Maintenance is the easiest line to cut, because the return is invisible. Nothing breaking is not a result anyone celebrates. So it gets deferred, then deferred again, and the bill arrives all at once.
The costs, in the order they usually appear
Search visibility, slowly. Nothing dramatic happens. A plugin update introduces a rendering issue on mobile. An expired certificate throws a warning for a week. Broken links accumulate. Page speed drifts as unoptimised images pile up. Rankings decay a little each month, and by the time it is noticeable, recovery takes longer than prevention would have.
Conversion, quietly. A checkout that fails on one browser. A contact form that has been silently discarding submissions since a mail configuration change. This is the failure mode that costs the most and gets noticed the least — there is no error message when leads simply stop arriving.
Security, suddenly. Known vulnerabilities in popular plugins are published, and automated scanners begin probing for them within hours. An unpatched site is not targeted because it is valuable; it is targeted because it is reachable. The cleanup cost, the notification obligations if customer data was exposed, and the reputational damage all substantially exceed the patching that would have prevented it.
Availability, expensively. Certificates expire. Disks fill. Databases that have never been optimised eventually hit a query that times out under load — usually during your busiest trading period, because that is when load peaks.
What a maintenance schedule actually covers
Weekly
- Apply security patches to core software and plugins
- Verify backups completed and are restorable
- Check uptime monitoring and error logs
- Scan for malware
Monthly
- Test the full restore procedure — an untested backup is a hope, not a backup
- Review page speed and Core Web Vitals against baseline
- Audit broken links and redirect chains
- Check form submissions are being received and stored
- Database optimisation and cleanup
Quarterly
- Full security audit including user access review
- Dependency audit — what is unmaintained, what needs replacing
- SSL certificate expiry check with renewal scheduled
- Review third-party scripts and remove what is no longer used
Annually
- Platform major version planning
- Hosting and capacity review
- Accessibility audit
- Content and structure review
The plugin problem
On WordPress and similar platforms, most incidents trace to plugins. The failure pattern is consistent: a plugin was installed for a feature used once, the developer stopped maintaining it, and it now sits in the codebase as an unpatched entry point.
A simple discipline prevents most of this. Every quarter, list installed plugins and ask three questions: is this still used, is it still maintained, and does it duplicate something else we have. Remove anything failing any of the three. Deactivating is not enough — uninstall it.
Backups that are not backups
A backup only counts if you have restored from it recently. We have seen backups running faithfully for two years to a location nobody could access, backups of the filesystem but not the database, and backups stored on the same server as the site they protected.
Test restores quarterly. Store copies off-site. Know your recovery time objective before you need it, not during the incident.
The economics
Maintenance is a small, predictable, monthly cost. Recovery from neglect is a large, unpredictable, urgent one — and urgent work is always the most expensive kind, because it displaces everything else and it is priced accordingly.
The comparison is not "spend on maintenance versus spend nothing." It is "spend a little on a schedule versus spend considerably more at the worst possible moment."
Our website maintenance plans cover this schedule with monthly reporting, and start with a free audit — including one critical fix, before you commit to anything.
Need help with this?
Our team applies exactly this analysis for clients across six countries. Start with a no-cost assessment of your own site.
Request an Assessment