A website is not permanently finished on launch day. Software, browsers, integrations, content, and business needs keep changing, so continued operation requires agreed maintenance. For a buyer, the key questions are what the service covers, who owns each responsibility, and how problems are detected before they disrupt customers or revenue.
Maintenance is part of the website lifecycle
Effective maintenance keeps a site usable, secure, and aligned with the business. It includes monitoring, backups, access management, incident response, and small continuous improvements as well as technical updates. Hosting alone does not necessarily mean that anyone is checking forms, repairing a failed integration, or maintaining the dependencies of the content management system.
The required service level depends on the role of the website. A simple corporate site, a lead-generating service site, and an ecommerce store processing payments require different monitoring and response times. Buyers should evaluate maintenance in relation to the commercial impact of downtime, lost data, or an enquiry path that silently stops working.
A good maintenance service is defined in concrete terms
A maintenance agreement should separate preventive work, incident correction, and actual product development. Preventive work includes software updates, backup monitoring, functional checks, and handling security findings. Publishing content, building new features, and making large design changes may sit in a separate development budget.
Monthly price alone does not reveal the value of a service. A proposal should state how often checks take place, what is monitored automatically, what triggers specialist work, and how quickly issues of different severity are addressed. Reporting should make completed updates, identified risks, and outstanding actions understandable to the business.
- updates to the platform, extensions, and other dependencies
- backups and regular testing of the restoration process
- monitoring of availability, forms, certificates, and integrations
- handling security findings, defects, and change requests
Updates and a smaller attack surface reduce risk
Finland's National Cyber Security Centre warns that known WordPress vulnerabilities may be exploited very quickly, even within hours. The content management system, themes, and plugins must therefore be kept current, and successful automatic updating should not simply be assumed. The same principle applies to other technologies: support and vulnerability status must be monitored for production dependencies.
Unnecessary plugins, old integrations, and unused accounts increase both maintenance effort and attack surface. Features should not be installed merely in case they are needed later. Changes should be controlled, tested before production, and documented so that a fault caused by an update can be identified and the change safely rolled back if necessary.
- remove features, extensions, and accounts that have no owner or purpose
- track manually updated components and expiring certificates
- test updates against the most important customer journeys
- record changes and confirm recovery options before release
Access, backups, and protective controls work together
Administrative and technical environments should grant only the access required for each role. The National Cyber Security Centre recommends least privilege and multi-factor authentication at least for administrative accounts. When an employee or supplier changes, unneeded access should be removed promptly, and shared administrator credentials should not be left without an accountable owner.
A backup has value only if it is recent enough, protected, and recoverable. After a breach, an environment should not be restored blindly: first confirm that the attacker no longer has access, that the restore point is clean, and that updates are applied before the service returns. HTTPS, secure cookie settings, and a carefully implemented Content Security Policy add protection, but do not replace fixing vulnerable code.
Responsibility determines what happens during an incident
The National Cyber Security Centre's WordPress guidance notes that responsibility for maintenance and updates passes to the customer when a site is bought from an external supplier unless something else has been agreed. Responsibilities should therefore never be left to assumptions. Document the roles of the business, website partner, hosting provider, and integration suppliers so that an incident has an immediate owner with authority to act.
Not every defect has equal priority. A fault that blocks payment, authentication, or a lead form usually needs a faster response than a cosmetic issue. The agreement should define severity levels, contact and escalation routes, and whether corrective work is included or billed separately.
| Maintenance area | Typical responsibility | What the buyer should verify |
|---|---|---|
| Hosting and infrastructure | Availability of servers, networks, and the hosting platform | Redundancy, monitoring, capacity, and the support route |
| Application and CMS | Updates, dependencies, defect correction, and testing | Update cadence, response times, and scope of changes |
| Content and business data | Accuracy, ownership, integrations, and measurement | Named owners, account access, and backup coverage |
How to compare maintenance proposals
Ask suppliers to describe the service as observable actions rather than general care: what is checked weekly or monthly, how a critical vulnerability is handled, where a backup is restored from, and how the enquiry form is proven to work. Also establish what happens when the contract ends and how credentials, documentation, code, and assets are handed back to the business.
Good maintenance makes the situation visible and supports decisions before they become urgent. It cannot promise a completely invulnerable site or uninterrupted operation, but it should reduce risk, shorten recovery time, and provide an agreed way to improve the site. Choose the service level according to business criticality, not the name of a pre-packaged plan.
- exact service scope, exclusions, and pricing for additional work
- monitored components, response times, and incident escalation
- backup retention, protection, and restoration testing
- ownership of accounts, code, documentation, and data
If you want ongoing maintenance and ownership responsibilities considered from the start, explore our business website service.
Sources and further reading
The guidance on security and maintenance responsibilities has been checked against official publications from Finland's National Cyber Security Centre and web.dev.
