Website Maintenance: What It Includes and How Often

A website is not finished on launch day. From the first week, plugins release updates, browsers change, certificates approach expiry, content goes out of date and search engines adjust what they reward. A site that nobody looks after does not stay the same. It slowly gets slower, less secure and less visible, usually without anyone noticing until something breaks.

Website maintenance is the routine work that prevents this. In this guide we explain what it includes, how often each task should be done, how needs differ for corporate sites, online stores, WordPress and custom applications, what drives the cost, and when it makes sense to keep maintenance in-house or hand it to a team. It is based on how we support the sites we build as part of our corporate website development work.

What website maintenance is and why it matters

In simple terms, website maintenance is the regular set of technical, content and monitoring tasks that keep a website secure, fast, accurate and working as intended after launch. The goal is simple: the site should keep doing its job for the business, every day, without surprises.

What happens without it is predictable:

Security vulnerabilities. Outdated CMS cores, plugins and libraries are the most common entry point for attackers. Most attacks are automated and look for known vulnerabilities in old versions. An unmaintained site is exactly what they search for.

Falling speed. Images get added without optimization, plugins pile up, the database grows, caching settings drift. Each change is small, but after a year the site can load noticeably slower than at launch, which hurts both conversions and Core Web Vitals.

Lost rankings. Broken links, 404 errors after content changes, missing redirects, outdated sitemaps and slow pages all send negative signals to search engines. Rankings rarely drop overnight. They erode.

Downtime. An expired domain or SSL certificate, a full disk, a failed update. Uptime problems are often caused by things that were easy to prevent with a calendar reminder.

Technical debt. Every postponed update makes the next one harder. A site that skipped two years of updates may need a partial rebuild just to get back to a supported version. We wrote more about this in our article on technical debt and who is responsible for it.

Good maintenance is mostly invisible. Its value shows in what does not happen: no breaches, no downtime, no slow decline in traffic.

What website maintenance includes

What does website maintenance include in practice? We group the work into six areas. Together they make up the core list of website maintenance tasks for any business site.

Technical updates

• CMS core updates. WordPress, Drupal, Craft or any other CMS releases security and feature updates regularly. Security patches should be applied quickly, major versions after testing.

• Plugins, themes and modules. The most frequent source of vulnerabilities and conflicts. Update them regularly, remove the ones you no longer use.

• PHP version. Each PHP version has a fixed support period. Running an end-of-life version means no security fixes. Upgrading requires checking that the theme and plugins are compatible.

• Frameworks and runtimes. For custom sites and headless frontends, this means Node.js versions, frameworks such as Nuxt.js or Next.js, and npm or Composer dependencies.

All updates should first go to a staging copy, not straight to production. Staging is a private copy of the site on the same software versions. The team applies updates there, checks key pages, forms and checkout, and only then repeats the update on the live site. It adds an hour to the process and removes most of the risk of a broken layout or a white screen on Monday morning.

Keep a record of versions too. When something breaks two weeks after an update, knowing exactly which plugin changed from which version to which saves hours of guessing.

Check SEO after every significant update. A theme or plugin update can silently change titles, remove structured data, add noindex to pages or break redirects. After each significant update, open a few key pages, check their titles and indexing status and run a quick crawl of the most important templates.

Security and backups

• Backups. Automatic daily backups of files and database, stored separately from the main server, with several versions kept.

• Malware scans. Regular automated scans for injected code, suspicious files and blacklist status.

• Access review. Remove former employees and contractors, check admin roles, make sure two-factor authentication is on.

• SSL renewal. Certificates should renew automatically. From March 2026 the maximum validity of public TLS certificates is 200 days, and it will keep shrinking in the coming years, so manual renewal is no longer practical.

Security is a large topic on its own. We cover it in detail in our website security checklist.

Performance optimization

• Core Web Vitals. Monitor LCP, INP and CLS in Google Search Console and fix pages that fall into the “needs improvement” or “poor” range.

• Caching. Check that page, browser and server caching work correctly after updates and content changes.

• CDN. A content delivery network serves static files from servers close to the visitor. Review its settings and cache rules when the site structure changes.

• Image optimization. New images uploaded by editors are often too large. Automatic compression and modern formats such as WebP or AVIF keep pages light.

Content updates

• Outdated pages. Old offers, expired events, discontinued services, references to past years.

• Legal pages. Privacy policy, cookie policy and terms should match current laws and the tools you actually use.

• Team and pricing information. Contacts, addresses, team members, prices and opening hours change more often than people remember to update them.

Outdated content does not just look careless. It creates real problems when a client calls a closed office or expects a price you no longer offer.

For multilingual sites, add one more check: whether all language versions were updated together. It is common for the main language to get a new service description while the other versions still show last year’s text. Search engines and AI assistants may then quote the outdated version to people searching in that language.

