Most small-business websites get built, launched, invoiced — and then nobody touches them again. As developers we know entropy doesn't care that the project is "done". Here's what that neglect actually looks like on a timeline, and what a minimal maintenance setup should cover.
The decay timeline
~6 months untouched:
- A typical WordPress install accumulates 3–7 plugins with publicly disclosed CVEs
- Dead links pile up: staff emails change, external resources move
- Uploaded images (5 MB PNGs straight from the phone) quietly drag load time down
~12 months:
- SSL certs expire if renewal isn't automated — visitors get the full-page "Not secure" warning
- Nobody can answer "when was the last backup, and where is it?"
- Stale content starts losing rankings to fresher competitors
~24 months:
- The site gets compromised. Not through a targeted attack — through a known, unpatched vulnerability that a bot scanner found. Most small-site hacks are exactly this boring.
- Cleanup costs real money (typically €500–2,000) plus days of downtime and a possible GDPR incident if forms collect customer data.
The four things that actually need maintaining
1. Updates (security)
CMS core, plugins, and the server's PHP version. WordPress core ships roughly every 4–6 weeks; some plugins patch weekly. If nobody owns this, the site is running known-vulnerable code most of the time. Automate what you can, review what you can't.
2. Backups
The test question: "If the site got wiped right now, how fast could you restore it?" Hesitation = no real backup strategy. Minimum viable setup:
- Automated (daily or weekly, depending on how often content changes)
- Off-site — a backup on the same server dies with the server
- Actually restore-tested. An untested backup is a hope, not a backup.
- ~30 days retention, so you can roll back past the point where a problem started
3. Uptime monitoring
There are two ways to find out your client's site is down: a customer calls them, or a monitor pings you first. A 5-minute-interval uptime check with email/SMS alerting costs almost nothing and turns outages from reputation damage into a non-event.
4. Performance drift
Sites don't stay fast. Content editors upload uncompressed images, the database grows, caches get misconfigured after a hosting migration. A monthly check (Lighthouse or similar, plus a look at the largest assets) catches regressions while they're still trivial to fix.
The content-editing trap
Owners should be able to edit their own site — that's what a CMS is for. But unsupervised self-editing is where a lot of decay comes from: giant images, markup that breaks the mobile layout, meta titles and descriptions silently deleted. The fix isn't taking access away; it's a CMS with guardrails (image processing on upload, constrained content models) plus a periodic technical review. This is exactly why I push headless or structured CMS setups for small-business clients instead of a wide-open page builder.
What maintenance is worth (rough EU market numbers)
| Scope | Who offers it | Monthly |
|---|---|---|
| Plain hosting, no support | Hosting provider | €5–15 |
| Hosting + auto-updates | Managed hosting | €20–50 |
| Full maintenance (updates, backups, monitoring, support) | Freelancer/agency | €49–200 |
| Maintenance + content work | Freelancer/agency | €100–400 |
One professional cleanup after a hack costs more than a year of the cheapest real maintenance tier. That's the whole business case.
When you genuinely don't need a maintenance contract
Honesty matters here:
- Static HTML/CSS site, no CMS, no forms — there's barely anything to maintain. Renew the cert, done.
- You're technical and actually do the updates + backups yourself — great, keep doing it.
Where it stops being optional: WordPress with plugins, anything with forms collecting personal data, shops, booking systems. In other words: most real business websites.
If you build sites for small businesses, offering maintenance isn't an upsell gimmick — it's the difference between shipping something that works at launch and something that still works in year three. I run a small web studio (acessio, Königstraße 35, 70173 Stuttgart) and every project we hand over ships with this conversation attached.
Top comments (0)