What website maintenance actually needs doing
What a maintenance retainer should cover for a small business, from domain and SSL renewals to security patching and backup restore tests, plus which line items are padding and how a static or modern-framework build shrinks the list to almost nothing.
Small business website maintenance comes down to a short list: keep the domain and SSL certificate renewed, apply security updates to whatever software runs the site, take backups and prove one restores, check that forms and links still work, and keep the content accurate. Everything else on a typical retainer is optional. How long that list gets depends almost entirely on how the site was built.
- A lapsed domain can take down the website and the company email at once, which makes renewal the highest-stakes item on the list.
- Software updates are the bulk of recurring work on a plugin-based site, and a steady share of them close security holes that are already publicly documented.
- A backup nobody has restored is an assumption. Restoring one to a test address is the only way to confirm it.
- Contact forms fail quietly. When delivery breaks, there is usually no alert, and the inquiries just stop arriving.
- Static and framework-built sites have no third-party plugin layer to patch, so the routine list shrinks to renewals and content, plus the occasional framework or dependency security release.
What needs doing on every website?
Four things apply no matter what the site runs on. The domain registration has to stay current, ideally on auto-renew with a card that will not expire first, because email hosted on that domain usually goes down with it. The SSL certificate has to keep renewing, which most modern hosting handles automatically, though it is worth confirming. Contact forms need a real test message pushed through them on a schedule, since delivery depends on mail services that change their rules without notice. And the content has to stay true: hours, phone number, service area, staff, anything seasonal.
Why do software updates take up most of a maintenance plan?
Because a database-driven site is assembled from many separate pieces of software, each on its own release schedule. A typical WordPress install runs the core application, a theme, and a stack of plugins, on top of a PHP version that also gets updated. Security patches ship with a public description of the hole they close, and automated scanners work through lists of known vulnerable plugins. They do not care how small the business is.
That is why the work is legitimately monthly and risky to hand over entirely to an unattended process. Updates sometimes conflict with each other, or with a customization someone made years ago. The responsible pattern is to apply them on a copy of the site, load the pages that matter, submit a form, then push the change live. That is real labor, and charging for it is fair.
How do you know a backup actually works?
You restore one. A backup tool reporting success tells you a file got written, not that the file holds a complete, loadable copy of the site. Once or twice a year someone should take the most recent backup, restore it to a staging address, and open it. Databases get truncated. Uploads folders get skipped. Backups quietly stop running after a host migration and nobody notices for months. Storage location matters too: a copy kept only on the site's own server is thin protection.
How much maintenance does each kind of site need?
The workload varies enormously by build, and that difference drives what a retainer should cost.
| What needs doing | Plugin-based site (WordPress and similar) | Static or framework build (Next.js, Astro, Hugo) | Hosted builder (Squarespace, Wix, Shopify) |
|---|---|---|---|
| Core and plugin security updates | Monthly, sometimes more often | No public plugin layer; dependencies updated when the site next changes | Handled by the platform |
| Backups | Set up, monitored, and tested | Code in version control; content store backed up separately | Platform handles it, exports vary |
| Domain, SSL, link and form checks | Required | Required | Required, renewals often bundled |
| Server patching and uptime | Depends on the host plan | Handled by the platform | Handled by the platform |
| Ongoing effort | Hours per month | Minutes per month, plus edits | Close to none, plus edits |
Sites that execute code from many third-party authors need continuous attention. Sites that serve prebuilt pages from a managed platform need renewals and someone keeping the words honest. That is worth weighing before you decide how the site gets built in the first place.
What on a maintenance invoice is padding?
Anything you would not miss if it stopped. A few show up repeatedly:
- Monthly PDF reports restating analytics a free dashboard already displays, sent to someone who never opens them.
- Uptime monitoring billed separately when free monitoring covers a single site.
- Security scanning that amounts to a plugin emailing its own notifications.
- Unlimited edits on a site that gets edited twice a year.
None of these are dishonest on their face. They become padding when billed against a site that cannot benefit from them, which is a better question to raise before signing than after. The same reasoning applies to build quotes, covered in what a small business site costs in central PA.
When is a retainer worth paying, and when is it rent?
A retainer earns its place when the site is doing work. An online store, a booking system, a plugin stack, or a site whose lead flow would be missed within days all justify having someone watch it. So does the plain fact that nobody at the business wants to be the person applying updates and hoping nothing breaks.
It slides into rent when the site is a brochure nobody edits, hosted on a platform that patches itself, with the domain on auto-renew and a form that has worked for two years. The honest arrangement then is hourly work when something needs doing, plus a yearly check. This is half the argument for moving a brochure site off WordPress: the rebuild costs something once, and the recurring line afterward drops close to nothing. Whoever quotes you maintenance should itemize it, the same transparency you should expect on project pricing.
Common questions
Do I need maintenance if my website never changes?
Yes, but very little. The domain and certificate still have to renew, and the forms still need an occasional test. For a static site, that is close to the whole list. A plugin-based site that never changes still needs patching, because the software underneath keeps changing even when the content does not.
What happens if the SSL certificate expires?
Visitors get a full-page browser warning saying the connection is not private, and many turn back rather than click through it. Automatic renewal is standard on modern hosting, but it can break after a DNS change or a server move, so the expiry date is worth checking a few times a year.
Can I handle small business website maintenance myself?
Often yes, if the site is simple. Setting the domain to auto-renew, sending yourself a test message through the contact form each month, and clicking the main pages covers most of it. The parts worth handing off are plugin updates on a live commercial site and backup restore testing, since both can break things in ways that are hard to reverse.
How often should the site be backed up?
Match the frequency to how much work you are willing to redo. A site that changes a few times a year is fine with monthly backups. A store taking orders needs daily backups at minimum, and the order data usually matters more than the site files.
Is a maintenance plan the same thing as hosting?
No. Hosting is the server space and platform the site runs on. Maintenance is the human work of updating, checking, and fixing. Providers often bundle both into one monthly charge, which hides what you are buying. Ask for the split before signing.
Does rebuilding the site eliminate maintenance?
It shrinks the list rather than emptying it. Renewals, form checks, and content accuracy apply to more or less any site that stays online. What a modern build removes is the recurring core and plugin update work, the part that grows over time.
Need this kind of work for your organization?