Website Maintenance: What Actually Needs Doing (and What’s Padding)
Monthly updates, backups, uptime, security, some of it is real, some is invoice padding. The honest breakdown, plus the silent failure that loses more money than hackers do.
Most “care plans” are padding wrapped around four real jobs. Actual website maintenance is software updates, backups, security monitoring, and the one everyone forgets: checking your forms still deliver leads. That last one fails silently and costs the most. Here is what genuinely needs doing, how often, and what you can safely ignore.
The four things that genuinely need doing
| Task | Why it matters | Cadence |
|---|---|---|
| Plugin + core updates | Outdated plugins are how WordPress sites get hacked | Monthly, by a human who checks the site after |
| Backups | The difference between a bad hour and a lost site | Automated daily, verified occasionally |
| Security monitoring | Catch problems before customers do | Continuous, automated |
| Lead-path checks | A silently broken contact form loses jobs invisibly | Monthly, minimum |
The failure that costs more than hackers: silent forms
We have audited sites where the contact form had been broken for months, every enquiry vanishing, nobody aware. Email delivery breaks quietly: a plugin update, a hosting change, a spam-filter tweak. That is why our Hosting & Care plan includes a lead safety net: we monitor that enquiries actually arrive in your inbox, and every lead is also stored in the site’s backend, so even a broken email never equals a lost job. Ask whoever maintains your site what their answer to this failure is. “Hope” is the common one.
The launch-day guarantee (why custom makes this easy)
Because our sites are hand-built rather than a tower of page-builder plugins, updates rarely break anything, which is why we can guarantee your site will always look the way it did the day it launched. We still eyeball it monthly, that is the point of a check. Plugin-stack sites cannot make that promise, every update is a small round of roulette.
What is padding on a maintenance invoice
- “Uptime monitoring” as a line item. It is a free automated ping.
- “Performance optimisation, monthly.” A well-built site does not need re-optimising every month; a badly built one needs rebuilding once. (The speed guide.)
- Vague “SEO maintenance”. Real SEO is a campaign with named work (what that costs), not a $49 line item.
What it should cost
Genuine hosting + maintenance for a small business site is a few hundred dollars a year, not a few hundred a month. Ours is $275 a year + GST all-in: hosting, monthly updates and visual check, premium plugin licences, domains from $30/yr, and the lead safety net. If you are paying 10x that, you are either getting a real SEO campaign bundled in (check the deliverables) or you are the padding. DIY is viable too if you will genuinely do the four tasks monthly, the honest question is whether you will.
If you do nothing else, do these two: confirm backups actually exist somewhere off the server (ask your host to show you one), and test your own contact form this week. Those two checks cover the disasters; everything else on the list is about staying fast and secure between them.