Website Maintenance
You commission a website, it launches, everyone is pleased, and then nobody touches it for three years. Meanwhile the platform releases forty security patches, three plugins stop being maintained, the contact form quietly breaks, and the first anyone notices is when a customer mentions they could not get through.
Platform, plugin and theme updates, applied via staging · Security monitoring and malware scanning · Daily off-site backups with thirty-day retention · Uptime monitoring
On this page
What happens to a website nobody maintains?
Four things, in roughly this order: it becomes insecure, it breaks silently, it gets slower, and it falls behind. A website is not a leaflet — it is software, running continuously, exposed to the internet, and built on dependencies that other people keep changing without asking you first.
- It becomes insecure. Content management systems and their plugins publish security patches constantly. An unpatched site is not targeted personally — it is found by automated scanners looking for known vulnerabilities across millions of domains. Most compromised small business sites were not hacked by someone who cared about the business.
- It breaks silently. A plugin update conflicts with another. A payment gateway changes its API. An SSL certificate expires. Forms are the classic case: they fail without any visible error, and the business assumes enquiries have simply dried up.
- It gets slower. Uncompressed images accumulate, plugins pile up, the database fills with revisions and logs. Page speed is a ranking factor and, more importantly, a conversion factor — and once decay has gone far enough it becomes a Core Web Vitals and rendering job rather than routine housekeeping.
- It falls behind. Content ages, prices go stale, the team page lists people who left, search engines read the whole thing as neglected, and the pages quietly stop earning the search visibility they once had.
- None of this is dramatic. It is just what happens when nobody is responsible.
What should a care plan actually include?
Nine things, and the list is the same whoever you buy from — us included. Updates tested somewhere safe first, backups kept off the server and proven to restore, monitoring that reaches a person, renewals watched, a supported runtime, a route for urgent patches, routine checks, and a named human to email. Compare any quote against it.
- Updates applied on a staging copy first. Core, plugins, themes, extensions — whatever the platform calls them — installed and tested on a copy of the site before they touch the live one. Ask any provider where updates get applied. If the answer is “straight to the site”, that is the most likely cause of your next outage.
- Backups held somewhere other than the hosting account. A backup on the same server as the site disappears with the server. Ask where the copies are kept, how far back they go, and who can get at them if the hosting account itself is the thing that has been compromised.
- A restore somebody has genuinely carried out. Restoring is a different operation from backing up, and it is the one that fails. Ask when a restore was last actually performed on a site like yours. A provider who can describe it is telling you something a feature list cannot.
- Uptime monitoring that reaches a person. Automated checks are cheap and nearly universal; what matters is whether the alert goes to somebody who acts on it or into a dashboard nobody opens. It matters most for a site that takes orders, where an outage costs money for as long as it lasts.
- SSL certificates and domain renewals watched. Certificates expire and browsers then warn visitors away from you; domains expire and the site simply stops. Both are usually lost because the renewal notice went to an inbox belonging to somebody who left. Ask who holds the registrar login, too.
- Runtime and platform versions upgraded before support ends. PHP, the database engine and the content management system all reach end of life, and an unsupported version stops receiving security fixes whether or not anything looks broken. If the upgrade turns out to be uneconomic, the real question becomes whether the site should be rebuilt on something current.
- A route for urgent security patches. Most updates can wait for a routine cycle. A serious vulnerability in something the site runs cannot, and the plan should say plainly what happens then rather than leaving it to the next scheduled visit.
- Routine checks on the things that break silently. Broken links, contact forms that stop sending, redirects that stopped resolving after a page moved. Forms are the classic case: they fail without any visible error, enquiries stop arriving, and nobody finds out until the enquiries are missed.
- A named human you can reach. Not a ticket queue that routes to whoever is free. You should know who reads your email, and they should know what your site is built on without looking it up. Ask to speak to the person who would actually be doing it before you sign anything.
What do our own care plans cover?
Nine things, on every plan unless the table below says otherwise. They are the same nine you should be asking any provider about. The tiers differ on response time, how much change work is included each month and how often we review performance — not on whether the site is actually looked after.
- Platform and plugin updates. Core, plugins and themes, applied on a staging copy first, tested, then pushed live. Updates are the most common cause of an unexpected outage precisely because most people apply them straight to the live site and hope.
- Security monitoring and malware protection. Firewall and malware scanning, login hardening, file integrity monitoring, and vulnerability alerts. If a site on a plan is compromised, we clean it and restore it as part of the service — you will not receive a separate invoice at the worst possible moment.
- Daily backups, with restore testing. Daily off-site backups retained for thirty days. Backups that have never been restored are a hope, not a plan, so we test restores periodically and keep a copy off the hosting account, because a backup stored on the same server as the site is not a backup.
- Uptime monitoring. Checked every few minutes, around the clock. If the site goes down we know before you do, and we start work rather than waiting for a report.
- Performance checks. Page speed and Core Web Vitals reviewed regularly, image compression, caching configuration and database cleanup. Not a full optimisation project, but enough to stop gradual decay.
- SSL, domain and DNS. Certificate renewal watched, domain expiry monitored, DNS managed. Businesses lose their websites over an expired domain renewal notice sent to an inbox nobody reads more often than you would think.
- Content changes. Included time each month for the small jobs — a price change, a new team member, updated opening hours, a fresh photograph. The things that never get done because they are too small to raise a quote for.
- Monthly reporting. What was updated, what was blocked, uptime, backup status, load times, and anything that needs your decision. Short enough to actually read.
- Support with a response time. You email a person, not a ticket queue that routes to whoever is free. Response times are set out in the plans below and we hold ourselves to them.
What drives the cost of a website care plan?
