Website Maintenance and Updates

A website is not a sign, and that is the whole problem

A sign on TX-198 does what it did the day it went up. A website is software, running on somebody else's computer, connected to a public network, built out of parts written by dozens of separate vendors, and paid for by a card that expires. It rots quietly, and nothing announces it.

That is the honest case for maintenance, and notice what it is not. It is not that somebody is hunting your five-page brochure site for the contact-form archive. It is that automated systems scan everything, that the parts your site is made of get patched constantly, and that the administrative details holding it all up have expiry dates nobody wrote down.

It is also not a case for the largest plan on offer. Much of what is sold to small businesses under the word security addresses risks a brochure site does not have, and we name those products below.

What actually goes stale

Six things, in the order they cause trouble.

The content management system core. WordPress and its equivalents ship security releases regularly. Core is rarely the problem; leaving it years behind is.

The plugins and the theme. This is the real surface. Researchers logged 11,334 new vulnerabilities in the WordPress ecosystem during 2025, up 42 percent year over year, and 91 percent were in plugins, 9 percent in themes, and six in WordPress core itself, all low priority. WordPress is not the problem. The twenty-three plugins somebody installed in 2019 are.

The PHP version. The language your site runs on has a published support timeline, and hosts eventually force the upgrade. As of the middle of 2026, PHP 8.0 and 8.1 are fully end of life, 8.2 receives security fixes only until the end of 2026, 8.3 until the end of 2027, and 8.4 and 8.5 are in active support. A site running an abandoned plugin that breaks on a newer version fails with a blank white page the day the host flips the switch, and the notice arrived by email six weeks earlier.

The SSL certificate. The maximum lifetime of a public certificate dropped to 200 days on 15 March 2026, and Let's Encrypt stopped sending expiry reminder emails on 4 June 2025. Certificates now expire more often and warn you less. The symptom is a full-page browser interstitial telling your customers the connection is not private.

The card on file, at the registrar and at the host. An expired card at the registrar does not take the site down; it takes the domain down, which takes the email with it, and it looks identical to being hacked. The variant that catches people is a domain registered years ago by a designer, with renewal notices going to that designer's inbox.

The contact form. It stops delivering, usually silently. The tell is not an error message. It is a customer saying they emailed and never heard back.

How sites actually get defaced or injected

Almost nobody defaces a small business website any more. In one widely cited analysis of infected sites, defacements were about 4 percent of what was found, while backdoors appeared on roughly 49 percent and search spam injections on about 20 percent. That report covers 2023 and no newer edition has been published, so date it in your head. The pattern holds: attackers install something quiet and monetize you slowly.

1. A scanner, not a person. An automated system requests a predictable file inside a plugin's directory, reads the version number, and if it matches a disclosed vulnerability, fires the exploit. Nobody looked at your site or decided you were interesting.
2. Speed. The median time from disclosure to mass exploitation for heavily targeted vulnerabilities has been measured at around five hours, with roughly half of high-impact vulnerabilities exploited within a day. A plan whose deliverable is somebody logging in on the first of the month cannot win that race. Automatic updates plus a restorable backup can.
3. Abandoned plugins. Worse than out of date is unmaintained: no update is coming, ever. The only fix is removal and replacement, and it is the most common real finding in an honest review of a small site.
4. Old credentials. Saved passwords in a file transfer program on an infected laptop, or the previous designer's administrator account, still active, still using a password from 2018.
5. The contact form as a spam relay. A form that drops user-supplied text into mail headers lets an attacker add recipients. Your site sends spam on somebody else's behalf, the server's address lands on a blocklist, and your own legitimate email stops arriving. That is the most expensive outcome here for a service business, because you never learn which quotes never landed.
6. The uploads folder executing code. An upload form that accepts a script file, plus a server willing to run anything in that folder, equals a shell. The fix is a server rule refusing to execute code in the uploads path: free, permanent, and something most paid plans never do.

One caveat before anyone oversells updating. Roughly 39 percent of infected sites were running out-of-date software when they were infected, which means about 61 percent were current and were compromised anyway, usually through a stolen password or a bug with no patch yet. Around 46 percent of disclosed vulnerabilities had no patch on the day they became public. Updating is necessary; it is not sufficient. The data comes from Patchstack and Sucuri, both security vendors, which is worth knowing as you read their numbers.

Backups you control, and the 3-2-1 rule

A backup you cannot reach is not a backup, and that is the difference between the host's backup and one you control.

The host's backup usually lives on the same server or inside the same provider's storage, is retained for something like a week to a month, and sometimes needs a support ticket to restore. It does not survive the host suspending your account, a billing dispute you lose, the host going out of business, or a designer locking you out. In every one of those cases the backup is inside the thing you lost access to.

The 3-2-1 rule is the standard formulation: three copies of the data, on two different kinds of media, with one copy off-site. It originates with photographers and has been repeated in US government security guidance ever since. For a small website it is this small:

1. The live site.
2. The host's automatic backup, which does not count as the off-site copy because it is the same provider.
3. A periodic archive of the files plus a database dump, downloaded to a cloud drive or a computer the owner controls.

