Maintenance
Website maintenance: what it covers and what happens without it
A website isn't finished the day it goes live. It depends on a server, on a certificate that expires, on a domain that has to be renewed and, if it's built with WordPress or similar, on software that gets security patches every few weeks. Maintaining it means keeping all of that working without you having to think about it. This guide explains each piece, what happens when it fails and how to tell whether a maintenance plan covers what it should.
What maintaining a website means
When someone talks about “website maintenance” they can mean very different things: from renewing the domain once a year to checking security every week and changing text whenever you ask. That's why two plans with the same name can cost €10 or €150 a month.
Broken into pieces, maintaining a small website covers this:
- Hosting: the server the site lives on stays up, with space and up-to-date software.
- SSL certificate: the padlock in the browser and the https address are renewed before they expire.
- Backups: there are recent copies, stored in more than one place, and they can be restored.
- Updates: the content management system, plugins and theme receive their security patches.
- Monitoring: someone finds out if the site goes down, if the form stops sending or if something odd appears.
- Domain: it's renewed on time and stays in your name.
- Content: opening hours, prices, menus, holidays and legal pages are up to date.
Hosting and the security certificate
These are the foundation: without them there's no site, or the browser warns your customers it isn't safe.
Hosting
Hosting is the computer running day and night that serves your site. On a shared plan, the provider looks after the hardware and the system; you, or whoever maintains the site, look after what's inside. What's worth checking now and then is whether there's space left, whether the PHP version (or whatever language the site uses) is still supported and whether the plan is still the one you're paying for: many first-year offers renew at full price.
A static site, generated as fixed pages with no database, needs far less server maintenance than a WordPress site, because there's no software running on every visit and no admin panel to attack.
SSL certificate
The certificate is what lets the site load over https and makes the browser show the padlock. If it expires, the browser shows a full-screen warning, and almost nobody clicks past it.
Certificates keep getting shorter. The CA/Browser Forum, which sets the rules browsers follow, approved a schedule in 2025 that cut the maximum validity to 200 days from 15 March 2026, will cut it to 100 days in March 2027 and to 47 days in March 2029. With those periods, renewing by hand isn't workable: renewal has to be automatic, as with Let's Encrypt's free certificates on a properly configured server.
If your provider charges you for a certificate and renews it by hand once a year, ask how they'll handle the new periods. For a small business site, a free certificate with automatic renewal is enough.
Backups: the 3-2-1 rule
A backup is the only thing that saves you from a hack, a botched update or your hosting provider shutting down. But a backup stored on the same server as the site isn't a backup: if the server is lost, it goes with it.
INCIBE, Spain's National Cybersecurity Institute, recommends the 3-2-1 strategy to businesses. Applied to a website, it looks like this:
- 3 copies of the data: the live site and two more copies.
- 2 different media or places: for example, the server itself and external storage.
- 1 copy offsite: with another provider or in another location, so a server problem doesn't take everything.
| Type of site | Indicative frequency | Copies to keep |
|---|---|---|
| Informational site that rarely changes | Weekly and before every change | The last 4–8 weeks |
| Site with a blog or frequent news | Daily | The last 30 days |
| Site with bookings, orders or forms that store data | Daily or several times a day | The last 30 days, plus one monthly |
| Static site in a code repository | With every published change | The full history |
What to back up
A site with a content management system has two parts: the files (theme, plugins, uploaded images) and the database (text, pages, settings, orders or bookings). A backup with only one of the two can't restore the site. For a static site the files are enough and, if it lives in a code repository, its history is already a backup.
How often, and how long to keep them
Frequency depends on how much the site changes. What matters is being able to go back to a point before the problem, and hacks are sometimes discovered weeks later: so keep several older copies, not just the latest.
Test that they restore
A backup nobody has ever restored is an assumption. At least once or twice a year, someone has to take a backup and bring the site up from it somewhere else, even in a test environment. It's the only way to know it'll work the day you need it.
Software updates
WordPress runs around four in ten websites worldwide according to W3Techs. That makes it convenient and, at the same time, the favourite target of automated attacks: there are programs that crawl the internet looking for versions with known flaws and get in without anyone having to notice your site in particular.
WordPress core has applied minor security updates on its own for years, and since version 5.5 you can switch on automatic updates for plugins and themes too. Even so, someone has to keep an eye on it. Most of the vulnerabilities published each year are in plugins and themes, not the core, and a plugin abandoned by its author stops getting patches even if you keep updating it.
How to update without breaking the site
Updating blindly can break a page or a form if a plugin isn't compatible with the new version. A sensible order is:
- Take a full backup right before.
- Update in a test environment first if the site has bookings, payments or a lot of traffic.
- Update core, plugins and theme, one at a time if any is critical.
- Check the main pages afterwards and send a test through the contact form.
- Remove plugins you don't use: each one is another door.
Paid licences
Many “premium” plugins and themes only get updates while you pay the yearly licence. If the licence lapses, the plugin keeps working but stops getting patches. Write down which licences your site has, whose name they're in and when they renew.
Monitoring: finding out before your customers do
The most expensive way to find out your site is down is a customer telling you. There are uptime monitoring tools, with free plans for a handful of sites, that visit yours every few minutes and email you if it doesn't respond.
Besides uptime, watch three things that fail silently:
- The contact or booking form: it can keep looking fine and stop sending emails. Send yourself a test once a month.
