A website launches, everyone is pleased, and the project closes. The team moves on to the next thing, which is exactly what should happen.
Then eighteen months pass. Nobody has logged in. The contact form quietly stopped delivering to the sales inbox back in March, and nobody noticed because nobody was watching. The team page lists two people who have left. A plugin nobody remembers installing has a known vulnerability that was published, and exploited, months ago.
None of that is negligence. It’s what happens when a website is treated as a project that ended rather than an asset that runs. The good news is that the fix is small and boring, which is the best kind of fix.
What maintenance actually covers
The word sounds vague, so here’s the concrete version. A maintenance arrangement handles six things:
- Updates. WordPress core, plugins, themes, and the PHP version underneath, applied on a schedule and tested rather than clicked blindly.
- Backups. Taken automatically, stored somewhere other than the server they came from, and restored occasionally to prove they work.
- Security monitoring. Watching for known vulnerabilities in what you’re running, plus malware scanning and login protection.
- Uptime monitoring. An automated tool checking your website every few minutes to ensure the site is up. That way we’ll learn about an issue before before a customer embarassingly tells you.
- Performance checks. Speed drifts downward over time as content and plugins accumulate.
- Small content changes. The staff page, the new certification, the updated phone number. The jobs too small to be a project and too annoying to keep putting off.
The first three are the ones that stop a bad week. The last three are the ones that keep the site earning.
What Maintenance Actually Covers
The update problem is bigger than most owners realize
If you run WordPress, and most B2B sites do, the numbers are worth knowing.
Patchstack, which tracks security across the WordPress ecosystem, counted 11,334 new vulnerabilities disclosed during 2025. That’s up 42% on the year before. Roughly nine in ten of them were found in plugins rather than in WordPress itself, which stays remarkably clean by comparison.
Unfortunately, about 46% of those vulnerabilities had no patch available on the day they were disclosed. Updating promptly is necessary and still not sufficient, which is why monitoring what you’re running matters as much as installing what’s offered.
A typical WordPress site runs twenty to thirty plugins. Each one is a small piece of software written by someone you’ve never met, running with full access to your site. Most are fine. The point of maintenance is that you find out about the ones that aren’t before an automated scanner does.
What actually goes wrong
In practice, neglected B2B sites fail in a handful of predictable ways.
- The silent form. A plugin update, a host change, or an expired API key breaks the contact form. Enquiries stop arriving and nothing announces it. Weeks of leads vanish before anyone notices the inbox has gone quiet.
- The compromise. The site gets used to host spam pages or redirect visitors. Google flags it. Your rankings and your reputation take the damage.
- The slow decay. Speed drifts. Images pile up uncompressed. The site that felt quick at launch takes four seconds to load, and Core Web Vitals scores slide with it.
- The drift. Prices, staff, services, and certifications go stale. A prospect finds a page describing an offer you retired last year.
- The expensive rescue. Two years of skipped updates means plugins that can no longer be updated in place, a PHP version the host is about to drop, and a rebuild where a small monthly arrangement would have done.
That first one deserves a moment, because it’s the most common and the most costly. We have seen companies lose months of enquiries to a form that looked perfectly normal on the page and delivered to nowhere. A maintenance routine that submits a test enquiry monthly would have caught it the first month.
When Nobody Is Looking
Some actual examples
In the past few years, we’ve had a couple of clients who have reached out to us about website maintenance plans. Unfortunately, for them, they were only reaching out after a disaster had occurred.
Self-maintenance failure
The first example was an IT company. Highly competent from a technical perspective, they felt their expertise was ideal for the task. However, during their normal maintenance process, they accidentally deleted their entire WordPress database (they thoughts it was the database for the staging site). Not a problem they thought – their hosting provider must have a recent backup to restore from. Upon restoration, it was discovered that the backups hadn’t been working for the entire month.
The site was restored to the backup available, despite it not being as fresh as hoped (it was almost 30 days old). In that time, many functional enhancements and content updates had been performed. Thankfully, we were able to update the site’s recent code changes from our own internal backups. However, all the content updates had to be recreated manually over the days to follow.
Needless to say, after that incident, that client immediately handed the reigns to us to handle their maintenance. That was about 4 years ago and since then, no issues have been encountered. Most importantly, it took one less task off their plate.