Everything that protects the site — updates, security, backups, uptime and malware cleanup — is on all three tiers, so what moves the cost is response time, how much change work is included each month, and how often we review performance. An online store needs more attention than a brochure site, so a retailer usually needs Business or above.
| Plan feature | Essential | Business | Priority |
|---|---|---|---|
| Platform, plugin and theme updates | Yes | Yes | Yes |
| Security monitoring and malware scanning | Yes | Yes | Yes |
| Daily off-site backups (30-day retention) | Yes | Yes | Yes |
| Uptime monitoring | Yes | Yes | Yes |
| SSL and domain expiry monitoring | Yes | Yes | Yes |
| Monthly report | Yes | Yes | Yes |
| Malware cleanup and restore if compromised | Yes | Yes | Yes |
| Support response | 2 working days | 1 working day | 4 working hours |
| Included content changes | 30 minutes | 2 hours | 5 hours |
| Performance and speed review | — | Quarterly | Monthly |
| Quarterly review call | — | Yes | Yes |
| Named account contact | — | — | Yes |
| Priority scheduling for larger work | — | — | Yes |
Is there a minimum term?
No. One month's notice, in writing, either way — we would rather keep clients because the service is worth it. Hosting is charged separately and can be arranged if you need it; if you already have hosting you are happy with, we will work with that instead.
What happens when something actually goes wrong?
We find out first, we tell you, we get you trading again, and we explain it afterwards in writing. Plans are easy to write; what matters is what happens at 4pm on a Friday when the site is down, so this is the sequence we actually follow.
- We usually know first. Uptime monitoring alerts us within minutes, so in most cases the work starts before anyone has told us.
- We acknowledge, then we act. You get a message confirming we are on it, with an honest first assessment of what has happened. No holding statements.
- We restore from backup if that is fastest. Getting you trading again comes before diagnosing the root cause. We find the cause afterwards.
- You get a written explanation. What happened, why, what we did, and what stops it recurring. Plainly, without jargon designed to make it sound harder than it was.
- Malware cleanup is included. If a site on a plan is compromised, cleaning and restoring it is part of the service.
Will you take on a website somebody else built?
Yes — most of the sites we look after, we did not build. We start with a health check before quoting anything: what it is built on, what state the code is in, what is out of date, what is broken, and whether there are security issues sitting there now. You get that in writing either way.
Occasionally the honest answer is that a site is too far gone to maintain economically — an abandoned page builder, a dead framework version, a plugin that no longer exists. If that is the case we will say so, tell you roughly what a rebuild would cost, and let you decide. We would rather lose a maintenance plan than take money to maintain something we know is failing. Where a site is worth keeping but looks its age, the cheaper route is often a redesign of the front end rather than starting again.
Common situations we handle: the developer who has stopped replying; the agency that has closed; the freelancer who has moved on; the in-house person who has left; and the site where nobody knows where the hosting or the domain actually is. That last one is more common than anybody admits, and untangling it is usually the first job.
Read next
How We Work
Health check
What the site is built on, what state the code is in, what is out of date, what is broken, and whether there are security issues sitting there now. You get that assessment in writing whether or not you go ahead.
Plan recommendation
Which tier actually fits, based on the health check rather than on what we would prefer to sell. Sometimes that is the cheapest plan. Sometimes it is a conversation about a rebuild.
Onboarding
Access, hosting and domain untangled, backups configured off-site, monitoring connected, and a baseline of speed and uptime recorded.
Monthly cycle
Updates applied via staging and tested, security and uptime monitored continuously, performance reviewed, and your included content changes done.
Frequently Asked Questions
What does a website maintenance package include?
Platform, plugin and theme updates applied via staging; security and malware monitoring; daily off-site backups with thirty-day retention; uptime monitoring; SSL and domain expiry watching; performance checks; included time for content changes; a monthly report; and support with a defined response time. The three plans differ mainly in response time, included change hours and how often we review performance.
How much does website maintenance cost in the UK?
What you are paying for is response time, how much change work is included each month, and how often performance is reviewed. The protective work underneath is much the same at every level. A busy online store needs more attention than a brochure site — what maintenance costs in the UK goes into the detail.
Can I cancel at any time?
Yes. One month's notice in writing, no minimum term and no cancellation fee. Your site, your hosting, your domain and your data remain yours throughout, and if you leave we hand everything over rather than holding anything back. We would rather keep clients because the service is worth paying for.
Do you maintain sites you did not build?
Yes, and most of the ones we look after are like that. We run a health check first so we both know what we are taking on, and we will tell you honestly if a site is beyond economic maintenance — in which case the conversation becomes what a rebuild would cost instead.
What is your response time if the site goes down?
An outage is treated as urgent on every plan regardless of tier, and uptime monitoring usually alerts us before you notice. The response times in the table — two working days, one working day, four working hours — apply to normal requests such as content changes and questions.
Does the plan include content changes?
Yes: thirty minutes on Essential, two hours on Business, five hours on Priority, each month. That covers text edits, image swaps, price and opening-hours updates, adding a team member, publishing a post. Larger work is quoted separately, and we will tell you before something falls outside the plan rather than silently using up your hours.
Is hosting included?
No, it is charged separately so you are not paying twice if you already have hosting you are happy with. We can arrange UK hosting if you would rather have it all in one place, and we will set out what that involves before anything moves.
What happens to my site if I leave?
You take everything. The site, the domain, the hosting, the backups and the access credentials. We will hand over to you or to your new developer and answer their questions during the transition. There is no buyout fee and we do not hold anything back.
Do unused hours roll over?
No — the plans are priced on the basis that some months you will use the time and some you will not. If you find you consistently need more, we will move you up a tier rather than quietly billing extra.
Let's Build Something That Matters.
Tell us what you're trying to achieve and we'll help you find the right solution.