- Google Search Console alerts: Google emails you if it detects the site has been hacked, if pages have errors or if there are mobile problems.
- Expiry dates: domain, certificate and licences, in a calendar with reminders.
The domain
A domain is rented by the year and has to be renewed. If it expires, the site and email stop working at the same time. For generic domains such as .com, ICANN's rules require the registrar to give you some time to renew after expiry and, for most, there's also a redemption period of about 30 days, usually with a surcharge. After that, anyone can register it. For .es the periods are set by Red.es; ask your registrar what they are.
Avoiding the problem takes little: auto-renewal switched on, a card that won't expire soon and a contact email someone reads. How to choose it and register it in your name is in the domain and professional email guide.
Small content changes
A site showing summer hours in November or last year's prices looks worse than having no site. Content changes are the most visible part of maintenance and the most often forgotten.
The usual ones for a local business are opening hours (including bank holidays and closures), the menu or price list, services, staff, photos and the legal pages if the owner changes or a new tool is added. Keep the same opening hours on the site and on your Google Business Profile: if they don't match, neither Google nor your customers know which to believe.
If maintenance includes “small changes”, ask them to define small: how many a month, how long each takes and what anything outside that costs.
What happens if nobody maintains it
Problems on an unmaintained site give no warning: one day it works and the next it doesn't, or it works but no longer does what it should. These are the most common cases and how to avoid them.
| Problem | What you see | How to avoid it |
|---|---|---|
| Expired domain | Site doesn't load and email doesn't arrive | Auto-renewal and a calendar reminder |
| Expired certificate | A “not secure” warning screen | Automatic certificate renewal |
| Hacked WordPress | Redirects to other sites, Google warnings, spam sent from your server | Updates, few plugins, strong passwords and offsite backups |
| Broken form | No error; messages simply stop arriving | A monthly test submission |
| Hosting cancelled or unpaid | The site disappears, sometimes with the files | Account in your name and backups off the server |
| Out-of-date content | Customers arriving to a closed shop or old prices | A quarterly content review |
Cleaning up a hacked site usually costs far more than a year of maintenance, and it isn't always possible: without a clean backup from before the attack, sometimes the quickest fix is to rebuild it.
Doing it yourself or paying someone
You can maintain your site yourself if it's on a builder such as Wix or Squarespace, where the platform handles the server, certificate and updates and you only look after the content and the domain. With WordPress it can be done too, if you have the time and the knack, following a routine like this:
- Weekly: apply updates with a backup first and check the site loads.
- Monthly: send a test form, check Search Console and confirm backups are running.
- Quarterly: review hours, prices and text; remove unused plugins; change passwords if someone has stopped working with you.
- Yearly: restore a test backup, review domain, hosting and licence dates, and check the hosting renewal price.
What a maintenance plan should include
If you outsource it, a reasonable plan for a small site covers, in writing: hosting or supervision of the hosting, a certificate with automatic renewal, 3-2-1 backups with a restore test, updates with a backup first, downtime monitoring, a number of small changes per month and a response time if the site goes down. In the Spanish market these plans run, as a guide, from about €15–25 a month for basic ones to €50–150 a month for those with more hours or priority support. As an example of a fixed price, AMG Design's maintenance costs €25 a month, VAT not included, with hosting, backups and small changes.
Red flags when hiring maintenance
Most problems with a provider aren't technical but about ownership: who holds the keys. Before hiring, and also if you already have someone, check the following:
- The domain is registered in your provider's name, not yours.
- You have no user of your own on the hosting or the site's admin panel, only they do.
- You don't know where backups are kept and they can't send you one when asked.
- The contract doesn't say what happens if you leave or how soon you get the files, database and logins.
- The price doesn't say what's included: just “maintenance”.
- They ask for the password to your email or Google account instead of asking you to give them user access.
Get it in writing that, if you end the service, they'll hand over a full copy of the site (files and database), the credentials for every account in your name and the domain transfer if it wasn't already yours. This is normal, and a serious provider won't object.
Frequently asked questions
What does website maintenance include?
At minimum: hosting, certificate renewal, backups, security updates, domain renewal and checking that the site works. Many plans add a number of small content changes per month. Ask for it in writing.
How much does website maintenance cost per month?
As a guide in Spain, basic plans for a small site run from about €15 to €25 a month, and those with more hours of changes or priority support from €50 to €150. Compare what each includes, not just the fee.
Do I have to pay for maintenance?
It isn't mandatory, but someone has to do it. On a builder like Wix the platform handles the technical side and you look after the content. On WordPress, if nobody updates or backs up, the risk of a hack grows over time.
How often should a website be backed up?
It depends on how much it changes: weekly for a site that rarely changes, daily if it has a blog, bookings or orders. What matters is keeping several older copies, having one off the server and testing a restore now and then.
What should I do if my WordPress site has been hacked?
Change the passwords for the admin panel, hosting and email, ask your hosting provider to check the server and restore a clean backup from before the attack. Then update everything and remove plugins you don't use. If there's no clean backup, the clean-up needs someone experienced, or the site has to be rebuilt.
How do I get my website back if my designer stops answering?
First check whose name the domain is in at the registrar and who holds the hosting account. If they're in your name, you can ask the provider for access directly. If not, you need the holder to transfer them, which is why it pays to settle it from the start.