SEO health checks

• Broken links. Internal and external links that lead nowhere hurt both users and crawling.

• 404 errors. Pages that were deleted or moved without a redirect. Check the Page indexing report in Google Search Console regularly.

• 301 redirects. Every changed URL needs a permanent redirect to its new address. Also check for redirect chains and loops.

• XML sitemap and robots.txt. The sitemap should include all important pages and nothing that returns errors. Robots.txt should not accidentally block important sections, which happens surprisingly often after updates or migrations.

• Google Search Console. Monitor indexing, manual actions, security issues and performance trends.

Analytics and tracking

• GA4. Check that data is being collected, that filters work and that key events are recorded.

• Google Tag Manager. Review tags and triggers after site changes. A redesigned form or a new button can silently break tracking.

• Form and conversion tracking. Test that every form actually sends leads to the right place and that conversions reach GA4 and ad platforms.

Broken tracking is one of the most expensive silent failures. Marketing decisions keep being made on data that stopped being accurate weeks ago.

Website maintenance checklist by frequency

This is the practical part. The website maintenance checklist below splits tasks by how often they should be done. Adjust it to your site, but keep the rhythm.

Weekly tasks

• Check that backups ran successfully and are stored off-site
• Review uptime monitoring alerts and response times
• Test key forms: contact, request a quote, checkout, newsletter signup
• Review security alerts from the firewall, security plugin or hosting
• For online stores: place a test order and check the payment flow

Monthly tasks

• Apply CMS, plugin and dependency updates after testing on staging
• Scan for broken links and new 404 errors
• Run a speed check on key templates: home, category, product, service pages
• Review analytics: traffic trends, conversions, sudden drops
• Check Google Search Console for indexing and security issues
• Run a malware scan

Quarterly tasks

• Review content: outdated pages, legal pages, prices, team, contacts
• Run an SEO audit: titles, meta descriptions, redirects, sitemap, internal links
• Audit access: remove unused accounts, review roles and passwords
• Do a restore test: restore a backup to a staging environment and check that it works
• Review tracking: tags, events, conversions

Yearly tasks

• Check domain renewal and auto-renew settings, and confirm SSL auto-renewal works
• Do a UX review: analyze user behavior, forms, navigation and mobile experience
• Run an accessibility audit against current WCAG requirements
• Review the tech stack: CMS version, PHP or Node.js version, hosting plan, end-of-life components
• Review the maintenance plan itself: what worked, what was missed, what to change

A short monthly report from whoever does the work keeps everyone aligned. It does not need to be long: which updates were applied, what was found and fixed, uptime for the month, any security events, speed and Core Web Vitals trends, and recommendations for the next month. If a report shows the same problem three months in a row, it is a signal that the issue needs a proper fix rather than another patch.

A checklist only works if someone owns it. Assign each task to a person or a contractor, and keep a simple log of what was done and when. That log becomes invaluable when something goes wrong and you need to know what changed.

Document the site, not just the tasks. Maintenance becomes much easier when basic documentation exists. It does not need to be long. One shared document should describe where the site is hosted and on which plan, where the code repository is, which CMS version, theme and plugins are installed and why, which integrations exist (CRM, forms, payments, analytics) and who owns each account, where backups are stored and how to restore them, and any known quirks, for example a plugin that must not be updated without testing a specific form. When the person who built the site leaves, this document is the difference between a smooth handover and weeks of reverse engineering.

Maintenance needs by website type

The checklist above applies to every site, but the weight of each area depends on what kind of site you run.

Corporate website. The focus is content accuracy, lead forms, analytics and security basics. Traffic and functionality are usually stable, so a monthly rhythm with quarterly content reviews works well for most companies. The biggest risk is that forms or tracking break unnoticed and leads disappear for weeks.

Ecommerce store. Ecommerce website maintenance is more intensive. Checkout, payment integrations, stock synchronization, shipping methods and product feeds must work every day. Price and catalog errors cost money directly. Online stores also face stricter security requirements, including PCI DSS for card payments, and peak seasons demand performance checks in advance. For most stores, weekly checks of the order flow and immediate security updates are the minimum.

WordPress website. WordPress powers a large share of the web, which makes it the main target for automated attacks. A WordPress maintenance checklist puts plugin updates, plugin audits, a security plugin, limited admin accounts and disabled unused features such as XML-RPC at the top. Many WordPress problems come from too many plugins, so reviewing what is installed is as important as updating it. If you run WordPress and need help with updates or hardening, our WordPress development team handles both.

Custom web application. Custom applications have no plugin marketplace, but they have dependencies: frameworks, libraries, runtimes, server software. Maintenance includes dependency updates, monitoring, log review, database maintenance and compatibility checks with third-party APIs that change over time. Custom code also needs developers who know it, which makes documentation and continuity of the team especially important.

