Websites: cost, hiring and build
What does website maintenance include?
Most maintenance plans list the same six words. What matters is what each one actually means, how you would know it was done, and what the contract says when it was not.
Website maintenance is the work that keeps a site running, safe and correct after launch. It is invisible when it is done well, which is exactly why it is hard to buy. A plan that says "updates, backups, security" might mean a weekly routine with written reports, or it might mean someone will look if you call. This page breaks the work into its parts, explains what good looks like for each, and lists what a maintenance agreement should put in writing.
How much of this you need depends on what the site runs on. On a hosted builder such as Wix or Squarespace, the platform handles the software updates, hosting and certificate for you. On WordPress or a custom site, all of it is somebody's job, and if it is not written down, it is nobody's.
Software updates
Every site built on a CMS or a framework depends on code other people write: the core software, the theme, plugins, and the libraries underneath them. Those get security fixes regularly. A site that skips updates for a year is running known, published vulnerabilities.
Good maintenance applies updates on a schedule, tests that the site still works afterwards, and has a way to roll back if an update breaks something. Turning on every automatic update and hoping is better than nothing, but an update that breaks your contact form on a Friday night is not noticed until the leads stop.
Backups, and the restore test nobody does
A backup you have never restored is a hope, not a backup. The questions to ask:
- What is backed up? Files and the database, or only one of them?
- How often, and how many copies are kept? A daily backup that only keeps one copy is overwritten by the broken version the day after something goes wrong.
- Where are the copies stored? A backup on the same server as the site disappears with the server.
- Whose account are they in? Backups held only in a supplier's storage leave with the supplier.
- When was a backup last restored, to a test copy, and did the site work afterwards?
Ask for a restore test at least a few times a year, with a short note of the date and the result. It is the only proof the backups are real.
Uptime monitoring
Monitoring means a service checks the site every few minutes from outside and alerts someone when it fails. Without it, the first person to notice the site is down is a customer, and most of them will not tell you. Good monitoring checks more than the home page: it should catch the contact form or booking page failing, not just the server answering. It should also alert a named person, by text or phone, not just send an email to an inbox nobody reads.
SSL certificate and domain renewal
The SSL certificate is what puts the padlock in the address bar. On modern hosting it is usually free and renews automatically, but automation fails, and the window is getting shorter. Under CA/Browser Forum rules, the maximum lifetime of a publicly trusted certificate dropped to 200 days in March 2026 and is scheduled to fall to 100 days in March 2027 and 47 days in March 2029. A certificate renewed by hand once a year is no longer an option. Maintenance should include confirming renewals actually happen.
The domain is the bigger risk. Under ICANN policy, registrars must send expiry reminders to the registrant roughly a month and a week before a domain expires. Those reminders go to whatever email address is on the registration. If that is a former employee or a supplier you no longer work with, nobody sees them, and when the domain lapses your website and your email stop working together. Maintenance should include checking the expiry date, the auto renew setting, the card on file and the contact email, at least once a year.
Security
- Admin accounts: one per person, no shared logins, two factor authentication on, and former staff and suppliers removed.
- Plugins and themes: anything unused deleted, not just switched off.
- Forms: spam protection, so the inbox is not flooded and the form is not abused to send mail.
- Monitoring for changes you did not make, such as new admin users or unexpected files.
- A written plan for what happens if the site is compromised: who is called, and how the clean backup is restored.
Content edits and small changes
Most plans include a few small edits a month: new hours, a staff photo, a holiday closure, a price change. The useful details are how many hours or changes are included, how quickly they are done, and what counts as small. A new page is usually not small. A redesign of the home page is not maintenance at all.
What a maintenance contract should state
| Item | What it should say |
|---|---|
| Scope | Exactly which tasks are included, and how often each is done |
| Backups | Frequency, retention, storage location, whose account, and how often a restore is tested |
| Monitoring | What is checked, how often, and who is alerted |
| Response times | How quickly someone responds to the site being down, and to a routine edit request |
| Edits | Hours or number of changes included, and the rate for anything beyond |
| Reporting | A short written report of what was done each month |
| Accounts | That hosting, domain, backups and admin access are in your name, with the supplier as a user |
| Exit | What you receive if you cancel: logins, the latest backup, and any documentation |
The last two rows matter most. A maintenance supplier needs access, but they should not be the only one who has it. If they disappear, you should be able to hand the same logins to someone else the next morning. The exact legal terms of any agreement, including liability if something goes wrong, are a question for a lawyer, not for this page.
How to check what you are getting now
- Ask your current supplier for the date of the last backup and the date of the last restore test.
- Look up your domain's expiry date and confirm the contact email on the registration is yours.
- Check who has admin access to the site, and remove anyone who should not.
- Ask what would alert someone if the site went down tonight, and who that someone is.
- Ask for last month's report. If there is no report, there is no way to know the work happened.
What to do next
Run the five checks above this week. They take less than an hour and tell you whether your current arrangement is real. If you are a business in Orlando or elsewhere in Central Florida and want maintenance done with the accounts in your name and a written report every month, Corsa Media House offers it, and the checklist above is what we would hold ourselves to.
Questions
What does website maintenance include?
Software updates with testing, backups with periodic restore tests, uptime monitoring, SSL certificate and domain renewal checks, security work such as access reviews and two factor authentication, and a set amount of small content edits. A good plan also includes a written report of what was done.
Do Wix and Squarespace sites need maintenance?
Less. On a hosted builder the platform handles software updates, hosting and the SSL certificate. You still need to keep the domain renewed with a current contact email, review who has access, and keep the content accurate.
How do I know my website backups actually work?
Ask when a backup was last restored to a test copy and whether the site worked afterwards. Also confirm what is backed up, how many copies are kept, where they are stored and whose account they are in. A backup that has never been restored is not proven.
Why does domain renewal belong in maintenance?
Because the expiry reminders registrars must send go to the email on the registration. If that address belongs to a former employee or supplier, nobody sees them, and when the domain lapses the website and email stop together.
What should a website maintenance contract say?
The tasks included and how often, backup details, what is monitored and who is alerted, response times, included edits and the rate beyond them, monthly reporting, that every account is in your name, and what you receive if you cancel.