can manage it; they should not own it. Check this today rather than when you need it.
Is WordPress harder to maintain than a simple static site?
Yes, meaningfully. WordPress earns its keep when you publish often or need bookings and memberships; it carries a permanent obligation of updates, plugin conflicts and security patching. A static site has almost no attack surface and almost no upkeep, at the cost of needing someone to make changes for you. Match the choice to how often the site will actually change.
Rather have it done for your site?
Send me your homepage. I'll apply all of this to your actual site and send back the three things to fix first — free, within 48 hours.
Get my free audit