Hoping for the best
Another situation that we remember clearly is a communications company who felt that maintenance was not a necessity and declined our monthly plans after their site launched. For almost two years, all was smooth sailing and no issues were encountered. It seemed like they had made a wise decision, saving themselves the ongoing cost of a monthly maintenance plan.
Until one Tuesday after they arrived back into the office after a long weekend, they discovered that beside each of their search engine listings had a little notice added by Google saying “this site may be hacked”. That’s not exactly something you want to see next to your domain name. I don’t know about you, but if I was a potential customer, I would not be clicking that link!
Upon seeing this, the client gave us a call to investigate the issue. Their search results were littered with SPAM links, all written in Chinese. There were hundreds of them all indexed on Google. Digging deeper into the code, we discovered that many of the site’s PHP files had been modified and/or added to by a malware infection.
The culprit? A WordPress plugin used on the site had a vulnerability from over a year ago. It allowed code to be injected into the website without anyone knowing and slowly over time more and more links were injected into various web pages. Visually they were hidden so as to not arouse suspicion, but the search engines could see them all.
The fix was for us to manually identify all the modified WordPress files that had been affected and restored them from working copies. It was tedious work, as just about every file had to be updated manually. Upon completion, we then had to document our process of restoration so that we could “prove” to Google that we had taken the right corrective steps to satisfy them that the malware issue had been resolved. Even so, it took them over 3 weeks to remove the “hacked” warning from the company’s domain. It was a long, painful wait until regular search results were restored.
Had the website been maintained under one of our plans, the issue would never have occurred. And even if it had, the security monitoring tools would have alerted us right away so that action could be taken before it caused any damage on the Google search results.
By the time anyone added it up, the two years of “savings” on maintenance had cost more than a decade of maintenance would have – and would have saved the embarrassment potential customers saw.
Doing it yourself, or having it handled?
Handling it internally works when someone on staff genuinely owns it, has time protected for it, and knows enough to tell a routine update from a risky one. If that person exists, a documented monthly routine will cover most of the ground.
Where it breaks down is predictable. The person who owns it gets busy. Updates get deferred because the last one broke something and nobody wants a repeat. Backups are configured once and never tested, which means they’re a hope rather than a plan. Nobody is watching at 11pm on a Saturday when the site goes down.
An external arrangement mostly buys three things you can’t easily replicate in-house. Somebody is watching when you aren’t. Updates get applied on a staging copy first, so a bad plugin release breaks a test site instead of yours. And when something does go wrong, the person fixing it already knows how your site is built.
Handled In-House
- Works with a named owner
- Needs protected time each month
- Document the routine
- Test your backups
Handled For You
- Someone watching when you aren’t
- Updates tested on staging first
- A known response if it breaks
- A report of what was done
What to expect from a maintenance plan
If you’re comparing providers, the questions that separate a real service from a line item are specific:
- How often are updates applied, and are they tested on a staging copy first?
- How often are backups taken, where are they stored, and when was a restore last tested?
- What monitoring is in place, and who gets alerted at 2am?
- Is a set amount of content-change time included each month?
- If the site is compromised, what happens, and is the cleanup included or billed?
That last question is worth pressing on. Plans vary enormously, and finding out during an incident is the wrong time.
The arithmetic
Maintenance is usually a modest monthly figure. Set it against the alternatives and the case makes itself.
Compare it against a compromised site, where cleanup, lost rankings, and the awkward client conversations run into the thousands. Or against a month of missing enquiries from a broken form, which for most B2B companies is the largest number on this page. Or against a premature rebuild, where two years of deferred updates turn a five-figure asset into a five-figure replacement.
None of those are hypothetical. They’re the three reasons companies call us about sites we didn’t build.
Maintenance also protects something less visible. A site kept current is one you can extend when the business changes, rather than one you’re afraid to touch. That’s the difference between an asset and a liability, and it’s decided by whether anyone was paying attention in the quiet months.
An insurance policy
The work of keeping a website healthy is genuinely small. Updates, backups, monitoring, and a few content changes add up to about an hour a month for a typical B2B site. The cost of skipping it is not proportionally small, because the failures don’t announce themselves and the bill arrives all at once. Think of it like insurance for your website to avoid (or at least minimize) issues from occurring.
Whoever does it, make sure someone does, and make sure you’d know if they stopped. If you’re not sure what’s currently being looked after on your site, or by whom, book a discovery call and we’ll walk through it with you.
