# Website maintenance: why it matters, what it covers and what drives the cost > Website maintenance is the regular work that keeps a site updated, secure, backed up and running after launch: software and security updates, backups with tested restores, SSL and domain renewals, uptime monitoring and small changes. A site without maintenance does not break in one day. It decays until it fails at the worst moment. The cost depends on how the site is built, how many integrations it has and how much change you expect. - URL: https://radkod.com/en/blog/website-maintenance - Publisher: RadKod - Published: 2026-09-06 ## In short - Website maintenance covers updates, security patches, backups, SSL and domain renewals, monitoring and small changes. - Unmaintained sites decay slowly, and the failure usually shows up at the worst possible time. - A backup only counts if you have restored it at least once. - Cost depends on the platform, the number of plugins and integrations, and how much change you expect. - Get the scope in writing, keep every account in your name and make leaving easy. ## What is website maintenance? Website maintenance is the regular work that keeps a website updated, secure and working after it goes live. It includes applying software updates, checking backups, tracking certificate and domain renewals, watching uptime and making small changes. A website is not a printed brochure. It runs on a server, an operating system, a programming language and a framework or CMS, and each of those releases updates on its own schedule. Even if your site never changes, everything around it does. ## Why does a website need maintenance? A website needs maintenance because new security flaws are found in the software it runs on, and only updates close them. Once a flaw is public, automated scanners try it against sites across the internet. Unpatched sites are the easy targets. Support also ends. Every version of a language or framework has a support window, and after it closes no more security fixes are released. PHP, for example, publishes active and security support dates for each version. External services change too. Payment, shipping, invoicing and map APIs retire old versions, and an old integration eventually stops working. ## What happens if you skip maintenance? If you skip maintenance, the site usually degrades quietly until something visible breaks. The cases we see most often: - An outdated plugin lets someone inject malicious code, and visitors get redirected or search results show a warning. - The SSL certificate expires and browsers show a full-page security warning. - The domain renewal is missed and the site and email stop together. - The server fails and the backups turn out to have stopped months ago. - The contact form stops sending email and nobody notices for weeks. - The database grows, images pile up and pages get slower. ## What does website maintenance cover? Website maintenance covers six areas: software updates, security patches, backups, SSL and domain renewals, monitoring, and content and small changes. The weight differs from site to site, but none of them can be dropped entirely. ## The six parts of website maintenance - **Software updates**: Language, framework, CMS, theme and plugin updates, tried on a staging copy first and then applied to the live site. - **Security patches**: Published vulnerabilities are checked against your site and patched first if they apply. - **Backups and restores**: Files and database are backed up off-server, and a restore is tested at regular intervals. - **SSL and domain renewals**: Renewal dates are tracked, and automatic renewal is checked to be actually working. - **Monitoring**: Alerts when the site goes down, slows down or the form stops working, before visitors notice. - **Content and small changes**: Small in-scope edits such as text fixes, a new field or a layout tweak. New features are separate work. ### How are updates applied safely? Updates are applied to a copy of the live site first, called a [staging environment](/en/glossary/staging-environment). If nothing breaks, they go live, followed by a quick check of the key flows: home page, form, and cart and checkout if there is one. With a code repository, every update is a separate commit, so rolling back takes minutes. ### Why is a backup not enough on its own? A backup you cannot restore is the same as no backup. Incomplete database dumps, corrupt archives and a single copy stored on the same server are common. Good [backup](/en/glossary/backup) practice means automatic backups, at least one copy off the server, and a restore test into an empty environment every few months. ### Why are SSL and domain renewals part of maintenance? Both expire, and when they do the site is effectively closed to visitors. Certificate lifetimes are getting shorter by industry decision, which makes manual renewal impractical. Automatic renewal is set up and still monitored. For domains, ownership matters most. If the domain is not in your name, renewal is not in your control either. We cover this in [who should own your domain and hosting](/en/blog/who-should-own-your-domain). ### What does monitoring catch? Basic monitoring checks every minute that the site responds. Better monitoring also watches page speed, disk space, error logs and whether the form really sends email. Speed deserves attention because it affects both visitors and rankings, as explained in [site speed and Core Web Vitals](/en/blog/site-speed-core-web-vitals). ## What does a monthly maintenance plan include? A typical monthly plan for a company site or a small store looks like this. Backups and monitoring run continuously, updates happen monthly, security patches go in when they are published, and a restore is tested every quarter. At the end of each month you get a short written summary of what was done. ## What drives the cost of website maintenance? The cost of website maintenance depends on how many moving parts the site has and how often they need attention. We do not publish figures here. These are the factors that move the price: - **Platform:** sites built on many third-party plugins need more update and conflict work than sites with few dependencies. - **Integrations:** each connection to payments, invoicing, shipping, marketplaces or a CRM has to be watched and adapted when the other side changes. - **How critical the site is:** an hour of downtime on a store that takes orders costs money. Tighter monitoring and faster response cost more. - **Volume of change:** a few small fixes a month is light. New pages and campaigns every week is a different workload. - **Current state:** a site that has not been updated for years usually needs a one-off clean-up first. - **Response time:** "within a business day" and "within an hour, nights included" are very different promises. ## How does maintenance work at RadKod? At RadKod, maintenance is optional. Every project we deliver includes 30 days of free bug fixes after handover. Monthly maintenance is for after that period, and you can run the site without it. The domain, hosting and code are in your name from day one, so you can also hand the site to another team at any time. If you choose maintenance, we write the scope on a single page. We test updates on staging, check backups and test restores, monitor the site, track renewals and send a short summary every month. The person you talk to is the person who wrote the code. Leaving takes one email, with no penalty, lock-in or notice period. We also take over maintenance of sites built by other teams after a short review, as described in [rescuing an unfinished software project](/en/blog/rescue-an-unfinished-software-project). Details are on our [maintenance and support](/en/services/maintenance-and-support) page. ## Frequently asked questions ### Is website maintenance mandatory? Not legally. But a site that is not updated, backed up and monitored will eventually develop security holes or stop without warning. Decide who owns maintenance before launch. ### Does a static brochure site need maintenance? Yes, a lighter version. The content may not change, but the server, language, certificate and domain do. Updates, backups and monitoring still apply. ### How often should maintenance happen? Backups and monitoring run continuously. Software updates are usually monthly, security patches go in when published, and restores are tested every few months. ### Does my hosting company not do this already? Hosting companies usually look after the server itself. Your framework, plugins, forms and integrations are often outside their scope. Ask them in writing what they cover. ### Can you maintain a site another agency built? Yes. We start with a short review and write down the state of the site and any urgent fixes on one page. Maintenance starts after that clean-up. ### How do I cancel a maintenance plan? With us, one email is enough. There is no penalty, lock-in or notice period, and the accounts and code are already yours. ### Are new features included in maintenance? Small in-scope changes are included. A new module, language or integration is separate work with its own one-page quote and definition of done. ## Sources - [Supported Versions](https://www.php.net/supported-versions.php), PHP - [OWASP Top Ten](https://owasp.org/www-project-top-ten/), OWASP Foundation - [Let's Encrypt Documentation](https://letsencrypt.org/docs/), Let's Encrypt **Let us look after your site** [Get a quote](https://radkod.com/en/get-a-quote)