Website maintenance is the ongoing work that keeps a website online, secure and accurate after launch. For a small business site of a few pages, that means four things: keeping the software updated, making sure the site stays up and secure, having a way to undo mistakes, and changing the content when your business changes.
None of it is hard on its own. The problem is that it never stops, and most of it is invisible until something breaks. Launch day, the end of the build timeline, is where maintenance starts.
What maintenance means for a five-page site
Most guides about website maintenance are written for companies with large sites and a team to run them. A small business site is simpler. There's no product catalog with thousands of pages and no team of editors. But the same basic risks apply:
- Software gets old. Every website runs on software, and that software stops getting security fixes at some point.
- Things expire. Your domain renews every year, and the certificate that puts the padlock next to your address has its own expiry date.
- Content goes stale. Hours change, prices change, a service gets added or dropped, and the site keeps saying the old thing.
- Sites go down. A server problem, a failed update or an expired payment can take a site offline, and you might not notice for days.
Maintenance is the routine that catches each of these before a customer does.
The routine, week by week and year by year
- Every week
- Every month
- Every few months
- Every year
Weekly, monthly, every few months and yearly checks.
| How often | What to do |
|---|---|
| Every week | Check that the site loads and the contact form works. Reply to messages that came through it. |
| Every month | Apply updates. Check your numbers in Google Search Console. Update anything that changed: hours, prices, photos, services. |
| Every few months | Read every page as if you were a customer. Remove what's out of date. Check that every link and button works on your phone, and run a speed test. |
| Every year | Renew the domain. Review your plan or hosting. Refresh photos and the questions people ask most. |
If that table looks like a lot, it's the reason maintenance plans exist. If it looks manageable, you can do most of it yourself.
Security and software updates
Updates are the part people skip, and the part that matters most. The US Cybersecurity and Infrastructure Security Agency calls patching "one of the most cost-effective practices to improve your security posture" for small businesses.
What that means depends on how your site is built:
- Website builders like Squarespace and Wix update their own software. You don't apply updates, but you still keep your account secure and your content accurate.
- WordPress updates itself partly. Since version 3.7, minor and security updates apply automatically in the background on most sites, but major releases still need someone to click "Update Now".
- The server software matters too. Many sites run on PHP, and each PHP version gets about four years of support. PHP's own support table shows version 8.2 receiving security fixes only until December 31, 2026. A site still on an older version after that gets no security fixes at all.
Plugins are where WordPress sites break
On WordPress, most of the work is in the plugins: the add-ons for forms, galleries, bookings and everything else. WordPress's own documentation says you should keep your plugins up to date because updates improve "security and performance", and it tells you to make sure you have a current backup before updating them. Since WordPress 5.5 you can turn on automatic updates plugin by plugin.
Two habits help more than any tool. Delete plugins you no longer use, since an inactive plugin is still code sitting on your server. And before you install a new one, check whether its listing says "Untested with your version of WordPress".
Logins
Turn on two-step login for every account connected to the site: the website, the domain registrar and the email. CISA's advice is blunt: any form of multifactor authentication is better than none.
The padlock and the domain
Two things expire on a schedule, and both can take your site down if nobody watches them.
The certificate. The padlock in the browser comes from a certificate that has to be renewed. Let's Encrypt, a free certificate authority, makes its default certificates valid for 90 days and recommends renewing every 60. Most hosts renew automatically, but someone should know when it happens and notice when it fails.
The domain. Domains renew every year. If it expires, your site and any email on that domain can stop working until it's renewed. Keep the domain in your own name and make sure the renewal card on file is still valid.
Backups and undoing mistakes
A backup is only useful if you can restore from it. CISA puts it plainly: "it's critical to regularly test partial and full restores". A backup nobody has ever restored is a guess.
For a small site, ask two questions:
- If an update breaks the site, can it be rolled back? WordPress recommends backing up before every update for exactly this reason.
- If someone deletes a page or a menu by mistake, can it come back? That's a different kind of backup: one for the content.
On the sites I build, the code is versioned, so any change I make can be rolled back.
Keeping the content true
Most maintenance is the website keeping up with the business: new prices, a new service, holiday hours, a dish that's no longer on the menu.
