TJ Slade
Web designer · Kansas City
Launch day feels like the finish line. The site goes live, the announcement goes out, everyone moves on. Then eleven months pass and somebody mentions, casually, that they tried to reach you through the website a while back and never heard anything. I'm TJ Slade, I build small business websites, and this is the honest version of what website maintenance involves after launch, what it costs to skip, and how much of it you can do yourself in fifteen minutes a month.
Nobody sells maintenance well, because the pitch is bad. You pay every month for a list of things that mostly do not happen. It sounds like an extended warranty on a toaster. The reason it is not is that a website is not a finished object sitting on a shelf. It is software, connected to the internet, running on top of other people's software, all of which keeps changing underneath it whether or not you touch anything.
The short version: what website maintenance actually is
Strip the jargon out and every maintenance plan on earth is some combination of these:
- Security updates to the software your site runs on, including plugins and themes.
- Backups, taken automatically and actually verified.
- Uptime monitoring, so you find out the site is down before a customer tells you.
- SSL certificate renewal, so the browser never warns people away from you.
- Contact form testing, because forms break silently and often.
- Broken link and error checks after content changes.
- Speed and image upkeep, because pages get heavier over time, never lighter.
- Small content edits: hours, prices, staff, seasonal notices, the copyright year.
- Domain renewal, which is not really maintenance right up until the day you forget it.
That is the whole list. So if someone quotes you a maintenance plan, ask which of those it covers and who is responsible for the rest. Some plans are hosting with a nicer name. A few are genuinely thorough. The word by itself tells you nothing.
Security updates are the one you cannot skip
If your site runs on WordPress, or any CMS with plugins, this is the whole ballgame. Every plugin is software written by someone else, and a hole in any one of them is a hole in your site. Updates ship constantly. Skipping them for a year is how a working site quietly becomes a site that serves spam pages to Google, and the first sign is usually a search result for pharmaceuticals with your domain sitting under it.
This is not a web design opinion, it is ordinary security hygiene. The federal cybersecurity agency's advice on keeping software updated is the same for a website as for the phone in your pocket: turn on automatic updates where you can and apply the rest promptly. The difference is that nobody nags a website owner the way a phone nags you.
It is also the strongest argument for thinking about maintenance before the site is built. A hand-built static site has far less to attack, because there is no login screen, no plugin ecosystem, and no database sitting on the public internet. That is one of the real differences between a static site and a CMS, and it shows up as a smaller maintenance bill for years afterward.
A backup only counts if someone has restored one
Almost every host advertises backups. Far fewer people have ever confirmed that those backups restore, and a backup nobody has restored is a rumor. I have run into a site with a year of nightly backups where every file in them was empty, which nobody found out until the day it mattered.
Ask your host or your designer two questions. How often are backups taken, and how far back do they go? And has anyone actually restored one? The second question is the one that matters. Where they are stored is worth asking too, because a backup living on the same server as the site is not much help when the server is the problem.
The quiet decay nobody schedules
The dramatic failures are rare. The ordinary ones are constant, and they cost more in total because they run for months before anyone notices.
Contact forms break. Email settings change, a plugin updates, a spam filter gets aggressive, and submissions go nowhere while the visitor sees a cheerful thank-you message. Pages get slower as photos are uploaded straight off a phone at full size, and by the time anyone measures it the homepage weighs five megabytes. Content goes stale in ways that are invisible from the inside: last year's hours, a staff page with two people who left, a copyright date that makes a stranger wonder whether you are still open. Those are three of the signs a website is quietly losing customers, and all three are maintenance problems rather than design problems.
Speed in particular is a slow leak instead of a break. A site that launched fast rarely stays fast on its own, and website speed matters more to your phone ringing than almost anything else on the page. Ten minutes of image compression a couple of times a year usually holds the line.
What you can do yourself, and what you should not
Plenty of this is yours if you want it. Here is the split I would suggest to any owner. Do these yourself, monthly, in about fifteen minutes:
- Submit your own contact form from your phone and confirm the message lands in the inbox you actually read, spam folder included.
- Load your homepage on a phone with wifi off and make sure it is readable in about three seconds.
- Check that your hours, phone number, address, and prices are still true.
- Skim for anything seasonal that has expired, the copyright year in the footer included.
Then these quarterly, in about an hour:
- Click every link in your main menu and footer and note anything that errors.
- Compress any images added since last time, before they pile up.
- Open Search Console and look for crawl errors and pages that fell out of the index.
- Reread your two most important pages as a stranger would, and fix whatever is no longer true.
Leave these to whoever maintains the site: core and plugin updates on a CMS, PHP and server version upgrades, SSL renewal, database work, and anything involving a redirect. Not because they are mysterious, but because the failure mode is the whole site rather than one page, and the fix usually needs a backup and a staging copy, which is exactly what a maintenance arrangement is for.
What it costs, and what skipping it costs
Maintenance usually gets sold in two pieces: hosting, which covers the machine your site lives on and the routine protection around it, and a care plan or retainer, which covers a person's time for edits and fixes. Hosting with me includes SSL, daily verified backups, uptime monitoring, security patching, and caching, because none of that is optional and I would rather not have to ask. Time for changes is a separate line, monthly or hourly, and the current ranges are on the pricing page.
The cost of skipping it is lumpy, which is exactly why it fools people. Nothing happens for a long stretch, then one thing happens that costs more than several years of the plan you did not buy: a hacked site cleaned up and cleared of Google's warning label, a domain that expired and got bought out from under you, six months of leads that walked into a dead form. I would rather you pay a little and stay bored than save it and get an interesting month.
If you are not sure what shape your site is in
Run the fifteen minute check above first. It is free, and it will tell you more than most paid audits. If everything passes, your site is probably fine and your money belongs somewhere else. If you find something and cannot tell whether it is a five minute fix or a real problem, send me the address and I will look and tell you straight. And if you inherited a site nobody has touched in years and you do not even know where it is hosted, that is a normal place to start from. Finding out is the first thing I would do.