Two details decide whether that third copy works. For a database-driven site the backup must be both halves: the files and a database dump. Files alone restore an empty site with no pages and no settings, and that is the most common backup failure at this scale. And an untested backup is a hypothesis; one restore test a year takes about an hour, and it is where people find they had files but no database, or an archive that will not open.

Host marketing gets retention backwards by emphasising frequency. For a site that rarely changes, retention length matters more, because the failure mode is a spam injection you notice six weeks later, at which point every restore point in a seven-day window is already infected.

Two decisions size the whole thing: how much work you are willing to lose, and how long you can be down. A brochure site edited twice a year can lose a month of changes and survive a day offline. A store taking orders on a Friday afternoon can do neither.

Which security products are theatre for a brochure site

Blunt section. If you run a five-page site with no login, no cart and no customer data, most of these are sold against a risk you do not have.

• A paid web application firewall subscription. A firewall of this kind filters traffic to an application; if there is barely an application, it filters nothing you care about. Independent testing found host-level firewalls blocked only about 12 percent of known-exploited vulnerabilities. It does earn its place on a store, a membership site, or a site already compromised once.
• Malware scanning on a static HTML site. No database, no plugins, no server-side code. There is nothing to scan.
• An SEO security audit. Not a real category. Buy a security scan, several of which are free, or a search audit with named deliverables.
• PCI scanning for a site that never touches a card number. If payments run through a hosted checkout or over the phone, card data never reaches your server.
• Trust seals and site-secure badges. Decoration. They verify nothing a visitor can check, and they add a third-party script to every page: a real supply-chain risk traded for a graphic.
• Denial-of-service protection plans for a site with a few hundred visits a month.
• Dark web monitoring. It tells you a password appeared in a breach. A free public service does the same, and the action item is identical: change the password.
• Cyber liability insurance sold by a web company. Buy it from a licensed agent, where it is regulated and usually cheaper bundled with the business owner's policy.
• A plan whose deliverable is a monthly PDF. Ask what it does the day a critical bug is disclosed at 2am. If the answer is that somebody checks on the first of the month, you bought a report.

The honest framing: on a small brochure site, most real risk reduction comes from four free things. Unique passwords in a password manager, multi-factor authentication on the registrar and the host before anywhere else, automatic updates switched on, and one backup stored somewhere the owner controls. What is worth paying for is not a subscription. It is somebody who answers the phone and can restore the site.

What maintenance actually consists of when it is worth buying

Stripped of the marketing, real maintenance on a small site is a short list done reliably:

• Core, plugin and theme updates applied promptly, with automatic updates on for security releases rather than saved up for a monthly visit.
• Unused plugins and themes deleted, not deactivated. A deactivated plugin's files are still on disk and still reachable, and plenty of exploits work fine against one.
• Fewer plugins overall. On a brochure site, plugin count is the attack surface, and each one is a separate vendor you are trusting.
• A backup you control, on a schedule matching how often the site changes, restored as a test once a year.
• Certificate renewal automated and monitored, because nothing emails you when it expires now. The support timeline for the underlying language is published at php.net: know what version you run before the host changes it for you.
• Uptime and defacement monitoring, so you learn about an outage before a customer tells you. Free monitoring at five-minute intervals is adequate at this scale.
• Accounts removed when people leave: the old designer, the former employee, the volunteer who moved away.
• Content changes as you need them, which for most small businesses is the part they wanted when they asked about maintenance.

What drives the cost is not mysterious: whether the site runs on a content management system or is static, how many plugins it carries and whether any are abandoned, whether there is a store or a login, and how often you want content changed.

When you do not need this

A static site the owner updates twice a year does not need a maintenance retainer. If your site is plain HTML with no content management system, no database and no plugins, there is no software on it to exploit and nothing to keep patched. The only recurring items are the domain renewal, the hosting bill and the certificate, and all three should be automated and pointed at a card and an inbox you control. That is a calendar reminder, not a monthly invoice. Call somebody when you want a change, and pay for the change.

Several related things are sold to businesses that do not need them:

• Real-time or hourly backups for a site whose content changes twice a year. Weekly, plus a manual backup before any change, is fine. A store taking orders is a different case.
• Paid one-minute uptime monitoring. The difference from free five-minute monitoring is four minutes of delay on a site nobody was visiting at 3am.
• A written disaster recovery plan document for a twelve-page site. The plan is one index card: where the files and database live, which registrar holds the domain and in whose name, which host, and which email address the accounts use.
• A staging environment for a site edited twice a year.
• A content delivery network for a business whose customers are all within forty miles. That product solves distance, and your customers have none of it.
• A 99.99 percent uptime agreement. The difference between that and 99.9 percent is about thirty-nine minutes a month, and agreements of this kind pay in service credits capped at a fraction of the monthly fee. Ask instead what the host's measured uptime was last year, and whether a human answers the phone on a Saturday morning.

Where a retainer earns its place: a content management system with more than a couple of plugins, any site taking payments or logins, a site that changes regularly, a business that would lose real money from a day offline, or an owner who does not want this to be their problem. Fear of a hypothetical hacker, sold against a five-page brochure site, is not on that list.