I look after the website of Sazón de Mi Cuba, my sister's kitchen in Lakeland. It changes constantly, based on what she asks for. She edits the menu, prices and photos herself and sends me the rest. That's what maintenance looks like for most small businesses: a steady trickle of small changes. A restaurant website changes more often than most, because the menu is the page people use.
Your Google Business Profile needs the same care. Google lets you edit your profile to keep your business info accurate, including special hours for holidays. If your website and your profile disagree, customers don't know which one to believe.
Speed: new photos are the usual cause
A site that was fast on launch day can get slow one upload at a time. A phone photo straight from the camera is often far larger than the page needs, and a few of those can make a page drag on mobile data.
Google measures how a page feels with three numbers it calls Core Web Vitals. Its guidance is that the main content should appear within 2.5 seconds, the page should respond to a tap within 200 milliseconds, and the layout shouldn't jump around (a layout shift score of 0.1 or less). You don't need to memorize those. Run your main pages through PageSpeed Insights every few months, and if a page gets worse after you added photos, resize the photos.
Accessibility: every new page and photo counts
The ADA applies to businesses open to the public, and the Department of Justice says that includes what they offer on the web. It points to the Web Content Accessibility Guidelines as guidance.
For maintenance, that mostly means the content you add later. A new photo needs a short text description. A new button needs readable contrast. A new PDF menu is harder to use than a menu on the page itself. These are small habits, and they're easier to keep than to fix later.
Signs your site needs attention now
Some problems announce themselves. If you see any of these, don't wait for the monthly check:
- A browser warning instead of your site, often an expired certificate.
- The contact form stopped sending. Messages stop arriving, and nobody tells you, because nobody can reach you.
- A security warning from Google. Search Console has a security issues report, and Google says affected sites can show "a warning label in search results or an interstitial warning page in the browser".
- Searches drop suddenly in Search Console with no change on your side.
- A customer quotes an old price or old hours back to you.
Checking that it still works for you
Once a month, look at two things:
- Google Search Console, a free Google service that shows how often your site appears in search results and which searches bring people in.
- Your inquiries. How many messages, calls or orders came from the site. That's the number that tells you whether the website is doing its job.
If both stay flat for a few months, the site probably needs clearer words before it needs a redesign.
Do it yourself or pay for a plan
Doing it yourself makes sense when the site is on a website builder, you're comfortable with its editor, and you'll keep up with the monthly check. A builder handles the hosting and software updates, so most of the work left is content.
A plan makes sense when the site runs on software that needs updating, when you'd rather spend the time on the business, or when you want someone to get the alert at night when the site goes down. Here's how to compare website maintenance plans and what each one should include.
What I include
My care plan is $100 a month: hosting, software updates, security checks, uptime monitoring (if your site goes down, I get the alert and fix it), 30 minutes of small content updates every month, a reply within one business day, and a short monthly report. The full details are on my website maintenance services page. If your site already exists, the starting point is the Website & SEO review.
Questions people ask about website maintenance
What is website maintenance? The ongoing work that keeps a website running: updates, security, backups, uptime checks and content changes.
How often does a website need maintenance? A quick check every week, updates and content changes every month, a full read-through and speed test every few months, and the domain renewal every year.
Does a Wix or Squarespace site need maintenance? Less than WordPress, since the platform updates its own software. The content still needs updating, and someone still has to notice when something stops working.
What happens if I don't maintain my website? Usually nothing at first. Then an expired certificate shows visitors a warning, an old plugin gets exploited, or a customer shows up during hours you changed months ago.
How much does website maintenance cost? It depends on what's included. The guide to maintenance plans breaks a plan into its parts, and the 3-year cost calculator puts it next to the cost of the website itself.
If you're still planning the website itself, start with the guide to small business websites.
Sources
- CISA: Cyber guidance for small businesses
- WordPress.org: Updating WordPress
- WordPress.org: Manage plugins
- PHP: Supported versions
- Let's Encrypt: FAQ
- web.dev: Web Vitals
- ADA.gov: Guidance on web accessibility and the ADA
- W3C: WCAG 2 overview
- Google Business Profile Help: Edit your Business Profile
- Google Search Console Help: Security issues report
- Google Search Console Help: About Search Console
