Most websites do not fail on launch day. They fail slowly, months later, in places nobody is watching. A plugin that never got updated. A certificate that did not renew. An email record lost during a provider switch. A contact form that quietly stopped sending. The first sign is often a client asking why your site shows a security warning.
Website maintenance services exist to catch those things before your customers do. The trouble is that the label covers very different offers, from an automated plugin updater to a team that takes full responsibility for your site. At Viralistic in Amsterdam we run managed hosting and maintenance for the sites we build, with one point of contact for domain, DNS, SSL, email and updates. This guide explains what a proper service includes, how to compare plans, what drives the price and when doing it yourself is the sensible choice.
What are website maintenance services?
Website maintenance services are the ongoing technical care a website needs after launch. They cover the software it runs on, the infrastructure around it (hosting, domain, DNS, email) and the small fixes and content changes every live site accumulates.
Maintenance is different from hosting and from a redesign. Hosting is where the site runs. A redesign changes what the site is. Maintenance keeps the current site healthy in an environment that keeps moving: browsers change, certificate rules tighten, email providers raise the bar and new software vulnerabilities appear every week. A site that was fine a year ago is not fine today by default.
It also differs from website management, which some agencies sell as a broader package with content planning and SEO. Maintenance is the foundation underneath that work.
What a website maintenance plan should include
A complete plan covers nine recurring tasks: updates, security, backups, monitoring, SSL, domain and DNS, email records, performance and content. Here is what each one means in practice, and where it usually goes wrong.
Software and plugin updates
Every site runs on software that needs patching. On WordPress that means core, the theme and every plugin, and the plugins carry most of the risk. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase on the year before, with 91% of them in plugins (Patchstack, State of WordPress Security in 2026). For the most heavily exploited flaws, the weighted median time from disclosure to first exploit was five hours.
A monthly update round is too slow for a plugin-heavy WordPress site. If that is your setup, read what to expect from a WordPress specialist. Static sites, such as the Astro sites we build, have no plugin layer that needs patching every week, so maintenance focuses on the underlying dependencies and the environment around them.
Security and access
Security starts with who can get in. Turn on two-factor authentication for every account that can touch the site: hosting, registrar, DNS, CMS and email. Give each person their own login and remove former staff and previous agencies. A shared password that has been passed around for years is the weakest point on many business websites.
Backups
A useful backup runs automatically, lives somewhere other than the site itself and has been restored at least once. An untested backup is an assumption. Ask how far back you can go as well. Some compromises are only discovered weeks later, and seven days of history will not help then.
Uptime monitoring
Monitoring checks every few minutes whether the site responds and alerts someone when it does not. The value is in who receives the alert and what they do next. Alongside uptime, watch certificate and domain expiry dates, and review Google Search Console each month for security and indexing issues.
SSL certificates
Certificates are getting shorter lives. In 2025 the CA/Browser Forum adopted a schedule that cuts the maximum validity of public TLS certificates from 398 days to 47 days, in steps between March 2026 and March 2029 (CA/Browser Forum, ballot SC-081v3). Since 15 March 2026 the limit has been 200 days. Manual renewal is no longer a workable plan. Renewal should be automatic, with an alert if it fails.
Domain and DNS
Your domain belongs in your company’s name, with auto-renew switched on and current contact details. DNS is the address book behind it: where the website lives, where email arrives and which services may send mail on your behalf. Hosting moves and email migrations are where DNS most often breaks, so keep a written record of every entry and why it exists.
Email authentication
Your website and your email share a domain, and therefore share DNS. Gmail requires every sender to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts needs SPF, DKIM and DMARC (Google, Email sender guidelines). When these records are wrong, quotes, invoices and form notifications land in spam. Check them after every change to your email or your forms.
Performance
Speed rarely collapses overnight. It erodes with a heavier hero image, a chat widget, another tracking script. Google measures it through Core Web Vitals: a page is “good” with a Largest Contentful Paint up to 2.5 seconds, an Interaction to Next Paint up to 200 milliseconds and a Cumulative Layout Shift up to 0.1, measured at the 75th percentile of visits (web.dev). Test quarterly in PageSpeed Insights and the Core Web Vitals report in Search Console. Speed also affects how many visitors get in touch, as our guide to conversion rate optimisation shows.
