Maintenance and security: keeping a working site working

Why sites break on their own

Nothing about a website is static. The platform releases security updates. Plugins update independently and sometimes conflict. Browsers change how they render things. Certificates expire on a schedule. Hosting configurations get changed.

Any of these can turn a working site into a broken one without anybody touching the content. That is why "we had it built two years ago and have not needed to change it" is usually followed by a list of problems.

Some of it sits below the website itself, in the domain registration and the server it runs on — see domains and hosting.

The routine that prevents most of it

None of this is complicated. It is just easy to skip until something goes wrong.

• Apply updates monthlyPlatform, plugins, themes. Take a backup first, then check the site afterwards — an update that breaks a layout is common and easy to miss.
• Keep off-site backupsA backup stored only on the same server is not a backup. If the server fails or is compromised, both go together.
• Test a restoreUntested backups fail at exactly the wrong moment. Restore one to a staging copy occasionally and confirm it actually works.
• Watch certificate expiryMost renew automatically, but automation fails quietly. An expired certificate makes every browser warn people away.
• Monitor uptimeFree services check every few minutes and email you when the site goes down. Otherwise you find out from a customer, days later.
• Test the contact formEvery couple of months. Broken forms are the most expensive silent failure there is — see turning visitors into enquiries.

Security in proportion

Small business sites are rarely targeted deliberately. They are compromised by automated scanners sweeping the internet for known vulnerabilities in out-of-date software.

That is reassuring, because it means keeping things updated defends against most of it. Add strong unique passwords, two-factor authentication on your admin login, and removing plugins you no longer use — every one you keep is extra surface area.

If the worst happens, a compromised site can be flagged by Google as harmful, which removes you from results and shows visitors a full-page warning. Recovering from that is considerably more work than preventing it.

Keeping it fast as it ages

Sites also get slower over time as content, images and plugins accumulate. A site that was quick at launch is often noticeably sluggish two years later without anyone making a decision that caused it.

Re-check your speed every few months rather than assuming it is as it was — site speed and Core Web Vitals covers what to measure and what usually causes the drift.

Common questions

How often should I update my website software?

Security updates as soon as they appear. Everything else monthly is a reasonable rhythm. Always back up first and check the site afterwards, because updates occasionally break layouts or conflict with each other.

What happens if my website gets hacked?

Typically spam pages are injected, visitors are redirected, or your site is used to send spam. Google may then flag it as harmful, which removes you from search results and shows a warning to anyone visiting. Cleaning up involves removing the malicious code, closing the vulnerability, restoring from a clean backup and requesting a review from Google.

Do I need a maintenance plan?

You need the work done; whether you pay someone for it depends on whether you will actually do it yourself. The tasks are not difficult, but they are easy to postpone indefinitely, and the cost of neglect arrives all at once.