Website Maintenance for UK Businesses: What It Involves and Why It Matters

Website maintenance is the routine work that keeps a site secure, fast, working and legally up to date after launch: updates, backups, security monitoring, speed checks, form and link testing, and keeping hosting and domains renewed. It is unglamorous, and it is easy to skip, which is exactly why so many small business sites break, slow down or get hacked a year or two after they go live.

This guide is built around the monthly routine we use on client sites. For each task it explains what it involves, how often it should happen and the kind of failure it prevents, including a few we have had to clean up ourselves. By the end you should know whether to handle maintenance in-house or hand it to someone else.

What website maintenance actually covers

Most people think of maintenance as "updating plugins". That is one part of it. A complete routine covers six areas:

1. Software updates for the CMS, theme and plugins, plus the server's PHP version.
2. Backups taken automatically, stored safely and tested.
3. Security monitoring, from login protection to malware scanning.
4. Performance checks so the site does not slowly get heavier and slower.
5. Function and content checks: forms, checkout, links, prices, opening hours and legal pages.
6. Hosting, domain and certificate renewals, with the accounts in the right hands.

Each area prevents a different kind of failure. Updates prevent known security holes being exploited. Backups turn a disaster into an inconvenience. Monitoring catches problems before customers do. Function checks stop leads disappearing without anyone noticing. Renewals stop the whole site vanishing because a card expired.

Good website maintenance is proportionate. A five-page brochure site on a well-managed host needs less attention than a WooCommerce store taking orders every day. But every site needs someone to own it. The most common problem we find is not a lack of knowledge. It is that nobody was responsible.

Maintenance for sites that are not on WordPress

Static HTML sites have no plugins to update, which removes the biggest risk, but they still need hosting, domain and certificate renewals, form testing, content updates and backups of the files. Hosted platforms such as Shopify, Wix and Squarespace update their own software, but apps, integrations, content, forms and account security remain your responsibility. Every site needs maintenance; only the list changes.

Core, theme and plugin updates

WordPress releases a major version a few times a year, with maintenance and security releases in between, and the project publishes its plans on the WordPress roadmap. Across a typical site with a theme and fifteen to thirty plugins, some update is available most weeks.

Why updates matter

Security researchers regularly report new vulnerabilities in WordPress plugins and themes. Patchstack's annual State of WordPress Security reports have consistently found that the large majority of new vulnerabilities are in plugins, with very few in WordPress core. Once a vulnerability is published, automated attacks often follow quickly, so an unpatched plugin is an open door.

A sensible update routine

1. Take a fresh backup before any update.
2. Update on a staging copy first for sites with shops, bookings, memberships or custom code.
3. Update in small batches so that if something breaks you know what caused it.
4. Test the important journeys afterwards: home page, a service page, the contact form, and for shops a full checkout.
5. Keep a log of what was updated and when.

When an update breaks something

Even careful updates occasionally cause problems, usually a conflict between a plugin and the theme or another plugin. If it happens, do not start deleting things at random. Restore the backup taken just before the update, or roll back the specific plugin, then reproduce the problem on staging to find the cause. A good routine turns a broken update into a ten-minute rollback rather than a lost day.

Automatic updates

WordPress can apply minor core updates and plugin updates automatically. For simple sites with reputable plugins this is reasonable, as long as backups and monitoring are in place. For sites that take payments or bookings, we prefer controlled updates with testing, because a broken checkout on a Saturday morning costs more than the time saved.

Retire what you do not use

Deactivated plugins can still be a risk if their files remain on the server. Delete anything you do not use, and replace plugins that have stopped receiving updates. Our WordPress security checklist covers how to spot abandoned plugins.

Backups and restores

Backups are the one part of website maintenance that only matters on the worst day. On that day, they are the only thing that matters.

What a good backup setup looks like

• Automatic daily backups of files and database, more often for busy shops.
• Stored off the server, in a separate location or cloud storage, not only in the same hosting account.
• Several restore points kept for at least 30 days, so you can go back to before a problem started.
• Tested restores at least a few times a year, ideally onto a staging site.

The lesson we learned about email

Website backups and email backups are different things. One client on shared hosting lost mailbox data, and even a paid restore from the host did not bring the messages back. The website was fine; the email, which lived with the same host, was not covered the way everyone assumed. If your email is hosted alongside your website, check exactly what the host backs up, for how long, and whether restores are guaranteed. Our guide to website backups explains the options, including what to do if your host's backups are the only copy you have.

Security monitoring

Small businesses are targets precisely because attackers assume they will not notice. The government's Cyber Security Breaches Survey has found that around four in ten UK businesses identify a breach or attack each year, with phishing the most common.

The monitoring basics

• Uptime monitoring that alerts you within minutes if the site goes down.
• Malware and file-change scanning to spot injected code.
• Login protection: limited login attempts, two-factor authentication for admins and no shared accounts.
• A web application firewall at host, CDN or plugin level.
• A regular review of user accounts, removing old staff, contractors and developers.

