Launch is a milestone, not an ending
A website is software that happens to be pointed at customers. Like all software, it sits on top of things that change without asking: browsers, hosting platforms, payment providers, the plugins it depends on, the search engine reading it, and the business it describes.
None of that changes dramatically enough to notice week to week. That is precisely the problem. A neglected site does not break on a Tuesday. It degrades quietly for two years and then fails at the worst possible moment, and the repair costs more than the maintenance would have.
The four things maintenance actually covers
Most of what gets sold as maintenance falls into four distinct categories, and it is worth knowing which ones a given plan includes, because they are not interchangeable.
Keeping it secure
Anything with a login and a database is a target, and the targeting is automated rather than personal. Nobody chose your business. A script found a version number.
On a platform like WordPress, this means keeping core, themes, and plugins current, because most compromises exploit known vulnerabilities in outdated versions rather than anything novel. On a static or code-first site there is far less surface to attack, but the dependencies it was built from still need updating and the hosting still needs attention.
Backups belong in this category too, and the useful question about a backup is not whether one exists. It is when someone last restored one successfully. An untested backup is a belief, not a safeguard.
Keeping it working
Things break without anyone touching them. A contact form stops delivering because an email provider tightened its rules. An embedded map stops rendering because the service changed its terms. A booking widget updates and no longer fits its container on a phone.
The contact form is the one worth checking often and deliberately. A form that silently stops sending is the most expensive failure a small business site can have, because there is no error message and no missing page — just an inbox that gets quieter, in a way that is easy to attribute to a slow month.
Keeping it fast
Performance decays. Images get uploaded at full camera resolution. Scripts accumulate — a chat widget, an analytics tag, a tracking pixel somebody added for a campaign that ended. Each is small and defensible on its own, and together they turn a fast site into a slow one.
This is measurable rather than a matter of opinion. Google publishes Core Web Vitals precisely so that loading, responsiveness, and visual stability can be checked rather than argued about, and a maintenance routine worth paying for checks them periodically instead of assuming launch-day performance persists.
Keeping it true
This is the category most maintenance plans ignore, and the one a business notices.
Prices change. Services get added and quietly dropped. Staff join and leave. Opening hours change for a holiday and never change back. A site that still describes the business as it was three years ago is not technically broken, but it is doing damage every day to people who believed it.
Nothing automated catches this. It requires somebody who knows the business to read the site occasionally and ask whether it is still true.
What it does not involve
Maintenance is not redesign, and conflating the two is how businesses end up paying a monthly fee for years and feeling that nothing happened.
Keeping a site secure, working, fast, and accurate does not restructure it, does not add pages, and does not change what it says. Those are projects. A care plan that quietly includes “a few hours of changes each month” is fine, as long as everyone understands that a few hours a month is not a redesign and will not accumulate into one.
Nor is maintenance the same as SEO. There is overlap — a fast, working, current site is easier to rank than a slow, broken, outdated one — but keeping a site from degrading is not the same activity as improving its position, and a plan that bundles them without distinguishing them is worth asking about.
Who should do it
There are three workable arrangements, and the wrong one is usually the one nobody chose deliberately.
Someone inside the business can do it, if they have the access, the instructions, and a recurring reminder. This works well for the “keeping it true” category and less well for the security and performance ones, which need someone who will notice a problem they were not looking for.
The person who built it can do it, which has the advantage that they already understand how it works and the disadvantage that it ties you to one provider unless you own everything outright.
Or nobody does it, which is the most common arrangement and is only visible in hindsight.
How to tell whether yours is being maintained
You do not need a technical audit to get a rough answer. Load the site on a phone on a mobile connection and see how long it takes. Submit the contact form and confirm the message arrives. Read the services page as if you had never seen it and ask whether it describes what the business sells today. Check when anything was last updated.
If the answers are uncomfortable, that is a maintenance question rather than a redesign question, and the two have very different costs.
We build sites that are straightforward to maintain and are direct about which parts need attention and how often. If you are not sure what condition yours is in, ask for a review and you will get an honest answer either way.