What website maintenance includes

Say you run a dental clinic, and your site runs on WordPress with a theme and 14 plugins. It launched well. Two years later, the hosting company changes how it sends email. Nothing looks different on the site. Patients still fill in the appointment form and see "Thank you, we will be in touch." But the messages no longer reach anyone. For five weeks the clinic assumes it is a quiet season.

Meanwhile, three of the plugins have had security updates that nobody applied, one has been abandoned by its developer, and the domain's renewal reminder went to the email address of a staff member who has since left.

None of this needed a developer to prevent. It needed a short monthly routine and someone whose job it was.

Hosted platforms remove a lot of work. Shopify, for example, states that it is certified Level 1 PCI DSS compliant (the card-payment security standard) and that this applies by default to every store on the platform. But a hosted platform cannot tell whether your opening hours are wrong or whether an app you installed has slowed the shop down.

Every site runs on software written by other people: the content system, the theme, plugins, apps and code libraries. That software gets security fixes, and an unapplied fix is an open door. Google's web.dev guidance on how sites get hacked puts it directly: "earlier software versions can have high-risk security vulnerabilities that enable attackers to compromise an entire site," and "outdated or unpatched themes and plugins are a major source of vulnerabilities." It advises removing themes and plugins that are no longer maintained.

The 2021 edition of the OWASP Top 10, a widely referenced list of web application security risks, includes "vulnerable and outdated components". OWASP says you are likely at risk if you do not know the versions of the components you use, if software is unsupported or out of date, or if you do not fix or upgrade it "in a risk-based, timely fashion". Its advice: remove unused components, keep an inventory, and obtain software only from official sources.

On WordPress specifically, some updates now apply themselves. WordPress's own documentation says that since version 5.6, new installations receive minor and major core updates automatically by default, while plugin and theme updates are automatic only in special cases or when you turn them on. WordPress also recommends backing up before you update, "so if there are any issues you can restore your website".

A practical routine:

• Apply updates on a regular schedule, and security updates as soon as they appear.
• After updating, check the pages and forms that matter most.
• Remove plugins, apps and themes you no longer use. Every one you keep is something to update.

A backup that has never been restored is a hope, not a backup. The US Cybersecurity and Infrastructure Security Agency (CISA) advises organizations to "maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario." It warns that some attacks look for accessible backups and delete or encrypt them too.

For a small business website, that translates into:

• Automatic backups of the files and the database, at a frequency that matches how often the site changes. A shop taking orders daily needs more frequent backups than a five-page brochure site.
• At least one copy stored away from the site's own hosting, so a problem with the host does not take the backups with it.
• A test restore to a separate copy of the site from time to time, to prove it works.

On hosted platforms, find out exactly what the provider keeps and for how long, and what you can export yourself. Shopify, for example, can export products to a spreadsheet file, but its help center notes that product images are not included in the file.

You want to hear about a problem before your customers do. Two free signals help:

• Google Search Console's Security Issues report flags hacked content, malware and deceptive pages that Google has detected. Google says affected pages "can appear with a warning label in search results or an interstitial warning page in the browser when a user tries to visit them." Make sure alerts go to an inbox someone reads.
• Uptime monitoring, a simple service that checks the site every few minutes and emails you if it goes down.

Account security matters as much as software. The same web.dev guidance lists compromised passwords and social engineering (phishing) among the top ways sites are hacked. Use unique passwords, turn on two-factor sign-in for the site, hosting, domain and email accounts, and remove access for people who no longer need it.

Two expiry dates can take a working site offline overnight.

• The domain. Under ICANN's rules for generic domains such as .com, registrars must send renewal reminders approximately one month and one week before expiry. After expiry, the registrar must interrupt the domain's normal working for a period, and if the domain is then deleted, the registry offers a 30-day redemption period during which it can be restored. That is a safety net, not a plan. Set the domain to renew automatically, and keep the contact email on the account current, because a reminder sent to a former employee helps no one.
• The security certificate (the padlock, HTTPS). Many hosts use free certificates from Let's Encrypt, whose default certificates are valid for 90 days and are designed to renew automatically. If automatic renewal breaks, visitors see a browser warning. Check that renewal is automated and that someone is told if it fails.

