Website Maintenance: What It Should Actually Include

"Website maintenance" is one of the most common lines on a web designer's invoice and one of the least explained. A monthly fee goes out, and if you asked what it bought last month, the honest answer is often "not much, but nothing broke".

That is not maintenance. Maintenance is the work of keeping a live website working, findable, secure and correct after the day it launched. Here is what that should actually include, how to check each part yourself, and the questions worth asking before you pay for a package.

First, what maintenance is not

It is not a redesign, and it is not new pages or a new feature. Those are projects. Maintenance is everything that stops a finished website quietly decaying: the certificate that lapses, the form that stops sending, the setting that tells Google to go away.

Most of those failures have one thing in common. Nothing looks wrong. The site loads on your phone, so you assume it is fine, while customers get an error or Google stops listing you. Good maintenance is mostly about noticing things before you would.

1. Someone checks that the site is actually up

A website can stop responding for plenty of dull reasons: a hosting fault, a domain or DNS change, a failed deployment. If nobody is checking, you find out when a customer mentions it, or never.

What to look for: automatic checks at a set interval, and a named person who deals with a failure. "We monitor your site" means nothing without those two details.

Check it yourself: load your site from a phone on mobile data, not your office Wi-Fi, which can cache an old copy.

2. The security certificate is renewed before it lapses

The padlock in the address bar comes from an SSL certificate, and certificates expire. Most renew automatically now, which is exactly why a failed renewal goes unnoticed: nobody is watching for it. When one lapses, browsers show visitors a full-page security warning, and very few people click past it.

Check it yourself: click the padlock next to your address, open the certificate details and look at the expiry date.

3. Google can still see the site

Websites are usually built on a preview address first, with a setting that tells search engines not to list the unfinished version. If that setting survives a rebuild or an update, the live site disappears from Google with no visible sign on the page.

What to look for: someone checking your site is still indexable after every change, and watching Google Search Console for pages dropping out.

Check it yourself: search Google for site:yourdomain.co.uk. If it returns nothing, see our guide to why a website is not showing on Google, which walks through the causes in order.

4. The contact form still reaches you

Forms break silently. A mailbox changes, an email service stops accepting the messages, a spam filter starts eating them. The visitor sees "thank you", and you never see the enquiry.

What to look for: enquiries stored somewhere as well as emailed, so a failed email does not mean a lost customer.

Check it yourself: once a month, fill in your own form as if you were a customer, and make sure it arrives.

5. Backups you could actually restore

"We back up your site" is a start. The useful questions are where the backup is, how often it is taken, how long copies are kept, and whether any of it is stored somewhere other than the server it is protecting. A backup on the same machine as the site does not help when that machine is the problem.

What to look for: frequent backups, older copies kept for a sensible period, and at least one copy held off-site.

6. Software kept up to date

Every website runs on software that needs updating. On WordPress that means the core, the theme and every plugin, and an out-of-date plugin is one of the most common ways small business sites get compromised. A custom-built site has fewer moving parts, but its framework and the packages it depends on still receive security fixes.

What to look for: updates included in the package, applied on a schedule, and checked afterwards, because an update that breaks the site is a maintenance problem too.

7. Analytics and your privacy notice still in place

If your site collects anything about visitors, whether a name on a form or analytics cookies, UK data protection rules expect you to say so in a privacy notice and, for non-essential cookies, to ask first. Rebuilds and theme changes have a habit of dropping the cookie banner, the analytics code or the link to the notice without anyone noticing.

Check it yourself: open your site in a private browser window. You should be asked about cookies before analytics runs, and your footer should link to a privacy notice.

8. Someone looks at how you are doing in search

Google Search Console tells you which searches you appear for, how often you are clicked, and which pages have problems. It is free, and in most small businesses nobody opens it.

What to look for: someone checking it regularly, weekly or monthly, and telling you when something changes, rather than a report that arrives once a year.

9. The content stays true

Opening hours, prices, staff, services you no longer offer, an event that happened in the spring. Out-of-date information costs trust faster than a slow page does. Most maintenance packages include a set amount of small edits; know what yours includes and use it.

Questions to ask before you pay for a maintenance package

• How often is my site checked to see that it is up, and who is told when it is not?
• Who renews the security certificate and the domain, and who notices if a renewal fails?
• Where are my backups kept, how long are copies kept, and is one held off-site?
• Are software updates included, and is the site checked after they are applied?
• Does anyone look at Google Search Console for me, and how often?
• How many content changes a month are included, and how quickly are they made?

A good provider answers all of those in a sentence each. If the answers are vague, the maintenance probably is too.

How we handle it

Our maintenance runs through Pulse, the system we built and run on our own hardware. For the sites we look after, it loads each site every ten minutes and logs one that fails two checks in a row. Every night it checks the SSL certificate's expiry, that search engines are not being blocked, that analytics and the privacy notice are in place, and that the contact form route is still connected. For clients with SEO in their plan it pulls Search Console figures every Monday, and everything we hold is backed up nightly with an off-site copy.

A person at Dalton Digital deals with whatever it finds. You can read exactly what Pulse does and does not do, or see what is included on our pricing page.