Website Maintenance: What It Actually Covers, What Skipping It Costs, and When to Hand It Off

By Jacob Campbell · Published October 8, 2026 · Updated October 8, 2026 · 🛠️ Maintenance · 10 min read

Key facts

• 6 jobs — Backups, updates, security, monitoring, renewals and fixes make up real maintenance
• Monthly — The minimum sensible check-in for a small business site, even a quiet one
• Tested restores — A backup you have never restored is a hope, not a plan
• £99 / £199 — BugShield Shield Light and Shield Pro, per WordPress site per month (October 2026)

What website maintenance actually is

Maintenance is everything you do to keep an existing site safe, working and fast, as opposed to changing what it says or how it looks. A redesign is a project; maintenance is a habit. It is also not the same as hosting: your host keeps a server running, but in most shared and managed hosting arrangements it does not update your plugins, check that your contact form still delivers, or notice that a page has started loading twice as slowly.

How much maintenance a site needs depends mostly on how many moving parts it has. A WordPress site with a page builder, a theme and twenty plugins has dozens of independently updated pieces of software, each with its own release schedule and its own security history. A small static or custom-coded site has far fewer, but it still has a server, a domain, a certificate, forms and content that can go stale. Nobody gets to skip maintenance entirely; the question is how much, and who does it.

The six jobs that make up real maintenance

Strip away the marketing and almost every maintenance plan, or every sensible DIY routine, comes down to six jobs:

1. Backups. Complete copies of files and the database, stored somewhere other than the server they came from, kept long enough that you can go back to a version from before a problem started. The part most people skip is testing: restore a backup to a staging copy at least occasionally, so you know it actually works.
2. Updates. Core software, plugins, themes, and the server-side language version (on most sites, PHP). Updates close security holes and keep things compatible, but they also occasionally break things, which is why they should follow a fresh backup and be checked afterwards.
3. Security. Scanning for malware and unexpected file changes, keeping admin accounts to the people who need them, strong passwords and two-factor login, and sensible server configuration such as security headers.
4. Monitoring. Uptime checks that alert you when the site goes down, plus an eye on speed, including Core Web Vitals and server response time, which tend to degrade gradually rather than all at once.
5. Renewals. The domain name, the SSL certificate, and any paid licences for themes or plugins. Most of these renew automatically now, until a card expires.
6. Fixes. The small things that break: a form that stops sending, a layout that collapses after an update, a broken link, a checkout error. This is the part of maintenance that is hardest to schedule, because it happens when it happens.

Content housekeeping, such as updating opening hours, prices and old blog posts, sits alongside these. It matters for customers and for search, but it is usually the site owner’s job rather than a technical one.

What skipping it actually costs

The cost of skipped maintenance rarely arrives as one big bill. It shows up as a handful of predictable failures:

• A known vulnerability gets used. Most compromised small sites are not targeted by anyone in particular. Automated scanners look for software versions with published vulnerabilities, and on WordPress the large majority of those are in plugins rather than in core. An update that was available for months is the usual way in. Cleanup after a hack typically costs more, in money and lost days, than a year of routine updates.
• The site breaks and nobody knows. A contact form that silently stops delivering is the classic example. The site looks fine, so nobody checks, and the business simply gets fewer enquiries until someone asks why a customer never heard back.
• A certificate or domain expires. An expired certificate puts a full-page browser warning in front of every visitor. A lapsed domain takes the site and often the email with it, and recovering a domain after its grace period can be expensive or impossible. We cover the moving parts in our domains, DNS and SSL guide.
• Speed decays. Plugins accumulate, images get uploaded at full size, the database grows. Each change is small, but the combined effect is a site that is slower than it was at launch, with the conversion and search consequences that follow.
• A forced upgrade lands all at once. When a host retires an old PHP version, a site that has not been updated for years can stop working overnight, and the fix becomes a rushed project instead of a routine change.
• There is no clean backup. If the host has a failure, or a bad update corrupts the database, the only backup turns out to be the host’s own snapshot from the same server, or nothing at all.

