Website maintenance is the ongoing, scheduled work of keeping a site secure, functional and fast: updating software, monitoring security, testing backups, checking uptime and fixing small faults before they become outages. Without it, even a well-built website quietly degrades until something breaks publicly, expensively and at the worst possible moment.
What actually breaks on unmaintained websites
The failure modes are consistent. Hacked WordPress installs top the list: a plugin with a known vulnerability sits unpatched, an automated bot finds it, and the site starts serving malware or spam. Sucuri’s Hacked Website Trend report found WordPress accounted for 90% of the hacked CMS sites it cleaned, with vulnerable plugins the primary attack vector. Most weren’t running old WordPress core — the plugins were the hole.
Then the quieter disasters. PHP updates break plugins when a host upgrades the server language version and a theme still relies on deprecated functions — sometimes a full white screen of death. Plugin conflicts after auto-updates are the same class of failure: two plugins update on the same morning, disagree, and the checkout page silently stops working. Nobody notices for days.
Expired SSL certificates are the most embarrassing failure of all: browsers flash full-page warnings, visitors bounce, and trust evaporates. Let’s Encrypt certificates last 90 days, so renewal is a constant loop. And backup failures discovered too late — the backup plugin has errored for months, and you learn that only when you need the restore. At that point there is no restore.
Maintenance as risk management, not housekeeping
A website is a revenue asset with known failure modes, and a care plan is insurance against them. A Liquid Web survey of 200+ SMBs found downtime costs an average of $20,172 per year in lost revenue, with 67% reporting direct revenue loss. For UK firms it’s bleaker: Beaming estimated British businesses lost ~150 million hours of internet downtime in one year — roughly £12 billion in lost productivity.
Care plans vs break-fix: the real cost math
| Break-fix | Care plan | |
|---|---|---|
| Response time | Hours to days after someone notices | Caught in scheduled checks, often before symptoms |
| Hack cleanup | Emergency rates, £800–£2,000+ per incident | Monitoring and hardening; most incidents prevented |
| Update conflicts | Discovered by visitors or by luck | Caught in staging before touching the live site |
| Backups | Restored from whatever exists (or doesn’t) | Tested restores, off-site copies, documented history |
| Uptime monitoring | Found out from an angry customer | Alert within minutes |
| Monthly cost | £0 until catastrophe, then very expensive | Predictable: £60–£250/month in the UK |
The honest caveat: a care plan is not cheaper in every single month. It is cheaper over any multi-year horizon, and it buys something break-fix never can — certainty that someone is watching.
Security realities: what maintenance actually prevents (and what it can’t)
No host, firewall or plugin makes a website unhackable. If a provider claims their security makes hacking impossible, that is a sales pitch, not a fact. What disciplined maintenance does is shrink the attack surface so automated, opportunistic attacks — the overwhelming majority — pass you by.
The data shows where real risk lives. Sucuri and Wordfence figures compiled by HowToWP indicate around 81% of hacked WordPress sites involved weak or stolen passwords as a contributing factor. That is a credential problem, fixed by maintenance habits: enforced strong passwords, two-factor authentication, limited admin accounts. Meanwhile Patchstack’s Mid-Year 2025 analysis found 57% of newly discovered WordPress vulnerabilities required no authentication at all — a bot needs no password, just one vulnerable plugin. That is a patching problem, and only scheduled patching solves it.
So maintenance prevents the attacks that matter: credential-stuffing against login pages, mass exploitation of known plugin flaws, reinfection after cleanup. It cannot stop a determined targeted adversary. We say that plainly in every engagement.
What we check every month
A care plan is only as good as its checklist. Ours runs monthly, in staging first, so updates never touch the live site untested:
- Full off-site backup, then a test restore. Files and database go to storage separate from the host; we restore into a sandbox and confirm the site loads. An untested backup is a hope, not a backup.
- Core, plugin and theme updates in staging. Every update is applied and key pages and forms tested before deploying to production.
- Security scan and log review. Automated scans plus a review of server logs for failed-login floods, new files that should not exist, and unusual access patterns.
- Uptime and performance check. We review uptime history and measure Core Web Vitals; our technical SEO team investigates regressions.
- SSL and domain expiry audit. We confirm certificate renewal is healthy and check domain and DNS expiry — expired domains cause a surprising number of outages.
- Form and checkout smoke tests. We submit every lead form and run the purchase path. Forms are where updates break most often, and a dead form is silent revenue loss.
- Plain-English monthly report. What was updated, found and fixed, and what needs your decision — no jargon, no filler.
When you don’t need a maintenance plan
A care plan is not for everyone. If your site is a static HTML brochure with no CMS, no forms and no user input, there is almost nothing to maintain. If an in-house developer already updates, monitors and backs up the site as part of their job, a second retainer adds little.
Sites on fully managed platforms like Shopify or Squarespace need less, because the platform patches itself — though app and integration maintenance can still warrant help. And if the site earns nothing and carries no reputation risk, break-fix economics can win: £120/month protecting a hobby blog is money down the drain. If you are unsure, a one-off SEO audit usually reveals how fragile your setup is.
What UK website maintenance costs
For context: basic care plans for small WordPress sites typically run £60–£120/month, covering updates, backups, monitoring and email support. Plans for WooCommerce or membership sites with staging workflows and priority response sit at £150–£250/month. Anything under about £50/month is generally automated-only with no human reviewing the scans. Emergency hack cleanups typically start around £500 and climb past £2,000 for stores with customer data.
Frequently asked questions
How often should a WordPress site be updated?
Core, plugins and themes should be reviewed at least monthly, with security patches applied as released rather than waiting for the cycle. Sites taking payments or storing customer data should be on a weekly schedule. The critical step is testing updates in staging first, since updates are the most common cause of sudden breakages.
Do automatic updates make maintenance plans unnecessary?
No. Automatic updates fix “forgot to update” but create “update broke the site.” Around a third of hacked WordPress sites Sucuri examined ran current core versions — the vulnerabilities were in plugins and themes. Someone must still verify the site works after each update and keep backups that can roll changes back.
What happens if my site gets hacked while on a care plan?
A good plan prevents most hacks, but none guarantees zero breaches. What it guarantees is fast detection through monitoring and a clean, tested backup to restore from — turning a multi-day emergency into a same-day recovery. Ask any provider what their hack-response process is before signing; vague answers are a red flag.
Will a maintenance plan speed up my site?
Maintenance keeps a site from slowing down, which is different from making it fast. Database optimisation, removing unused plugins and watching Core Web Vitals prevent the performance rot of neglected sites. But a site that was never optimised — heavy theme, no caching — needs a separate performance project, not monthly updates.
Can I back up my site myself instead?
You can, but most DIY backups fail when needed: stored on the same server that dies, excluding the database, or never test-restored. If you self-manage backups, verify them monthly with an actual restore into a test environment — that single habit catches most failures.
How do I know if my site is already compromised?
Warning signs include sudden ranking drops, a Google hacked-content warning, unfamiliar admin users, unexpected redirects (especially on mobile), and spikes in server usage. Security plugins catch known malware, but injected code in legitimate files increasingly escapes basic scans, per Patchstack and Monarx research — a professional review is worth it.
Keep your website off the failure list
A site that is not maintained is quietly getting worse. The work is unglamorous — updates, backups, scans, tests — but it is the difference between a site that earns for years and one that dies in public during your busiest week.
Book a free consultation and we will review your setup honestly — including telling you if you do not need us.