The most expensive failures are silent: the page looks fine, but nothing reaches you. Once a week or once a month:

• Send a test enquiry through every form and confirm it arrives.
• If you take bookings or payments, use an agreed test procedure. For orders, prefer the platform’s test gateway or test mode in a suitable test environment. A real payment followed by a refund can incur fees. Do not switch a live shop into test mode during normal trading: customers cannot place live orders while it is active. Coordinate booking tests to avoid real notifications or reserved capacity.
• Click through the main navigation on a phone.
• Check that your analytics are still recording visits and enquiries.

Search Console is also worth a monthly look for pages Google cannot index and for drops in search clicks. Speed drifts too, as images and apps are added. Google's Core Web Vitals give clear targets (for example, the main content should appear within 2.5 seconds of the page starting to load, for at least three in four visits). Our guide to why a website is slow explains the usual causes.

Out-of-date content is a maintenance failure customers notice first: old prices, a team member who left, last year's opening hours, a discontinued product still for sale, an expired offer. Once a quarter, read every important page as a customer would. Update policies when they change. Remove or redirect pages for things you no longer offer, rather than leaving them to collect visits that go nowhere.

Accessibility can drift in the same way. A new image without a text description, a button added in a low-contrast color, a PDF menu that a screen reader cannot read: each is small, and together they shut some customers out.

The frequency depends on how much the site changes and how much depends on it. A rough pattern that suits most small business sites:

• Weekly: test the forms and checkout; read any alerts.
• Monthly: apply updates; confirm backups ran; review search and speed reports.
• Quarterly: test a restore; review content and remove unused plugins, apps and user accounts.
• Yearly: confirm the domain renews, the contacts are current, and the site still meets the accessibility and speed standards it launched with.

A shop with daily orders, a site with many plugins, or a site that handles personal data needs closer attention than a small brochure site on a hosted builder.

Maintenance keeps a site healthy. It will not make a site that is not bringing enquiries start bringing them, and it will not fix a structure that confuses visitors. If the problem is results rather than upkeep, that is a different job: understanding what visitors do and why.

Maintenance also has limits on old foundations. If a site depends on software that is no longer supported, regular updates eventually stop being possible, and rebuilding becomes the safer choice.

Care after launch is optional. Updates, backups, security and renewals are not included unless we agree them. If you want us to handle them, we write down what is covered and who does each job. See our website care service. Our approach page explains how we plan, build and launch sites, including handing over a site you own. If you are planning a new site, read how long a website project takes, and what changes it. Tell us about your project, and we reply with next steps. No cost, no obligation. Discuss your project

web.dev, "Top ways sites get hacked by spammers": https://web.dev/articles/top-ways-sites-get-hacked-by-spammers

OWASP Top 10 (2021), "A06: Vulnerable and Outdated Components": https://top10.owasp.org/2021/A06_2021-Vulnerable_and_Outdated_Components

WordPress Developer Resources, "Upgrading WordPress": https://developer.wordpress.org/advanced-administration/upgrade/upgrading/

CISA, "#StopRansomware Guide" (backups): https://www.cisa.gov/stopransomware/ransomware-guide

Google Search Console Help, "Security Issues report": https://support.google.com/webmasters/answer/9044101

ICANN, "Expired Registration Recovery Policy": https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-21-02-2024-en

Let's Encrypt, "FAQ" (certificate lifetime): https://letsencrypt.org/docs/faq/

web.dev, "Web Vitals": https://web.dev/articles/vitals

Shopify, "PCI DSS compliance": https://www.shopify.com/pci-compliant

Shopify Help Center, "Exporting products": https://help.shopify.com/en/manual/products/import-export/export-products