What website maintenance is for

Maintenance is the part of the web industry that runs on fear. The pitch usually arrives just after launch: pay a monthly fee or face hackers, downtime and mysterious decay. Some of that risk is real. Most of the pitch is not.

What maintenance is

Website maintenance is six jobs:

• Hosting. The server your site lives on. Somebody has to pay for it, configure it and keep it running. Without it there is no website.
• SSL. The certificate behind the padlock in the browser bar. It needs renewing on a schedule, and browsers flag your site as "not secure" if it lapses. In 2026 renewal is almost entirely automated, so this should never be an impressive-sounding line item.
• Security and dependency updates. Every website sits on software written by other people: a CMS, plugins, code libraries. Updates patch the holes as they are found. On a plugin-heavy platform this is a genuine, ongoing chore. On a hand-coded site there is far less surface to patch, though it is never zero.
• Backups and rollback. The useful question is not "do backups exist" but "how fast can the site be put back to how it was on Tuesday".
• Monitoring. Something, ideally someone, that notices the site is down before your customers do.
• Small changes. A new photo, a price update, a team member leaving, a paragraph that needs rewording. This is the part that varies most between businesses, and the part most plans are vaguest about.

If a maintenance quote cannot be mapped onto those six jobs, ask what exactly the money buys. A good provider can answer in one sentence per line.

What is optional

For some sites, very little of this needs a monthly fee.

A small, static, hand-built site that rarely changes carries far less risk than a sprawling CMS install with thirty plugins. If nothing on the site changes and nothing on it can be logged into, the catastrophic failure modes mostly are not there. What you are really deciding is simpler: who do you call when something does break, and how much active attention does this site deserve?

Skipping maintenance entirely is a legitimate choice. It just has consequences you should choose knowingly: nobody is watching, every change is billed ad hoc, and when something goes wrong at 9pm on a Friday you are the one finding out what your options are. For a site that is effectively a business card, that trade can be perfectly rational. For a site that brings in your enquiries, it usually is not.

The scare tactics worth ignoring

A few patterns come up again and again. None of them survive a direct question.

• The hack countdown. "Unmaintained sites get hacked." The risk depends almost entirely on what the site is built with, and anyone quoting fear without first asking what the site is built with is selling.
• Hostage hosting. Hosting that only exists through the provider, where cancelling the maintenance plan takes the site down with it. Hosting and maintenance are separate jobs. Bundling them is fine. Holding one hostage to the other is not.
• The twelve-month lock-in. There is no technical reason a maintenance agreement needs a year-long contract. Month-to-month is entirely possible, which means a lock-in is there for the provider's benefit.
• The mystery retainer. A monthly fee with no record of what was done. You should be able to see what happened each month, even when the honest answer is "nothing needed doing and the site stayed up". That sentence is worth paying for.
• The rankings protection racket. "Without ongoing SEO maintenance, Google will punish you." Nobody can promise you rankings, so nobody can charge you to protect them. Treat any fee sold that way with suspicion.

Questions to ask any provider

Five questions do most of the work:

1. What exactly happens each month, and where do I see a record of it?
2. If I cancel, what do I lose? The site should keep working, and you should keep the ability to host it elsewhere.
3. Who owns the code, the domain and the hosting account? The answer should be you.
4. If an update breaks something, how quickly can you roll back?
5. What counts as a small change, how many do I get, and what happens when I ask for a sixth?

Fuzzy answers to any of these are the same warning sign as a fuzzy build quote, and the fix is the same one I recommend in the piece on website pricing: get it in writing before money moves.

How I handle it at Meko

My own answers to those questions:

Hosting is its own line, and it's never held hostage. The first 30 days after launch are included. After that, Hosted is £40 a month (or £400 a year): managed hosting with SSL, your domain pointed at it, monitoring around the clock, a copy saved every day and security updates as they land. Every plan below includes it. And if you'd rather host the site yourself, I hand over the code and help you move it, free, because the site is yours. So the real decision is how much active attention you want on top:

• Live, £150 a month. Everything in Hosted, rollback to any earlier version in minutes, and four change requests a month.
• Compounding, £400 a month. Everything in Live, plus ten change requests a month, analytics inside your portal, your ads connected to real enquiries, and the site kept fast.
• Partner, £1,200 a month. Everything in Compounding, plus unlimited changes, same-day replies, a strategy meeting every fortnight, and a campaign or landing page every quarter. Capped at four clients at a time.

Every plan is monthly (Hosted can also be yearly) and optional. You add, change or cancel one yourself in your client portal, with no notice period and nothing to sign, and change requests are pinned directly on the page they concern, exactly like feedback during the build. The full breakdown sits on the pricing page.

In short

Not every site needs a maintenance plan, but every site needs an answer to two questions: who notices when it breaks, and who makes the small changes. If your website brings in your work, someone should be watching it. If it is a business card, perhaps nobody needs to. Decide on written answers rather than on a countdown to a hack that was never coming.