Launch day is the beginning of the website's life, not the end of the project. Most sites that fail do not fail dramatically — they decay: an expired certificate, a stale price list, a backup nobody ever tested. Here is what maintenance actually consists of, what it costs, and what happens when it is skipped.
What actually goes wrong after launch
In nine years, the emergencies we have been called into cluster into a short and repetitive list:
- An expired SSL certificate. Every browser shows a full-page security warning. Traffic stops instantly. Fixing it takes ten minutes; noticing it took four days.
- A domain that quietly expired because the renewal notice went to an employee who left two years ago.
- Compromise through an outdated component. Almost always an unattended plugin or library with a published vulnerability.
- A silent form. The mail configuration changed, submissions stopped arriving, and nobody noticed for weeks because a broken form looks exactly like a quiet month.
- Content that became false. Old prices, a discontinued service, last year's holiday hours. This one costs the most and is reported the least.
- A backup that did not restore. Backups were running. Nobody had ever tried restoring one.
None of these are exotic failures. Every one of them is prevented by a routine that takes minutes per month.
Backups you have actually tested
A backup that has never been restored is a belief, not a backup. Three rules make the difference:
- Off-server. A backup stored on the same machine as the site disappears with the machine. Keep at least one copy elsewhere.
- Versioned. Keep daily copies for a week, weekly for a month, monthly for a year. Some problems — a bad edit, a slow compromise — are only noticed weeks later.
- Tested. Restore to a staging copy at least twice a year and confirm the site actually works, including forms and images.
What a real backup contains
Files and database are the obvious parts. Also record DNS settings, mail routing, environment configuration and the list of accounts with access. Rebuilding a site from files alone, without knowing where the domain points or how mail is routed, still means a day of downtime.
Updates, and how to apply them without breaking things
Every dependency is a maintenance obligation you accepted when you added it. This is a large part of why we build with as few as possible: a site with three dependencies has three things to watch; a typical plugin-heavy site has forty.
| Update type | When | Risk |
|---|---|---|
| Security patch | Within 72 hours | Low — apply promptly |
| Minor version | Monthly | Low, but test forms afterwards |
| Major version | Planned, on staging first | High — breaking changes are normal |
| Server / platform | Scheduled with the provider | Medium — confirm compatibility first |
| Abandoned component | Replace, do not update | Highest — unmaintained code accumulates known holes |
The procedure that avoids nearly every bad outcome: back up, apply on a staging copy, click through the critical paths, then apply to production during a quiet hour. Never on a Friday afternoon.
Monitoring: knowing before your customers do
The worst way to discover an outage is a customer mentioning it. Basic monitoring is inexpensive and, for a business site, effectively mandatory.
- Uptime checks every minute from more than one location, alerting by e-mail and phone
- Certificate expiry alerts at 30, 14 and 7 days — automated renewal still fails occasionally
- Domain expiry alerts at 60 and 30 days, sent to more than one person
- Form delivery checks — a scheduled test submission that alerts if it does not arrive
- Content change detection on the homepage, which catches defacement quickly
- Performance checks monthly, to catch the slow drift that follows content updates
- Search console errors reviewed monthly for crawl problems and manual actions
Security basics that stop almost everything
Small business sites are rarely targeted deliberately. They are found by automated scanners looking for known vulnerabilities across millions of addresses. That is good news, because generic attacks are stopped by generic defences.
- HTTPS everywhere, with HTTP redirected and HSTS enabled
- Unique passwords in a password manager, and two-factor authentication on hosting, domain and mail
- Least privilege: editors get editor accounts; remove access the day someone leaves
- Keep the attack surface small — delete unused plugins, themes, test files and old staging copies rather than deactivating them
- Rate-limit login attempts and change any default admin path
- Set security headers — content security policy, X-Content-Type-Options, Referrer-Policy
- Server-side form validation and a honeypot; never trust the browser's checks alone
- Keep an incident plan: who to call, where the backups are, how to take the site offline gracefully
The single highest-return security measure for a small business is two-factor authentication on the domain registrar account. Losing the domain is the one failure from which recovery is measured in weeks, not hours.
Content maintenance — the part that earns money
Technical maintenance prevents losses. Content maintenance produces gains, and it is the part most often skipped because nothing visibly breaks when it is not done.
| Frequency | Task |
|---|---|
| Monthly | Check prices, hours and contact details; add photos; reply to reviews; publish one update |
| Quarterly | Re-read the main service pages; check every form arrives; review search performance; check all languages match |
| Twice a year | Restore a backup to staging; audit performance; review structured data; check for broken links |
| Annually | Audit directory listings and NAP; review the whole content set for accuracy; confirm legal pages are current |
Special hours deserve their own note. Holiday closures, seasonal schedules and one-off changes should be entered as soon as they are decided, in the website and the business profile together. A customer who arrives at a closed door because your site said otherwise usually tells everyone about it.
What it costs, and what skipping it costs
Maintenance is priced by how often the site changes, not by how big it is. Our own plans run from €39 to €190 per month, and the pattern across the industry is similar.
| Level | Typical monthly | Suits |
|---|---|---|
| Technical only | €30–€50 | Stable brochure sites where the owner edits content |
| Technical + content | €80–€120 | Restaurants and clinics with changing menus and prices |
| Partner level | €150–€250 | Businesses adding pages, campaigns and languages regularly |
| None | €0 | Sites that will be rebuilt in two years anyway |
That last row is a real option, honestly stated. Some businesses genuinely prefer to run a site untouched and replace it when it becomes embarrassing. The mistake is choosing that path by accident and discovering it during an outage.
Weigh it against the alternative. A day of downtime at peak season, a compromise requiring a rebuild, or a menu that has been wrong for six months all cost considerably more than a year of maintenance. Most of what we charge for is not repair — it is the routine that means repair is never needed.
Questions people ask about this
You need the tasks done; a plan is one way to guarantee that. If you have someone technical who will genuinely apply updates, verify backups and check that forms still deliver, do it in-house. The failure mode is assuming somebody is doing it when nobody is.
Daily for anything that changes, weekly at minimum for a static brochure site. Keep versioned copies — daily for a week, weekly for a month, monthly for a year — stored off-server, and restore one to staging at least twice a year to prove it works.
Known vulnerabilities are published together with their fixes, which is exactly what automated scanners use. An unpatched site is typically compromised for spam or redirects rather than targeted, and cleaning it up costs far more than the update would have.
Between €30 and €50 per month for technical care only, €80 to €120 when regular content updates are included, and €150 to €250 for businesses adding pages and campaigns regularly. Pricing follows how often the site changes, not how many pages it has.
Much of it, yes — content updates, review replies, checking hours. Delegate the parts with a real failure cost: certificate and domain renewals, security patching, backup verification and monitoring. Those are cheap to outsource and expensive to forget.
The short version
- Most post-launch failures are certificates, domains, patches, silent forms and stale content
- A backup is not a backup until you have restored it to staging successfully
- Patch security issues within 72 hours; test major upgrades on staging first
- Monitor uptime, certificate expiry, domain expiry and form delivery — automatically
- Two-factor authentication on the registrar is the highest-return security step you can take
- Content maintenance is the part that earns; technical maintenance is the part that protects
- Deciding to skip maintenance is legitimate — discovering you skipped it is not
