Website maintenance, explained without the scare tactics

Maintenance is the part of the web industry that runs on fear. The pitch usually arrives just after launch: pay a monthly fee or face hackers, downtime and mysterious decay. Some of that risk is real. Most of the pitch is not. So here is what maintenance actually involves, what it is worth paying for, and how to spot a plan that exists mainly to keep billing you.

What maintenance actually is

Strip out the jargon and website maintenance is six jobs:

Hosting. The server your site lives on. Somebody has to pay for it, configure it and keep it running. Without it there is no website.
SSL. The certificate behind the padlock in the browser bar. It needs renewing on a schedule, and browsers flag your site as "not secure" if it lapses. In 2026 renewal is almost entirely automated, so this should never be an impressive-sounding line item.
Security and dependency updates. Every website sits on software written by other people: a CMS, plugins, code libraries. Updates patch the holes as they are found. On a plugin-heavy platform this is a genuine, ongoing chore. On a hand-coded site there is far less surface to patch, though it is never zero.
Backups and rollback. The useful question is not "do backups exist" but "how fast can the site be put back to how it was on Tuesday". A backup nobody can restore quickly is just a souvenir.
Monitoring. Something, ideally someone, that notices the site is down before your customers do.
Small changes. A new photo, a price update, a team member leaving, a paragraph that needs rewording. This is the part that varies most between businesses, and the part most plans are vaguest about.

If a maintenance quote cannot be mapped onto those six jobs, ask what exactly the money buys. A good provider can answer in one sentence per line.

What is genuinely optional

Here is the part the industry rarely says out loud: for some sites, very little of this needs a monthly fee.

A small, static, hand-built site that rarely changes carries far less risk than a sprawling CMS install with thirty plugins. If nothing on the site changes and nothing on it can be logged into, the catastrophic failure modes mostly are not there. What you are really deciding is simpler: who do you call when something does break, and how much active attention does this site deserve?

Skipping maintenance entirely is a legitimate choice. It just has consequences you should choose knowingly: nobody is watching, every change is billed ad hoc, and when something goes wrong at 9pm on a Friday you are the one finding out what your options are. For a site that is effectively a business card, that trade can be perfectly rational. For a site that brings in your enquiries, it usually is not.

The scare tactics worth ignoring

A few patterns come up again and again. None of them survive a direct question.

The hack countdown. "Unmaintained sites get hacked." The risk depends almost entirely on what the site is built with, and anyone quoting fear without first asking about your stack is selling, not assessing.
Hostage hosting. Hosting that only exists through the provider, where cancelling the maintenance plan takes the site down with it. Hosting and maintenance are separate jobs. Bundling them is fine. Holding one hostage to the other is not.
The twelve-month lock-in. There is no technical reason a maintenance agreement needs a year-long contract. Month-to-month is entirely possible, which means a lock-in is a business decision made for the provider's benefit, not yours.
The mystery retainer. A monthly fee with no record of what was done. You should be able to see what happened each month, even when the honest answer is "nothing needed doing and the site stayed up". That sentence is worth paying for. Silence is not.
The rankings protection racket. "Without ongoing SEO maintenance, Google will punish you." Nobody can promise you rankings, which means nobody can honestly charge you to protect them. Treat any fee sold that way with suspicion.

Questions to ask any provider

Five questions do most of the work:

What exactly happens each month, and where do I see a record of it?
If I cancel, what do I lose? The site should keep working, and you should keep the ability to host it elsewhere.
Who owns the code, the domain and the hosting account? The answer should be you.
If an update breaks something, how quickly can you roll back?
What counts as a small change, how many do I get, and what happens when I ask for a sixth?

Fuzzy answers to any of these are the same warning sign as a fuzzy build quote, and the fix is the same one I recommend in the piece on website pricing: get it in writing before money moves.

How I handle it at Meko

For transparency, here is my own answer to those questions.

Hosting, with SSL and your domain pointed at it, is included with every Meko build at no charge, for the life of the site. It never appears on an invoice and it does not expire if you never buy anything else. So the only real decision is how much active attention you want on the site:

Live, £150 a month. Monitoring around the clock, security and dependency updates as they land, rollback to any earlier version in minutes, and four change requests a month.
Compounding, £400 a month. Everything in Live, plus unlimited change requests, analytics inside your portal, and a one-page summary every month of what changed and what I would do next.
Partner, £1,200 a month. Everything in Compounding, plus priority on the queue, out-of-hours cover, a campaign or landing page every quarter, and a strategy call every month.

Every plan is month-to-month and optional. You add, change or cancel one yourself in your client portal, with no notice period and nothing to sign, and change requests are pinned directly on the page they concern, exactly like feedback during the build. The full breakdown sits on the pricing page.

The honest summary

Not every site needs a maintenance plan. Every site needs an honest answer to two questions: who notices when it breaks, and who makes the small changes that keep it true. If your website is the front door of your business, someone should be watching it. If it is a business card, perhaps nobody needs to. Either way, make the decision on facts and written answers, not on a countdown to a hack that was never coming.