How much website maintenance costs

Website maintenance cost depends on the site and on how much responsibility you want to hand over. There is no single price, but there are clear models and cost drivers.

Payment models:

• Hourly billing. You pay for actual hours spent. Suits small sites with occasional needs, but makes budgeting harder and usually means no guaranteed response time.

• Monthly retainer. A fixed monthly fee covers an agreed scope of work and a set number of hours. Predictable for both sides and the most common model for business sites.

• SLA tiers. A service level agreement defines response and resolution times for different types of issues, for example critical outages versus minor content changes. Higher tiers with faster response cost more.

Cost drivers:

• Platform and stack: a standard WordPress site is simpler to maintain than a custom application with many integrations.

• Size and complexity: number of pages, templates, languages and integrations.

• Ecommerce functionality: payments, stock, delivery and higher security requirements.

• Required response time: next business day versus within an hour, around the clock.

• Current state of the site: a site with years of postponed updates needs an initial clean-up before regular maintenance can start.

• Content work: whether maintenance includes regular content updates or only technical work.

The most accurate way to estimate maintenance is to look at the specific site. We review the platform, current versions, integrations and your expectations, and after that brief we propose a scope and an estimate that fits the site.

What a maintenance agreement should include. Whoever does the work, a written agreement prevents most misunderstandings. Check that it covers:

• Scope. Which tasks are included every month, and which are billed separately, such as new pages, redesign of sections or new integrations.

• Response and resolution times. Different times for different priorities, for example a critical outage, a broken form and a minor content change.

• Working hours. Whether the team responds at night and on weekends, and how to reach them.

• Reporting. What the monthly report contains and when you receive it.

• Access and ownership. That the domain, hosting, code and accounts belong to your company, and the contractor works through personal accounts.

• Exit terms. What the contractor hands over if you end the cooperation: access, documentation, the latest backup and a list of open issues.

A good agreement protects both sides and makes it easy to judge whether the service is working.

In-house vs outsourced website maintenance

There are three common ways to organize maintenance. Each can work, the right choice depends on your site and your team.

Website maintenance for small businesses usually works best as an agency retainer. A small company rarely needs a full-time developer, but it does need someone who reacts quickly when the site goes down and who handles updates without being reminded.

For larger products the line between maintenance and development blurs. If your site or application is constantly evolving, a dedicated development team combines maintenance with new features and keeps the same people working on the product.

When you compare offers, look past the hourly rate. Ask how updates are tested, where backups are stored and how often restores are tested, who is on call outside office hours, how incidents are reported to you, and what happens to access and documentation if you decide to change contractor. The answers tell you more about the quality of maintenance than the price list.

Whatever the model, agree on three things in writing: what is included, how fast the team responds to different issues, and who owns access to the hosting, domain, code and accounts.

What to do when something breaks. Even well-maintained sites have incidents. What matters is how quickly they are noticed and resolved. A basic incident process looks like this: monitoring detects the problem and alerts the responsible person, they assess whether it is critical (site down, checkout broken, data at risk) or minor, fix or roll back the last change, and then inform the business with a short explanation of what happened and what was done to prevent it. Agree in advance who can make decisions at night or on weekends, especially for online stores, where every hour of downtime is lost revenue.

Use maintenance hours to improve, not only to repair. Many companies treat maintenance purely as protection. The better approach is to reserve part of the monthly hours for small improvements: fixing a confusing form field found in session recordings, compressing a heavy page, improving internal links to an important service page, updating a case study. Each change is small, but over a year they add up to a noticeably better site, without the cost and risk of a big redesign.

Signs that your current maintenance is not working. You learn about outages from customers, not from monitoring. Nobody can tell you when the last backup was restored. Plugins and CMS are several versions behind. Reports are missing or say “all good” every month without details. Small requests take weeks. If you recognize two or more of these, review the agreement or the contractor before something breaks.

When maintenance is no longer enough

Maintenance keeps a site healthy, but it cannot fix a site that no longer fits the business. Signs that it is time for a redesign or rebuild:

• Legacy CMS or stack. The platform or major version is no longer supported, and updating it means rewriting large parts of the site anyway.

• Updates keep breaking things. Every update causes conflicts, and the team spends more time fixing side effects than improving the site.

• Performance cannot be fixed. Core Web Vitals stay poor despite optimization, because the problem is in the architecture or the theme.

• The business has outgrown the site. New services, markets, languages or ecommerce functions do not fit the existing structure.

• The design looks dated. Visitors judge credibility quickly, and an old design undermines trust even when everything works.

• Maintenance costs keep rising. When you pay more each year to keep an aging site alive, a rebuild often costs less over a few years.

If several of these apply, it is worth planning a redesign rather than adding more patches. Our website redesign checklist explains how to prepare for it without losing traffic.