None of these are exotic. They are the ordinary failure modes of software left alone, which is why a basic routine prevents most of them.

A realistic maintenance schedule

If you are doing it yourself, this is a schedule a small business can actually keep. Adjust the frequency up for busy online shops and down for very simple sites.

Continuously (automated)

• Uptime monitoring with email or text alerts.
• Off-site backups on a schedule: daily for shops and sites that change often, at least weekly for brochure sites.

Monthly

• Take a fresh backup, apply updates, then click through the key pages, forms and checkout.
• Submit a test enquiry through every form and confirm it arrives.
• Review security scan results and the list of admin users.
• Glance at uptime and speed reports for anything trending the wrong way.

Quarterly

• Restore a backup to a staging copy to prove it works.
• Remove plugins and themes you no longer use; inactive code can still be vulnerable.
• Run a speed test and a broken-link check, and look at Search Console for new errors.

Yearly

• Check domain and certificate renewal dates and the payment card behind them.
• Confirm your server language version is still supported.
• Review who has logins to the site, the host, the domain registrar and analytics, and remove anyone who has left.

For most small sites this is an hour or two a month once it is a habit. The hard part is not the work; it is remembering, and knowing what to do when an update does break something.

Do it yourself, or hand it off?

DIY maintenance makes sense when the site is simple, you are comfortable restoring a backup, and an hour of downtime would be an inconvenience rather than a loss. Handing it off makes sense when any of these are true:

• The site takes payments or bookings, so downtime or a broken checkout costs money by the hour.
• It runs on a large plugin stack, where updates regularly need someone who can diagnose conflicts.
• Nobody in the business would know how to restore a backup or clean up malware under pressure.
• You manage several sites and the routine has quietly stopped happening on some of them.

The trade-off is straightforward: a plan costs a monthly fee, and in return the routine actually happens and someone else is responsible when something breaks. It is worth comparing that fee against the cost of one bad week, not against zero.

What to check before you sign up for a maintenance plan

Maintenance plans vary more than their headline features suggest. These questions separate a useful plan from a reassuring-sounding one:

• Backups: how often, stored where, kept for how long, and how do you restore one? Can you restore it yourself, or do you have to wait for someone?
• Updates: are core, plugin and theme updates applied for you, and is anything checked after they run?
• Fixes: how many are included, what counts as one, and what happens when you go over the allowance?
• Response time: is there a stated response time, in writing, for when something breaks?
• Security: is malware only detected, or also removed, and is removal included in the price?
• Monitoring: what is checked (uptime, speed, SSL, domain) and how are you alerted?
• Platform: does the plan cover the platform your site actually runs on, and does it need anything installed on the site?
• Access and exit: can you cancel, and do you keep full ownership of your logins, files and backups if you do? Our guide to whether you really own your website covers why that last point matters.

A closer look: BugShield’s WordPress maintenance plans

Disclosure: BugShield is a content partner of BuiltToWinWeb. Everything in this section is taken from BugShield’s own published pages as of October 2026; check them for current prices and terms.

BugShield is a UK company that specialises in WordPress bug fixing and maintenance. Alongside one-off fixes, which it lists from £49.99 with no subscription, it offers two monthly plans, each priced per site. The plans run through a BugShield plugin installed on each subscribed site, which connects it to BugShield for monitoring, backups and scans.

• Shield Light (£99 per site per month): two bug fixes a month, with extra fixes charged at one-off rates and a stated fix response within 24 hours; weekly off-site backups with 100GB of storage; file integrity checks and security scans with alerts.
• Shield Pro (£199 per site per month): unlimited bug fixes with no overage charges and a stated response within one hour; daily backups plus on-demand copies before major changes, with 200GB of storage; active malware prevention, with detection and removal handled by the BugShield team.