Content and small fixes
Outdated pages cost trust: old prices, a colleague who left, wrong opening hours, a privacy policy that no longer matches what the site does. Broken links send visitors to dead ends. Content upkeep is the part of maintenance your customers notice first.
Integrations and automations
If forms feed a CRM, a newsletter tool or an automation, those connections belong in the plan too. Running your own n8n instance, for example, makes you responsible for its updates and backups, including the encryption key. If you would rather not, managed n8n hosting in Europe takes that off your list. If you keep it in-house, our guide to updating and backing up a self-hosted n8n shows what to protect.
How website maintenance packages differ
Website maintenance packages usually bundle updates, backups, monitoring and security with a set number of hours for small changes. Beyond that, inclusions vary widely, so compare what is in the plan rather than the monthly figure.
| Item | Commonly included? | What to ask |
|---|---|---|
| Hosting | Sometimes | Where does the site run, and who manages it? |
| CMS and plugin updates | Yes | How often, and are they tested first? |
| Backups | Yes | How often, how long are they kept, who tests them? |
| Uptime monitoring | Often | Who gets the alert, and how fast do they act? |
| SSL | Often | Does it renew automatically? |
| Domain and DNS | Varies | Whose name is the domain registered in? |
| Email records (SPF, DKIM, DMARC) | Rarely | Who owns them when something changes? |
| Content edits | Sometimes, in hours | How many, and what happens to unused hours? |
| Recovery after a hack | Varies | Included, or billed by the hour? |
| Reporting | Sometimes | What is in it, and how often? |
Questions to ask before you sign
- Who works on my site, and who is my fixed point of contact?
- What is the response time for an outage, including outside office hours?
- Are the domain, hosting and every account in my company’s name?
- What do I receive if we stop: backups, access, documentation?
- What falls outside the plan, and how is it billed?
How much do website maintenance services cost?
Cost depends on four things: the platform, the size and complexity of the site, the response time you need and the hours included for changes. A plugin-heavy WordPress site needs more attention than a static site. An online store with payments and inventory integrations has more ways to break than a brochure site.
Watch for what a low price leaves out. A plan without recovery after a hack, or with monitoring nobody acts on, looks cheap until the day it is needed. The useful comparison is total responsibility per month, not hours per month.
Choosing reliable hosting
Reliable hosting shows itself in four ways: proven uptime, backups you can restore, clarity on where data is processed and support from people who know your site. The monthly price tells you little about any of them.
| Hosting type | What it is | Work left to you | Fits |
|---|---|---|---|
| Shared hosting | Your site shares a server with many others | Everything above the server | Small, low-risk sites |
| VPS or cloud server | Your own virtual server from a cloud provider | Everything, including the server | Teams with in-house engineers |
| Managed hosting | Hosting where the provider also runs and supports the site | Little | Companies that want one contact |
| Static hosting on an edge network | Prebuilt pages served from locations worldwide | Little, if managed | Fast sites without a heavy database |
A few numbers and terms worth knowing:
- An uptime promise of 99.9% still allows about 43 minutes of downtime a month. At 99.99% it is a little over four minutes. Ask how uptime is measured and what happens when the target is missed.
- For speed, the physical server location matters less than it used to. An edge network serves pages from a point close to each visitor.
- For privacy, location does matter. If your host processes personal data for you, for example form submissions, it acts as a processor under the GDPR, and Article 28 requires a contract between you. Ask where that data is stored.
- Support quality is the difference between a ticket queue and a person who knows your setup.
Registering the domain with the same partner that hosts the site saves coordination, as long as the domain stays in your company’s name. With our managed hosting, domain and DNS management are included.
DIY or a website maintenance service?
