What does website maintenance actually include?
The short answer
It should cover four things — keeping the site online, keeping it secure, keeping it working as browsers and services change, and keeping the content current. Most maintenance agreements cover the first three and charge extra for the fourth, which is backwards, because content is the part that actually decays and the part that affects whether the site earns anything.
On this page
Why a website needs maintaining at all
A website is not a printed brochure. It sits on a server, depends on other software, and is read by browsers that keep changing. Left completely alone for three years, a site does not stay the same — it degrades.
There are four distinct kinds of work, and they are worth separating because agreements price them very differently.
One: keeping it online
The unglamorous part. The server has to keep running, the domain has to be renewed, the SSL certificate has to stay valid, and someone should notice when the site goes down — ideally before your customers do.
What to check: is there actual monitoring, or does "we'll fix it if you tell us"? And who renews the domain? An expired domain is the fastest way to lose a website, and it happens to real businesses every week because the renewal notice went to an address nobody reads.
Two: keeping it secure
How much work this is depends entirely on how the site was built.
A site built on a platform with plugins needs those plugins updated continuously, because published vulnerabilities are scanned for automatically within days. This is real, ongoing work, and neglecting it is how small business sites end up serving spam.
A site built without that dependency stack has far less exposed surface, and maintenance here is mostly about the server itself.
What to check: are there backups, how often, and — the question almost nobody asks — has a restore ever been tested? A backup that has never been restored is a hope, not a backup.
Three: keeping it working
Browsers update. Payment providers change their APIs. A mapping embed gets deprecated. An email provider tightens its rules and your contact form silently stops delivering.
Nothing has been touched, and yet something has broken. This is the category people are most surprised by, and it is why "the site is finished" is never quite true.
What to check: who notices? If the answer is "you tell us", then in practice you find out when a customer mentions they emailed twice and heard nothing. That specific failure is common enough to have its own article — my contact form stopped working.
Four: keeping the content current
This is the one that matters most commercially and the one usually excluded.
Prices change. Hours change. Services change. Staff leave. Photos age. A site showing last year's prices is not a neutral object — it actively costs you enquiries, and it costs you more than any of the first three categories ever will.
What to check: are content changes included, and how many? "Two hours a month" sounds generous until you need a fifteen-minute change on a Saturday and it waits until Tuesday. The better arrangement is not a bigger allowance — it is being able to make ordinary changes yourself, instantly, without asking.
The questions to ask before signing
- What is your response time when the site is down, and is it monitored automatically?
- How often are backups taken, and when did you last test a restore?
- Are content changes included? How many, and what counts as one?
- Can I edit my own text and photos, or does every change come through you?
- Who owns and renews the domain?
- What happens to my site if I stop paying?
Get the answers in writing. Every one of these is cheap to ask now and expensive to discover later.
What this looks like in Helm
The first three categories are ours and are not itemised, because they are not really optional. Sites run on our own servers with monitoring, nightly encrypted backups, and security handled at the server level. Sites are built without a plugin dependency stack, which removes most of the update treadmill rather than managing it.
The fourth is the one we treat differently. Content changes are yours, unlimited, and cost nothing, because they happen in Edit — your dashboard, on your domain, built so that no technical knowledge is needed. Change a price on a Saturday morning and it is live in a minute.
That is a deliberate design choice rather than generosity. Any arrangement that bills per content change produces websites nobody updates, and a stale website is a worse business outcome than any maintenance failure on the list.
Your domain stays in your own account. We point records at the site; we never hold the name.
The short version
Maintenance is four jobs, not one: staying online, staying secure, staying functional as the world around it changes, and staying current. Ask specifically about monitoring, tested restores, and who renews the domain. And weight the fourth category heaviest — a site that is perfectly patched and eighteen months out of date is still failing at the only thing it was built to do.