Website maintenance: what it really covers and what happens if you skip it

"Website maintenance" is one of those budget lines almost nobody explains and almost everybody charges for. Let us open it up: what actually gets done every month, what it costs and what happens when it stops. No scare tactics, no sugar coating.

What maintenance is, and what it is not

Maintenance is all the work that keeps your site running as well as the day it launched. It is not a redesign, it is not adding new sections and it is not a marketing campaign. It is the periodic review of a system that degrades when left alone.

It degrades because the software underneath keeps moving: the CMS ships new versions, so do the plugins, browsers update their engines and payment gateways change their APIs. Your site does not break all at once. It drifts.

What a serious plan includes

Updates

The CMS core, plugins, themes and framework dependencies. The important part is not clicking "update": it is doing it on a staging environment first, checking that the contact form still sends and the checkout still charges, and only then pushing to production. Updating blind on a Friday afternoon is how sites break.

Backups

Daily for an online shop, weekly for a corporate site. With two conditions almost nobody checks: the backup lives off the same server, and somebody has actually restored one at least once. A backup that has never been tested is not a backup; it is an assumption.

Security

A valid SSL certificate that renews on its own, a review of who still has access (the intern who left two years ago is usually still there), passwords and FTP accounts, an application firewall when the project justifies it, and a look at the logs when odd traffic shows up. Most small sites are not attacked by hand: they are found by a bot crawling for old versions of well-known plugins.

Performance

Measure now and then, not just on launch day. Sites gain weight with use: images uploaded without compression, a new plugin loading 200 KB of JavaScript, a third-party script somebody added for a campaign and nobody removed. A quarterly look at PageSpeed Insights and the home page weight catches most of it.

Monitoring and small changes

Uptime monitoring (you noticing the site is down is not monitoring), broken link and 404 checks, and a small allowance for minor edits: change a phone number, upload a photo, fix a paragraph.

What it should not include (but sometimes does)

• Redesigns or new pages: that is a project, not maintenance.
• SEO and campaigns: a different service, with different goals and different measurement.
• Hosting: it can sit on the same invoice, but it is a separate cost and you should see it itemised.

What it costs

The usual ranges in Girona and on the Costa Brava, with the scope that normally goes with each:

Range	Profile	Typical scope
€30-50/month	Simple corporate site	Updates, backups, SSL, basic uptime monitoring
€50-80/month	Site with forms, a blog or several languages	The above plus performance reviews and minor edits
€80-120/month	Online shop or site with integrations	Daily backups, checkout testing, payment and stock monitoring

Below €30 a month you are usually just paying for hosting under another name. Above €120 you should be getting a monthly report that justifies the difference.

Signs your site is degrading

You do not need to be technical to spot them:

1. The admin panel feels slow or greets you with a list of pending updates.
2. Form submissions stop arriving, or land in your own spam folder.
3. The browser warns "not secure": the SSL certificate has expired.
4. The site is slower than a year ago on mobile data, away from the office wifi.
5. 404 errors appear when you search for your business on Google and click older results.
6. Nobody knows who holds the access credentials. This is the worst one, because it is usually discovered on the day something fails.

What happens if you skip it

Best case, nothing for months. Worst case, an outdated plugin lets in a script that injects spam links into your pages; Google notices, flags the site and you lose rankings that took years to build. Recovering from that costs more than two years of maintenance, and nobody gives you back the weeks your site spent flagged.

The second scenario is more common and less dramatic: erosion. The site stays up but gets slower, forms fail intermittently and content goes stale. You do not lose customers in one go; you lose them without noticing.

Frequently asked questions

Do I need maintenance if my site is custom-built and not WordPress?

Less, but not none. There are no plugins to update, but there are framework dependencies, certificates, backups and monitoring. The monthly cost is usually lower because fewer pieces move.

Can I do it myself?

Backups and updates, yes, if you have discipline and a staging environment. Where most people fail is not technical skill, it is consistency: it gets done for three months and then forgotten.

Does maintenance include rebuilding the site when it looks dated?

No. A well-maintained site keeps working for years, but design and structure age anyway. Plan on revisiting the whole approach every four or five years.

What happens to my site if I stop paying for maintenance?

It stays online as long as the domain and hosting are current. It simply stops being reviewed. Make sure that, whatever happens, the domain and the credentials are in your name.

Conclusion

Maintenance is not an extra: it is the cost of still having something that works three years from now. Always ask for an itemised list of what is covered and how often, and insist that backups and credentials belong to you. If you want to know what your case needs, see how we handle domains and hosting or tell us your situation and we will say what it would take.