The worst thing that goes wrong with a website isn’t the site going down. If your site goes down you’ll know by lunchtime, because somebody will ring you.
The worst thing is the contact form that quietly stopped sending emails in March.
Nothing looks broken. The page loads, the form submits, the little thank you message appears. It’s just that nothing arrives at your end any more, and a website getting no enquiries looks exactly like a website nobody is interested in. I have watched people conclude their site doesn’t work and start pricing up a new one, when what they actually needed was a test message and twenty minutes.
That’s the argument for maintenance in one paragraph. The rest of this is detail.
Three ways it goes wrong
Security, which is almost never personal
Nobody has singled out your bakery. What happens is automatic. When a vulnerability turns up in a popular plugin it gets written up in public, and within days there are bots working through the internet trying that exact hole on every site running that plugin. Being small isn’t protection, it just makes you a smaller prize on the same list. The bots can’t tell the difference and wouldn’t care if they could. Updates are the entire defence, and they only work if somebody applies them.
Breakage, which arrives from outside
Your host moves to a newer version of PHP. A payment provider changes how its system works. A plugin author gives up and stops releasing updates, which is the sly one, because nothing breaks on the day they stop. It breaks eight months later when something else moves and the abandoned plugin can’t follow.
Rot, which is everybody’s doing
Prices from two years ago. A member of staff who left in 2024 and is still smiling at people from the team page. An events page still advertising the summer fete of 2023, which by all accounts was lovely. None of it stops the website working. It just tells every visitor that nobody’s home.
What maintenance actually is
It’s dull, and the dullness is the point. Updates applied and then checked, rather than applied and hoped over. Backups that somebody has restored from at least once, because a backup nobody has tested is a rumour. PHP and plugin versions kept current instead of being left until a host forces the issue. Somebody occasionally sending a test message through the contact form.
What it costs to leave it
Fixing a site after the fact is always the expensive version. Cleaning up after a compromise means working out what was changed and when, restoring from a backup old enough to lose you real work, and then explaining it to anyone whose details were on there. A site left three PHP versions behind is often cheaper to rebuild than to untangle, which is a miserable sentence to have to say to somebody who paid for it once already.
How I handle it
If I host your site you get daily backups either way. That isn’t an upsell, it’s just how I run things.
On top of that there are two options.
Option one, £320 a year. Plugins, WordPress core and PHP all updated monthly. This covers the first two problems above, the automated attacks and the things that break because something outside your site moved.
Option two. Everything in option one, and I add content for you as well. A blog post, a new member of staff, another product in the shop. You send it over and it goes on the site, included, rather than turning into an invoice for fifteen minutes’ work that nobody enjoys receiving and I don’t much enjoy sending. Priced per site, because it depends how much you’re likely to send me.
Option two exists because of the third problem. Websites don’t go out of date through laziness. They go out of date because updating them belongs to somebody who is already busy, and it slides down the list every week until the fete was three years ago. Taking it off that person’s list is usually the whole difference between a site that stays current and one that doesn’t.
The honest bit
You can do most of this yourself. It isn’t secret knowledge, and if you’re the sort of person who will log in every month and work through the list, you don’t need me for it. Those people exist. I’ve met two of them.
Most people aren’t that person, and it isn’t a character flaw. You didn’t start a dental practice or a sports club in order to keep an eye on PHP versions. The question is only whether it’s somebody’s job, and whose.
Not sure what state yours is in?
Send me the address and I’ll have a look. I’ll tell you what versions of WordPress and PHP it’s running, whether the plugins are current, whether anything obvious is broken, and whether the contact form is actually delivering. That last one takes a minute and is worth knowing even if you never speak to me again.
No charge for that and no obligation afterwards. If everything turns out to be fine, I’ll tell you that too.