Most small business owners are in one of two places with their website. Either nobody is touching it and they are hoping for the best, or they are paying a monthly retainer and not entirely sure what they are getting for it. Neither is a good place to be. This guide helps you work out what maintenance should actually cover, how to spot a padded plan, and what the do-nothing option is genuinely costing you.

What “maintenance” actually means

The word gets used loosely. Strip it back and there are four things a maintained site needs, every month without fail.

  • Software updates. Your site runs on a platform, and that platform has plugins or extensions, a theme, and a core version. Each one is a door. An out-of-date plugin is the most common way a small business site gets compromised, because attackers scan for known vulnerabilities in bulk. They dont target you personally - they target the version number.
  • Backups. A backup that lives on the same server as the site is not a backup. It should be off-site, versioned (meaning you can go back more than one step), and tested occasionally. If your provider cannot tell you where the backup lives and how far back it goes, that is your answer.
  • Uptime and form monitoring. A broken contact form can sit there for weeks. Nobody complains because the person who tried it just moved on. Uptime monitoring, a check that pings the site every few minutes and alerts someone if it goes down, catches the obvious failures. Form testing catches the quiet ones.
  • Domain and SSL housekeeping. An expired domain hands your address to whoever registers it next. An expired SSL certificate, the padlock in the browser bar, kills trust and can drop you out of search results. Both are calendar jobs that should never be left to chance.

That is the floor. Anything below it is not maintenance - its just hosting.

The three options, honestly

You have three real choices. Here is what each one involves.

Option one: do nothing

It costs nothing now and it costs unpredictably later. Work out your own number: how many enquiries does your site generate in a week? Multiply that by the average job value. Now ask how long your site could be down, hacked, or showing a broken form before you noticed. A week is not unusual. Two weeks happens. Thats the exposure sitting in the do-nothing column. Add the cost of emergency recovery, which is always higher than planned maintenance, and the occasional cost of rebuilding trust with a customer who saw something alarming on your site. The number is yours to run, but it is not zero.

Option two: manage it yourself

If you or someone on your team is comfortable in the platform, this is legitimate. The honest cost is time: logging in, running updates, checking they havent broken anything, verifying backups, testing forms, tracking renewal dates. Budget at least an hour a month if everything goes smoothly, and a half-day when something breaks after an update, which it will occasionally. If that hour has a real value to you, put it in the column. If you genuinely enjoy it, fine. Most owners dont.

Option three: a care plan from a provider

This is where the range in the market is wide. What you are buying is someone else’s time and attention on a schedule. The things worth paying for: off-site backups with a clear retention period, update runs with a post-update check, uptime alerting, domain and certificate tracking, and a defined way to submit small content changes.

That last one matters more than it sounds. The batching trick is simple and it saves everyone time: collect your changes across the month, a price update here, a new team member there, a tweak to the opening hours, then send one message, one run. One round of back-and-forth instead of six. A good care plan has a clear process for this. A padded one charges you each time as if it were a project.

Questions worth asking any provider before you sign:

  • Where do backups live, and how far back can you restore?
  • What happens after an update breaks something - is that included or billed separately?
  • How do I submit content changes, and what is the turnaround?
  • Who holds the domain and the hosting login - you or me?
  • What is not included?

That last question is the most revealing. A provider who answers it clearly is telling you the truth. One who deflects is selling you vagueness.

What a fair plan covers and what it doesnt

A fair care plan covers the four things listed above plus a small allowance for minor content changes, maybe thirty minutes a month, enough for text edits and a photo swap but not a redesign. New pages, new functionality, and anything that needs design work are change requests, scoped and agreed separately. If a plan bundles unlimited changes into a low monthly fee, someone is absorbing that cost somewhere, and it usually shows up in slow turnarounds or work that gets quietly deprioritised.

The thing that separates a real plan from a padded one is specificity. You should be able to read the scope and know exactly what happens each month, who does it, and what falls outside it. If the description is vague, the value will be too.

The honest recommendation

If your site generates enquiries or sales, it is infrastructure. You would not leave the phones unattended or skip the insurance renewal. The question is not whether to maintain it - its who does the maintaining and whether the price is justified by what is actually included. Run your own numbers on the do-nothing risk, ask the questions above of any provider you are considering, and make the decision on evidence rather than habit.

If you want a second opinion on what your current setup covers, or you are not sure whether what you are paying for is actually being done, we can take a look and tell you plainly what we see. No obligation - just a straight answer.