Website Maintenance: What It Actually Covers (And Why Skipping It Costs More)

If your website is the front door to your business, "maintenance" is the lock, the hinges, the doormat and the postbox. Skip it for long enough and people stop coming in. Most UK businesses think of website maintenance as a hosting bill plus the occasional theme update. It is more than that, and the gap between what is sold as maintenance and what a site actually needs is where most of the trouble lives.

This piece covers what real website maintenance includes, what UK agencies typically charge for it in 2026, and the warning signs that yours is not being done properly.

The seven things "website maintenance" actually means

Maintenance is a bundle, not a single task. A site that is properly looked after gets each of the following carried out on a regular cadence, not just when something visibly breaks.

1. Security patching

CMS core, extensions, plugins, themes, server-side libraries and the underlying PHP/Node runtime all receive security advisories. Joomla and WordPress between them have several security releases a year; popular extensions release patches more frequently than that. A site running an unpatched version is not "stable", it is exposed. The Joomla Security Strike Team publishes coordinated disclosures so attackers and defenders see them at the same time, which means the window between advisory and exploitation is measured in hours, not weeks.

Patching means: review advisory, check compatibility, apply on a staging copy, smoke test, deploy to production, verify version on the live site. Anything less is just hoping.

2. Backups (and tested restores)

Backups that have never been restored are a guess. A maintenance contract should include a documented restore drill at least quarterly, and ideally an off-site copy that lives outside the hosting account itself; if the hosting account is compromised, backups stored alongside it are gone too.

3. Uptime and performance monitoring

An external monitor (Pingdom, UptimeRobot, StatusCake or similar) checking the homepage and at least one transactional page every minute. Alerts to a human, not just an inbox no one reads. Page load and Core Web Vitals tracked over time so degradation gets caught before customers notice.

4. SSL, DNS and email deliverability

Certificate renewal is mostly automated now, but the renewal still has to actually happen, and someone needs to notice when it does not. DNS records drift: SPF, DKIM and DMARC for outbound email; CAA records; the AAAA record someone added for an old IPv6 trial three years ago. A maintenance review checks these annually at minimum.

5. Content, accessibility and SEO hygiene

Broken internal links, dead outbound links, images missing alt text, headings out of order, contact forms that no longer reach anyone. The Public Sector Bodies Accessibility Regulations have raised the bar for UK public sector sites, and private sector sites increasingly need to meet WCAG 2.2 AA to avoid complaints. Maintenance is the right place for this work; doing it once at launch and never again is how sites quietly drift into non-compliance.

6. Database hygiene

Sessions table swelling to gigabytes, search index out of date, cache tables not being pruned, orphaned records from extensions that were uninstalled badly. None of this is visible from the front end until the day the site is suddenly slow and nobody knows why. A monthly database health check catches it cheaply.

7. Disaster recovery and access control

Who has admin access? Are the accounts of former staff still active? Is two-factor authentication enforced? Is there a written runbook for "the site is down and I cannot reach the developer"? These are not exciting questions, but they are the ones that matter at 9pm on a Sunday when something has gone wrong.

What UK agencies actually charge for this in 2026

Pricing varies enormously and the headline figure rarely tells the full story. The figures below are typical for UK SMB websites in 2026 and are based on published agency rate cards plus what we see in our own client base.

Tier	Typical monthly cost	What is usually included	What is usually not
Hosting only	£10 to £40	Server, automated SSL, server-level backups	CMS updates, extension updates, content changes, monitoring
Basic care plan	£40 to £120	Hosting, monthly CMS and plugin updates, weekly backup	Tested restores, security incident response, content edits
Standard maintenance	£120 to £300	The above plus uptime monitoring, performance tracking, small content edits, quarterly review	Major version upgrades, accessibility audits, design changes
Managed / business critical	£300 to £1,000+	The above plus same-day incident response, accessibility checks, staging environment, documented DR plan	New features, redesign work

Two things are worth flagging. First, the cheapest tier is genuinely just hosting, sold as "maintenance"; it leaves the customer responsible for everything that breaks. Second, the gap between £40 and £300 is mostly down to whether updates are tested before they are pushed live. Untested updates are how a routine Tuesday turns into an emergency.

Eight warning signs your maintenance is not being done

You cannot remember the last time you saw a maintenance report.
You cannot say which version of the CMS your site is running.
The login screen still works for ex-employees.
Your contact form has not been tested in over a year.
Your backups have never actually been restored.
The hosting renews automatically and that is the only "maintenance" event in the calendar.
The agency has not contacted you about a security release in the last twelve months.
Page load on the homepage is over four seconds on a phone over 4G.

If three or more of those are true, the site is being run on borrowed time.

What to ask before you pay for another year

Before renewing a maintenance contract, ask the supplier to send you, in writing:

The current CMS version and the date of the last security update applied.
The backup schedule, where backups are stored, and the date of the last successful test restore.
The uptime figure for the last 90 days from an external monitor.
A list of users with admin access, and which of them have two-factor authentication enabled.
A written response time SLA for security incidents.

An agency that takes maintenance seriously will have all of this to hand. An agency that cannot answer is selling hosting and calling it maintenance.

The honest summary

Website maintenance is not glamorous and it does not produce screenshots for the portfolio, but it is what keeps a site doing its job between redesigns. The cost of getting it right is predictable. The cost of getting it wrong, in lost sales, leaked customer data or a site that is offline during your busiest week, is not.

If you are not sure where your site sits on the table above, that itself is the answer. Time for a conversation with whoever you are paying.

Phil Walton is the founder of SoftForge, a Joomla 6 Release Manager, and a member of the Joomla Security Strike Team. SoftForge maintains websites for UK businesses and public sector clients.