Web Development

Website Maintenance Services for Small Business: What to Buy

What website maintenance services for small business include, what your platform already covers, the expiry dates to watch, and how to size the cost.

Ảnh đại diện Long Nguyen

Long Nguyen

Lập trình viên Fullstack · Kỹ sư AI · Nhà nghiên cứu

• • 5 phút đọc •

What website maintenance services include

Website maintenance services for small business are the recurring jobs that keep a site online, secure and working after launch: software updates, backups, security monitoring, renewals of the domain and TLS certificate, and regular tests of the forms or checkout that bring in money. Design changes, new features and marketing are separate work, even when the same provider sells them.

The table below is the full list. The last column matters most when you compare plans, because several of these jobs need no developer at all.

TaskWhat it preventsHow oftenWho can do it
Core, plugin, theme and dependency updatesKnown security holes staying openWeekly to monthlyOwner on a small site, developer on a store or custom build
Backups stored away from the server, plus a restore testLosing the site to a hack, a bad update or a mistaken deletionDaily backups, restore test every quarterDeveloper to set up, owner to confirm
Uptime and error monitoringFinding out from a customer that the site is downContinuous, automatedDeveloper to set up
Domain, TLS certificate and software end-of-life datesThe site or business email going offline on a known dateMonthly checkOwner
Form, booking and checkout testsLeads and orders that silently never arriveMonthly and after every updateOwner
User accounts and access reviewFormer staff or old contractors keeping admin accessQuarterlyOwner
Speed, broken links and accessibility checksSlow pages, dead ends and visitors who cannot use the siteQuarterlyDeveloper for fixes
Small content fixes: hours, prices, staff, legal pagesOutdated information that costs trustAs neededOwner, or provider if it is in the plan

A note for businesses selling to consumers in the EU: the European Accessibility Act has applied to online shops and other e-commerce services since . Micro-enterprises that provide services are exempt, but if you are above that size, accessibility checks belong in the plan and not on a wish list.

What your platform already covers

The platform your site runs on decides how much maintenance is left for you. This is the first thing to establish before buying a plan, and it is where small businesses most often pay for work nobody needs to do.

JobHosted builder (Shopify, Wix, Squarespace)Self-hosted CMS (WordPress, WooCommerce)Custom-built site (Django, Laravel, Next.js)
Server and core software updatesPlatformYou or your providerYou or your provider
Security patchesPlatform for its own code; apps and themes you add are yoursCore security releases install automatically by default; plugins and themes only if someone switched that onEvery dependency is yours
TLS certificatePlatform, automaticHost, usually automatic, worth verifyingYou configure and monitor it
Backups you can restore yourselfVaries by platform and plan; check what you can roll backYou or your providerYou or your provider
Domain renewalYouYouYou
Forms, checkout, content, access, accessibilityYouYouYou
Maintenance effort left overLowMediumMedium to high

Two things follow from this. A five-page site on a hosted builder rarely justifies a monthly technical plan, because the platform has already taken the technical jobs. And a hosted platform protects you from its own failures, not from your mistakes: if someone on your team deletes a product catalog or overwrites a page, what you can recover depends on the platform and your plan, so find out before you need it.

The expiry dates that take a site down

Hacks get the attention, but a small business site more often goes offline because a date passed and nobody was watching it. Three dates deserve a recurring calendar entry.

Domain registration

For generic domains such as .com, ICANN's rules require the registrar to send at least two renewal reminders before expiry, roughly one month and one week ahead, and another after expiry if the name is still not renewed. After expiry the registrar must interrupt the domain's DNS before deleting it, which takes down the website and every email address on that domain at the same moment. A deleted name can usually still be restored during a 30-day redemption period, at a higher cost than a normal renewal.

Those reminders go to the email address on the registrar account. If that address belongs to a former employee or the freelancer who built the site five years ago, the reminders are being sent and nobody is reading them. Country domains such as .co.uk, .de or .ae follow their own registry's rules, so check those separately.