Doing it yourself works when the site is simple, you block out time every week and you know what to do during an outage. A service pays off once the site brings in leads or revenue, has integrations attached or has no clear owner inside the company.
| Do it yourself | Maintenance service | |
|---|---|---|
| Cost | Low in money, high in time | A fixed monthly fee |
| Knowledge | You build and keep it current | Sits with the provider |
| Outage response | When you happen to notice | Monitoring alerts the provider first |
| Main risk | Updates slip when work gets busy | Depends on what the plan covers |
| Coordination | Split across several suppliers | One point of contact |
Outsourcing does not mean handing over ownership. Keep the domain, hosting, analytics and Search Console in your company’s name, give your provider its own user account and ask for a written record of DNS entries and access. That way you can switch providers without starting over.
Website maintenance checklist
Use this as a fixed rhythm, or as a way to check what your provider actually does.
| When | Task |
|---|---|
| Daily | Automated backup and uptime monitoring running, with alerts going to someone who acts |
| Weekly | CMS, theme and plugin updates (WordPress), review alerts and error logs |
| Monthly | Test every form, check Search Console for security and indexing issues, remove unused accounts |
| Quarterly | Test-restore a backup, measure Core Web Vitals, fix broken links, review key pages |
| Yearly | Check domain renewal and contacts, clean up DNS, verify SPF, DKIM and DMARC, review hosting, update privacy and cookie pages |
Two moments always deserve a full review: a hosting or email migration, and the departure of anyone who had access.
Maintenance is also a good moment to ask whether the site still fits where the business is heading. Our piece on digital strategy helps with that question. If the foundation no longer fits, building a new website is sometimes cheaper than repairing the old one.
How we help
Viralistic offers managed website hosting and maintenance with one point of contact. Your website runs on a global edge network with automatic SSL, daily backups and uptime monitoring, so we hear about problems before you do. Domain and DNS management are included. Email runs with your provider, such as Google Workspace or Microsoft 365, and we handle the DNS records it needs. We apply security and dependency updates, and because our sites are built in Astro there is no plugin stack that needs patching every week.
On top of that you get a digital partner who knows your site and your business. A small content change, a new page, a form that needs a new destination, a question about a notification from Google: you send one message. Most clients come to us after we build their website. Sites built elsewhere can be taken over after a short technical review. Plans are configured on the hosting page and billed monthly.
Planning a new site instead? Webdesign projects start around EUR 4,000, and larger CMS-driven platforms can reach EUR 20,000 or more.
Frequently asked questions
What is web maintenance?
Web maintenance is the ongoing work that keeps a live website secure, fast and accurate. It covers software and plugin updates, security, backups, uptime monitoring, SSL renewal, domain and DNS management, email authentication records, performance checks and content updates. The goal is to prevent problems rather than repair them after customers notice.
How often should a website be maintained?
Backups and monitoring should run daily and automatically. Plugin-based sites need update checks every week. Forms and Search Console deserve a monthly look, and performance and a test restore a quarterly one. Once a year, review the domain, DNS, email records and legal pages. A fixed rhythm beats maintenance whenever someone finds the time.
What happens if I don’t maintain my website?
The site slowly becomes slower, more exposed and less reliable. The most heavily targeted plugin vulnerabilities are exploited within hours of disclosure, certificates expire, forms stop sending without warning and email lands in spam. Most owners find out from a customer or from falling search visibility. Recovery almost always costs more than the maintenance that would have prevented it.
What is the difference between website maintenance and website management?
Maintenance is the technical care: updates, backups, security, monitoring and small fixes. Website management is a broader arrangement that can add content planning, SEO and coordination around business goals. Every managed site needs maintenance underneath. Not every maintained site needs full management, so decide which problem you are actually trying to solve.
Can you maintain a website you did not build?
Usually, yes. We start with a short technical review to see how the site was built and what it depends on. Sites on Astro, Webflow or plain HTML move easily. Heavier platforms are assessed case by case. After that we confirm access to the domain and DNS and take over monitoring.
Written by
Founder of Viralistic and official n8n Ambassador
Marrallisa leads strategy, design, search and automation for premium brands from Amsterdam. She has trained teams at Volkswagen and speaks at n8n and Anthropic events. Want to talk through your situation? Book a call with her directly.