Website maintenance: what it involves and how often

By the ContractorUK Editorial Team · Fact-checked 7 November 2026

The four jobs

Maintenance plans tend to come with long feature lists. Strip them back and the work is this:

1. keep the website software up to date;
2. keep backups somewhere else, and know you can restore them;
3. close the obvious security gaps;
4. keep what the site says accurate.

The first three keep the site running. The fourth keeps it worth visiting, and it's the one that quietly gets dropped.

Software updates

On a WordPress site there are three layers to update: WordPress itself, the theme and the plugins. The core software patches itself: its security and maintenance releases install automatically on most sites. Plugins and themes only update themselves if auto-updates are switched on for each one, so on many sites they sit waiting until somebody logs in. If WordPress is new to you, our guide to WordPress websites explains how themes and plugins fit together.

Our advice: update plugins one at a time, open the site after each, and jot down what you changed. If something breaks, you'll know where to look. Delete plugins and themes you no longer use, because a deactivated plugin is still code sitting on your server.

Backups you can actually restore

The National Cyber Security Centre's guide for small organisations tells businesses to back up all the data they need to operate, and it lists the website alongside emails, invoices and customer details. It also makes the point most people skip: once a backup exists, check you know how to restore it and that it really contains everything.

For a website, a complete backup means the files and the database together. Keep at least one copy away from your hosting account, so a problem at the host can't take the backup down with the site. The NCSC suggests two backups, one online and one on a separate device, with 2-step verification turned on for the online one.

Whatever platform you're on, keep your own copy of your words, photos and logo as well. It costs nothing and it's the part of a website that's hardest to recreate.

Security basics

• Use a strong, unique password and 2-step verification on everything that controls the site: the hosting account, the domain registrar and the website login.
• Remove accounts for people who no longer work with you, such as the designer who built the site three years ago.
• Ask your host which software versions your site runs on, and whether they're still supported.
• Watch the security certificate behind the padlock. Under the CA/Browser Forum's Baseline Requirements, the industry rulebook, a certificate issued since 15 March 2026 can be valid for no more than 200 days. That falls to 100 days from March 2027 and 47 days from March 2029. Renewal has to happen automatically, or visitors start seeing warnings.
• Renew the domain on time. Switch on auto-renew; our guide to buying a domain name covers registrars and renewals.

Content: the job everyone forgets

An out-of-date site costs you quietly. A number that changed last year, a service you stopped offering, a price list from two winters ago, a registered office you moved out of. None of them break the site. All of them lose you work or trust.

Doing it yourself or paying someone

For a small site with a handful of plugins, the routine above is manageable in-house once it's a habit. Paying someone makes sense if you'd rather not think about it at all, or if the site takes bookings or payments and can't afford to be down.

Maintenance prices vary a lot, and so does what they buy. Instead of comparing monthly fees, ask each provider:

• How often are updates run, and does anyone check the site afterwards?
• Where are backups kept, how often are they taken, and for how long?
• Is restoring a backup included, and how fast can it be done?
• Who answers if the site goes down on a Saturday?
• Are content changes part of the fee or charged on top?

Typical figures for the wider costs of running a site are in our guide to what a website costs in the UK.

What our plan takes off your list

ContractorUK's £49 a month, including VAT, covers hosting and https, so you never deal with servers or certificate renewals yourself. Content is yours to change whenever you like: ask the AI builder in plain English, using an allowance included in the plan, or click into a page and edit it directly. If something looks wrong, our UK team answers by phone and email.

Two habits are still worth keeping whoever hosts your site: hold your own copy of your words and photos, and send that monthly test message through your forms. And if you need a guaranteed response time or a set backup schedule, get it written into the agreement before you sign, with any provider.

Sources: NCSC small organisations guide, CA/Browser Forum Baseline Requirements and WordPress.org documentation, checked on 7 November 2026.