When monitoring finds something

Speed matters. A hacked site can be flagged by browsers and search engines, drop out of results and send spam from your domain. Our step-by-step guide to what to do if your website is hacked covers the first 24 hours, and our broader guide to website security for small businesses explains prevention.

Speed and Core Web Vitals checks

Sites get slower over time. New plugins, larger images uploaded straight from a phone, extra tracking scripts and new page sections all add weight. Without checks, a site that launched fast can be sluggish a year later without anyone deciding to make it so.

A monthly speed check takes ten minutes:

1. Open the Core Web Vitals report in Google Search Console and look for any pages moving from "Good" to "Needs improvement".
2. Run your home page and a key service or product page through PageSpeed Insights on mobile.
3. Check the size of recently uploaded images.
4. Review any scripts added since the last check.

If a problem appears, fix it while it is small. Our guide to website speed optimisation explains how to diagnose and fix the usual causes.

Content, forms and link checks

This is the part of website maintenance most often skipped, and it is where businesses lose the most money without realising it.

Test every form

Contact forms fail silently. An email setting changes, a plugin update breaks something, the host blocks outgoing mail or messages start landing in spam. The site looks fine and nobody complains, because the people who tried to contact you simply went elsewhere. We have seen forms go unnoticed for weeks.

Every month, submit each form yourself and confirm the message arrives. Use a proper email sending service (SMTP) rather than the server's default mail function, and store submissions in the site as a backup so nothing is lost if an email fails. Test booking forms and checkouts end to end too.

Check links

Broken links frustrate visitors and waste the value of links from other sites. Check for broken internal and external links monthly or quarterly, and fix or redirect them.

Watch your email deliverability

If your domain sends email from your website, such as enquiry notifications or order confirmations, it needs the right DNS records so messages are not treated as spam. Check that SPF, DKIM and DMARC are set up when you change email provider or add a new sending tool.

Keep content accurate

Out-of-date content costs trust. Check prices, opening hours, staff pages, service lists, bank holiday notices and promotions. Review privacy and cookie policies when you add tools that collect data, and keep your copyright year and company details current. On one venue site we maintain, new prices from the client conflicted with an older pricing box elsewhere on the site. Customers see both, so catching those conflicts is part of the job.

Hosting, domains and renewals

Some of the most damaging failures have nothing to do with code.

Domains

If your domain expires, your website and email stop working. Turn on auto-renew, keep the payment card current and make sure the renewal emails go to an address someone reads. The domain should be registered in your business's name. Our guide to domain name ownership explains how to check.

SSL certificates

Most hosts renew free certificates automatically, but automation fails. An expired certificate shows visitors a security warning, which is the fastest way to lose an enquiry.

Hosting and PHP versions

Hosting plans renew, often at a higher price than the introductory rate. Review the plan each year. Also check which PHP version your site runs: older versions stop receiving security fixes, and WordPress 7.0 no longer supports anything below PHP 7.4. The PHP supported versions page shows current dates. Our guides to web hosting in the UK and managed WordPress hosting explain what to look for.

Account ownership

Hosting, domain, DNS, analytics and Search Console accounts should all be accessible to you, not only to a past developer. When a relationship ends badly, missing access turns a routine change into a crisis.

DIY vs a maintenance plan

Website maintenance can be done in-house if someone owns it, has the time and follows a checklist. The risk with DIY is not skill, it is consistency: the routine slips during a busy month, and that is when things go wrong.

A maintenance plan is usually cheaper than a single emergency: cleaning a hacked site, rebuilding from a missing backup or recovering lost rankings can cost more than a year of routine care. Our guide to website maintenance cost shows typical UK prices, and our guide to website care plans explains what a good plan includes. If you run WordPress, our WordPress for business guide explains why the platform needs this routine.

Monthly checklist

Use this as your routine, whether you do it yourself or check that your provider does.

Every week

• Apply security updates for core, theme and plugins.
• Confirm backups ran and are stored off the server.

Every month

1. Update remaining plugins and theme after a fresh backup, testing key pages and forms.
2. Submit every form and complete a test checkout or booking.
3. Check Core Web Vitals in Search Console and test the home page speed.
4. Scan for malware and review admin user accounts.
5. Check for broken links and outdated content.
6. Review uptime reports for any downtime.

Every quarter

1. Test a full restore onto a staging site.
2. Review plugins and remove anything unused or abandoned.
3. Check the PHP version and hosting performance.
4. Review privacy and cookie policies against the tools you use.

Every year

1. Check domain, hosting and certificate renewal dates and ownership.
2. Review hosting plan and costs.
3. Audit the site's content, SEO and accessibility.

If you would rather hand this over, our web development team runs this routine for client sites.

Frequently asked questions

Keep your site in good shape

If you are not sure your site is being looked after properly, ask us about website maintenance and we will check its current state and recommend the right level of care.