Web design
Website maintenance means keeping your site's software updated, backed up, secure and working, and renewing things like your domain on time. Skipping it raises the risk of hacks, broken forms and lost data, which cost far more to fix than to prevent.
By Look North Digital · Published
Maintenance is a set of small, regular jobs. None of them is hard on its own. The problem is that they are easy to forget until something breaks.
The exact list depends on how your site is built. A WordPress site with many plugins needs more care than a simple site on a hosted builder. The table shows a typical routine.
| Task | How often | Why it matters |
|---|---|---|
| Update the core software, theme and plugins | Weekly or as updates arrive | Closes security holes before attackers use them. |
| Take backups of files and database | Daily or weekly, depending on how often the site changes | Lets you recover from a hack, a bad update or a mistake. |
| Test a restore from backup | Every few months | Proves the backups actually work. |
| Test contact forms and booking | Monthly | A broken form can lose enquiries for weeks before anyone notices. |
| Check security warnings in Google Search Console | Monthly | Google tells you there if it finds hacked content or malware. |
| Check the server software version | Every few months | Old versions stop getting security fixes. |
| Renew the domain name and certificate | Yearly, or as they fall due | An expired domain or certificate can take your site offline or show warnings. |
| Review content, prices and contact details | Every few months | Out-of-date information costs trust and enquiries. |
Most websites run on software that other people write. When someone finds a security flaw, the developers release a fix. WordPress warns that once a fix is out, the information needed to exploit the flaw is almost certainly public.
That means an unpatched site is an easy target. WordPress says you should always keep up to date with the latest version, because older versions are not maintained with security updates.
WordPress installs minor core updates, such as security releases, automatically by default. Plugins and themes are different. Since version 5.5, owners can switch on automatic updates one plugin or theme at a time, but they are not automatic unless you choose them.
Your website also depends on software on the server, such as PHP (the programming language WordPress and many other sites are written in). Each version of PHP gets about two years of full support, then two years of security fixes only. After that it reaches end of life and gets no fixes at all.
Your host or developer should move your site to a supported version before that happens. It's worth asking which version you are on. An old site may need some work to run on a newer version, which is a good reason not to leave it for years.
| PHP version | Full support until | Security fixes until |
|---|---|---|
| 8.2 | Ended 31 December 2024 | 31 December 2026 |
| 8.3 | Ended 31 December 2025 | 31 December 2027 |
| 8.4 | 31 December 2026 | 31 December 2028 |
| 8.5 | 31 December 2027 | 31 December 2029 |
The NCSC (National Cyber Security Centre) lists websites among the data a business should back up. It suggests keeping more than one copy, for example one online and one on a separate device, so a single failure doesn't leave you with nothing.
WordPress also recommends keeping dated copies. If an attack goes unnoticed for a while, you need a backup from before it happened, not just last night's copy.
Ask whoever looks after your site when they last restored a backup, not just when they last took one. A backup that has never been tested is a hope, not a plan.
Google describes hacked content as anything placed on a site without permission, through a security weakness. It can be hidden code that harms visitors, spam pages added to your site, hidden links, or redirects that send some visitors elsewhere. You may not see any sign of it on your own pages.
If Google finds a problem, your pages can show a warning label in search results or a full warning page in the browser. Most visitors will leave at that point. The Security issues report in Google Search Console shows what Google found.
After cleaning the site, you fix every affected page and then request a review. Google says fixing only some pages won't earn a partial return, and reviews can take days or weeks. That is lost time for any business that relies on its website for enquiries.
Your domain name is rented, usually by the year. If it isn't renewed, it doesn't vanish at once, but it does stop working. Nominet, which runs .uk domains, follows the timeline below.
Make sure the domain is in your name, the renewal email goes to an inbox someone reads, and the payment card on file is current. Your security certificate, which gives the padlock in the browser, also needs renewing. Ask your host whether that happens automatically.
| Days after expiry | What happens |
|---|---|
| Day 1 | Nominet emails the registrant to say the domain has expired. |
| Day 23 | A warning that the domain will be suspended in 7 days. |
| Day 30 | The domain is suspended. It can still be renewed. |
| Day 83 | A warning that the domain will be cancelled in 7 days. |
| About day 90 | The domain is cancelled and you no longer hold it. |
If your site collects personal data, such as names and emails through a contact form, then yes. Under UK GDPR, the ICO (Information Commissioner's Office) says you must use security measures that are appropriate to the risk.
The ICO also says you must be able to restore access to personal data in a timely way after an incident. It describes a 3-2-1 approach to backups: three copies, two on different devices and one off-site. Regular updates and tested backups are a practical way to show you take this seriously.
You can do much of it yourself if you are comfortable with your site's dashboard. Updating plugins, testing forms and checking Search Console are all within reach for a careful owner. The hard part is doing it every month, and knowing what to do when an update breaks something.
If your site is on a hosted builder, the platform runs the software underneath. Ask what it updates for you and what is still your job. Content, forms, domains and your own logins are always yours to look after.
Paying someone makes sense when your site brings in real enquiries or bookings, when it has custom features, or when you simply don't have the time. Whoever does it, write down who is responsible for each task, so nothing falls between two people.
| Factor | Do it yourself | Paid care plan |
|---|---|---|
| Cost | Your time, plus any backup or security tools | A monthly fee |
| Suits | Simple sites, owners with time and confidence | Sites that bring in enquiries, bookings or sales |
| Risk | Tasks slip when you are busy | You depend on the provider doing the work |
| When things break | You fix it or find help fast | The provider should restore or fix it |
Every website we build needs our monthly Website Care plan, which covers hosting, care and support. It means someone is responsible for keeping your site updated, backed up and working.
If you have a site we didn't build and it needs attention, we also redesign existing sites. See our pricing page, or tell us about your project through our quote form.
Website maintenance is the regular work that keeps a site secure and working. It includes software updates, backups, security checks, domain renewals and testing forms. It also covers keeping your content, prices and contact details up to date.
Security updates should go on soon after they are released, because the details of the flaw are often public by then. In practice that means checking at least weekly on a WordPress site. Content should be reviewed every few months, or whenever your services or prices change.
Partly. WordPress installs minor core updates, including security releases, automatically by default. Plugins and themes only update automatically if you switch that on for each one, which has been possible since version 5.5.
It depends on how often the site changes. A shop or booking site that takes orders every day needs daily backups, while a simple brochure site may be fine with weekly. Keep several dated copies, store one away from your host, and test a restore every few months.
Nothing may happen at first, which is why it's easy to stop. Over time, the software falls behind on security fixes, forms can break unnoticed and the server version reaches end of life. The risk of a hack or a sudden outage grows each month.
You may not be able to tell by looking, because hacked content can be hidden or only shown to some visitors. Check the Security issues report in Google Search Console, which shows any hacked content or malware Google has found. Strange new pages in Google results for your site are another warning sign.
Only if your agreement says so. Many designers build the site and hand it over, leaving updates to you. Check your contract, and if nobody is named as responsible, assume nobody is doing it.
For .uk domains, Nominet suspends the domain 30 days after expiry, and it is cancelled around 90 days after expiry. You can still renew while it is suspended. Once it is cancelled you no longer hold it, so keep your renewal details current.
Keep reading
More on the same subject, and where we can help with it.
Next step
Tell us about your business and what the website needs to do. We will come back with a fixed price and a clear plan.
We use cookies that are essential for this site to work. With your consent, we may also use analytics cookies to understand how the site is used. See our cookie policy for details.