Both plans include monitoring (uptime checks every five minutes, response time tracking, Core Web Vitals, plugin health, file integrity, SSL and domain alerts, and SEO audits), with alerts in the app and by email. BugShield lists managed “safe plugin, theme, and core updates” as part of the service. Backups cover files, theme, plugins, uploads and the database, are kept for 28 days, and can be restored from the dashboard yourself, with the team available to help. Fix requests are submitted from the dashboard and assigned to a developer, and a separate support chat for general questions does not use up the monthly fix allowance. If you run several sites, each has its own plan, so you can put a busy shop on Pro and a brochure site on Light under one account.

How it measures up against the checklist above. On paper it answers most of the questions that matter: backup frequency, retention and self-service restores are all stated, response times are in writing, and the difference between the tiers is clear. BugShield itself positions Light for sites that need dependable monitoring, weekly backups and up to two fixes a month, and Pro for business-critical or frequently changing sites such as a busy WooCommerce store, which matches how we would split them too.

Where it will not fit. It is WordPress only, so it is not an option for Shopify, Wix, or custom-coded sites. Pricing is in pounds sterling and per site, so an agency or owner with many sites should do the arithmetic before committing. And as with any plan built on a plugin, you are adding one more component to the site, which is the trade-off for having it monitored and backed up from outside. If those points do not rule it out, compare BugShield’s Shield Light and Shield Pro plans against whatever you are paying for now, including the hidden cost of doing it yourself.

Where custom-coded sites fit in

Most of what we build at BuiltToWinWeb is custom PHP rather than WordPress, and one practical reason is maintenance. A site without a plugin stack has far fewer third-party components to update and far fewer published vulnerabilities to chase, so the monthly routine is shorter. It is not zero: the server and PHP version still need updating, backups still need to exist off-site and be tested, the certificate and domain still renew, forms still need checking, and speed still needs watching. If you are deciding between platforms, our redesign vs rebuild guide covers when moving off a heavy stack is worth it, and our website maintenance service covers the sites we build and look after ourselves.

The bottom line

Maintenance is unglamorous, but it is cheap compared with what it prevents. At a minimum, every site needs off-site backups you have actually restored, regular updates, uptime monitoring, renewal dates you are tracking, and a monthly check that the forms still work. If you can keep that routine yourself, do. If you cannot, or the site earns enough that a bad week would hurt, pay someone to keep it for you, and use the checklist above to make sure the plan you choose covers what it claims to.

Related reading

• Website maintenance and support — How BuiltToWinWeb keeps the custom sites it builds updated, backed up and fast.
• Security headers for small business — CSP, HSTS and the other headers worth setting, with copy-paste config.
• TTFB and hosting speed — How to measure server response time and the fixes that cut it.
• Custom domains, DNS and SSL — The renewals and records that take a site offline when they lapse.
• Do you own your website? — Code, data and domain ownership, and what to keep control of.

Frequently asked questions

What does website maintenance include?

Six core jobs: off-site backups, software updates, security scanning, uptime and speed monitoring, domain and SSL renewals, and fixing things that break, such as forms or layouts after an update.

How often should a website be maintained?

Backups and uptime monitoring should run automatically, updates and a form test should happen at least monthly, and backup restores, plugin clean-ups and speed checks quarterly. Busy online shops need more frequent attention than simple brochure sites.

What happens if I do not maintain my website?

The usual results are a hack through an outdated plugin, a form that silently stops sending enquiries, an expired SSL certificate or domain, gradually slower pages, and no clean backup when something finally goes wrong.

How much does a website maintenance plan cost?

It varies with platform and scope. As one example, BugShield lists WordPress plans at £99 per site per month for Shield Light and £199 per site per month for Shield Pro as of October 2026, with one-off fixes from £49.99.

Do custom-coded websites need maintenance?

Yes, but usually less. Without a plugin stack there are fewer components to update, but the server, PHP version, backups, SSL certificate, domain, forms and speed still need regular attention.