TLS certificates

The certificate behind the padlock in the browser used to be something you could renew once a year. That is over. The CA/Browser Forum schedule for shorter certificate lifetimes cuts the maximum in steps:

Certificates issued fromMaximum lifetime
Before 398 days
200 days
100 days
47 days

At 47 days, renewing by hand stops being realistic. Most hosts and all the large hosted builders already renew certificates automatically, so the maintenance job has changed: confirm that automatic renewal is switched on, and that a person gets an alert when it fails. An expired certificate puts a full-page browser warning in front of every visitor.

PHP version end of life

WordPress, WooCommerce, Drupal, Magento and Laravel all run on PHP, and each PHP version stops receiving security fixes on a published date. These are the dates on the official PHP supported versions page:

PHP versionSecurity fixes untilWhat to do
8.1 and olderAlready endedUpgrade now
8.2Plan the upgrade this quarter
8.3Fine for now
8.4Fine
8.5Fine

Your hosting control panel shows which version the site runs on. Moving up a version is a setting in that panel, but old plugins and themes can fail on a newer PHP, so the change should be tried on a copy of the site first.

Why updates break sites

Most maintenance damage is self-inflicted: an update goes in, nothing reports an error, and part of the site stops working.

I ran into this on netalith.com itself. I moved the site's styling from Tailwind's CDN script to a compiled static stylesheet. Together with prioritizing the main image and fixing color contrast, that took the PageSpeed performance score from 81 to 93. During that work, the newest release of Tailwind's build tool (v4) processed the project without complaint and produced an incomplete stylesheet, because the project's configuration was written for v3. Pinning the build to the v3 release fixed it. No error message pointed at the problem; only looking at the pages did.

That is the part of maintenance worth paying for. Clicking update takes seconds. Knowing whether the update was safe takes a process:

  1. Take a backup immediately before the change.
  2. Apply the update to a staging copy, not the live site.
  3. Look at the main pages on a phone and a desktop, then run the money path end to end: submit the form, make the booking, place a test order.
  4. Deploy to the live site and repeat the same checks.
  5. Keep the previous version ready, so a rollback takes minutes.
  6. Treat major version jumps as small projects: read the release notes first and schedule them outside your busy hours.

A provider that switches on automatic updates for everything on the live site and sends an invoice has skipped steps two to five.

How much website maintenance costs for a small business

Published average prices for maintenance plans come mostly from companies selling those plans, and the ranges are too wide to tell you anything about your own site. A more useful way to size the cost is in hours of work per month, which you can then multiply by any provider's rate.

SiteRecurring workEstimated hours per month
Brochure site on a hosted builderExpiry checks, form test, review of added apps, small content fixes0.5 to 1
WordPress business site with 10 to 20 pluginsStaged updates, backup verification, uptime monitoring, form tests1 to 3
WooCommerce or other self-hosted storeAll of the above, plus checkout tests and payment, shipping and feed integrations3 to 6
Custom-built web applicationDependency and server patching, monitoring, database backups, restore drills4 to 10 or more

These are starting estimates for a site in good condition. A site that has gone a year or more without updates needs a one-time catch-up first, and that is priced separately from the monthly work.

Six things push the price up: the number of plugins and integrations, taking payments online, a guaranteed response time, content edits included in the plan, hosting bundled in, and the state of the site on the day the provider takes it over.

Maintenance is usually sold in one of three ways:

ModelBest forWatch for
Fixed monthly planStores and sites where downtime costs sales the same dayVague task lists, and hours that expire unused
Prepaid block of hoursSites with uneven needs across the yearWhether routine updates are scheduled, or wait until you ask
Pay per taskHosted-builder sites and owners who handle the routine checks themselvesNobody watching the site between tasks

Do it yourself or hire a maintenance service

A non-technical owner can cover a large share of the list in about half an hour a month. This routine works on any platform:

  1. Open the site on your phone and send yourself a message through the contact form, or place a test order. Confirm that the email arrives.
  2. Log in to the domain registrar. Check the expiry date, that auto-renew is on, that the payment card is current, and that the account email is one you read.
  3. Click the padlock in the browser and note when the certificate expires.
  4. If the site is on WordPress, check that a backup from this week exists, then apply the pending updates and repeat step one.
  5. Open Google Search Console and read the Security issues and Manual actions reports.
  6. Remove user accounts for people who have left, and turn on two-factor login for everyone who stays.

Hiring makes sense when one or more of these is true:

  • The site takes payments or bookings, so an hour of downtime has a price.
  • Nobody in the business could restore the site from a backup today.
  • The site depends on more than a handful of plugins, or on custom code.
  • The person who built the site is no longer reachable.

If the site in question is a company or brand site on a CMS, that falls under Netalith's business and CMS website service.

How to choose a website maintenance provider

Seven questions separate a provider who maintains sites from one who bills for them. Ask them before signing.

QuestionA good answerRed flag
Whose name are the domain, hosting and platform accounts in?Yours. The provider works through access you grant and can revoke.Everything is registered under the provider's own account.
Where are backups kept, and when did you last restore one?Away from the web server, with a dated restore test.'The host takes care of backups.'
How do you apply updates?On a staging copy first, followed by checks and a rollback plan.Automatic updates on the live site, with no checks.
What is included, and what is billed extra?A written task list and a defined amount of content edits.'Unlimited' anything.
How fast do you respond when the site is down, and in which hours?Stated working hours, a time zone and a response target.No commitment in writing.
What do I receive each month?A report: updates applied, backup and restore status, uptime, upcoming expiry dates, open issues.An invoice and nothing else.
What happens if I leave?Credentials and the latest backup handed over, with no exit fee.A long lock-in, or the site held until a final payment.

The first question matters more than the rest combined. If the domain is registered in your name and you hold a recent backup, every other mistake can be undone with a different provider.

Get a maintenance scope for your site

If you would rather hand this over, tell me what the site runs on, roughly how many plugins or integrations it has, and whether it takes payments. You get back the list of tasks that site needs, the hours involved and a price for that scope, with nothing bundled in that your platform already does for you. Request a free website maintenance quote; it needs no account and costs nothing.

CÂU HỎI THƯỜNG GẶP

Câu hỏi thường gặp

How often should a small business website be maintained?

Backups and uptime monitoring should run automatically every day. Software updates are worth applying weekly to monthly, form and checkout tests monthly and after every update, and expiry dates deserve a monthly look. Backup restore tests, speed checks and access reviews fit a quarterly schedule.

Is website maintenance the same as hosting?

No. Hosting is the server space that keeps the site reachable. Maintenance is the work done on the site itself: updates, backups you can restore, security checks, renewals and testing. Some hosts add automatic updates or backups, but they do not test whether your forms and checkout still work afterwards.

Do I need a maintenance plan if my site is on Shopify, Wix or Squarespace?

Usually not a technical one. Those platforms update their own servers, software and certificates. What remains is your domain renewal, the apps and themes you added, form and checkout tests, content accuracy and user access, which most owners can handle with a short monthly routine or occasional paid help.

What happens if I stop maintaining my website?

Nothing visible at first. Over time, unpatched plugins become a way in for attackers, the PHP version behind the site stops receiving security fixes, and a failed certificate or domain renewal can take the site and business email offline in a day. The longer the gap, the more a catch-up costs.

Does website maintenance include SEO or content changes?

Not by default. Maintenance keeps the existing site working. Some plans add a fixed amount of small content edits each month, but new pages, redesigns, new features and SEO campaigns are separate work, so ask for the included tasks in writing.

Can I switch maintenance providers without rebuilding my site?

Yes, as long as the domain, hosting and platform accounts are in your name and you hold a recent backup. The new provider then only needs access. If those accounts sit under the old provider's name, get them transferred to you before you give notice.

Cập nhật cùng Netalith

Nhận kiến thức công nghệ, cập nhật sản phẩm và ưu đãi đặc biệt qua email.