Website Maintenance: What Needs to Be Done Regularly

Why a website needs maintenance, even when it is new

After a new website launches, many businesses consider the work done. The agency has been paid, the site looks good, and for the next few years it should simply run. A year later fewer inquiries come in, and nobody knows why. An update was left undone, the form sends to a mailbox nobody reads anymore, and the page for the most important service links to a data sheet that no longer exists.

This guide therefore answers the question: What needs to be done regularly on a website, how often, and who is responsible for it? We first clarify a model from software engineering that divides maintenance into four types. Then we look at what studies show about security vulnerabilities and decaying content, weigh two views on responsibility and build a maintenance calendar.

A website that nobody maintains does not stand still. It decays.

The thinking model: four types of maintenance

Since the studies by Bennet Lientz and Burton Swanson (1980), software engineering has examined what work arises after a program launches. The ISO/IEC 14764 standard today distinguishes four types of maintenance, meaning all work on software after delivery. Corrective maintenance fixes errors that have occurred. Adaptive maintenance keeps the software running in a changing environment, for example with new browsers, server versions or legal requirements. Perfective maintenance makes it better than it was: faster, clearer, more useful. Preventive maintenance removes weaknesses before they turn into errors.

For a website the model is useful because it shows where the gap usually lies. Corrections happen as soon as someone notices an error. Adaptation happens when something stops working. Improvement happens in a relaunch. But preventive maintenance has no trigger. Its absence goes unnoticed for a long time, until an attack, an expired certificate or data loss reveals it.

What studies show about security and decaying content

Martinez-Caro and colleagues (2018) compared the three widely used open-source content management systems WordPress, Joomla and Drupal. They built the same website with form, newsletter, maps and videos in each system and then examined security. Citing earlier studies, they note that by far the largest share of vulnerabilities lies in extensions, meaning add-on modules that are not part of the system’s core. The more extensions are installed, the larger the attack surface. Their recommendations read like a maintenance plan: regular backups of files and database, current versions of system and extensions, changing default passwords, removing installation files, limiting access to administration. The study is based on 2017 versions and is more a tutorial than a field study. The principles have not changed since.

The second danger is quieter. Content decays. In 2024 the Pew Research Center analyzed which pages from samples taken between 2013 and 2023 were still accessible. Of the pages from 2013, 38 percent could no longer be reached; across all years it was a quarter, mostly because individual pages on otherwise functioning websites had been deleted. 23 percent of the news pages examined contained at least one broken link.

For small businesses there is a fitting study from Poland. Król (2019) checked the links of 919 websites of rural holiday accommodations. He found broken links on 464 of them; for around 65 percent of these sites there were only a few. Broken links in the description of the offer and to the business’s own social media profiles were particularly harmful. No simple relationship with search engine optimization emerged. The author suspects that the low number was more chance than the result of deliberate maintenance.

What is changing now: shorter certificates and stricter expectations

Adaptive maintenance includes responding to changes in the environment. One affects every website with an encrypted connection. A TLS certificate confirms to the browser that the site really belongs to the stated address, recognizable by the padlock in the address bar. Following a decision by the CA/Browser Forum, the body of certificate authorities and browser makers, the maximum validity of such certificates is falling in stages: to 200 days since March 15, 2026, to 100 days from March 15, 2027, and to 47 days from March 15, 2029. Anyone still renewing certificates by hand should make sure with their host that renewal runs automatically.

Other changes come from law and technology. In Germany, the Accessibility Strengthening Act has applied since June 2025 to offers through which consumers conclude contracts, as the article on the accessible website describes. Rules on consent to cookies and measurement are being debated at EU level, as the article on cookie banners and measurement explains. Both belong on the checklist once a year.

Who maintains the website? Two views

The first view puts maintenance in the hands of a service provider. Updates, backups and security checks are specialist tasks. A maintenance contract with an agency or host ensures they are done regularly, even if nobody in the business thinks of them. For adaptive and preventive maintenance there is much in favor of this, especially for systems with many extensions.

The second view considers maintenance a task for the business. Whether the phone number is correct, whether the service is still offered, whether the form reaches the right recipient and whether the testimonial is still current cannot be judged by any service provider. Corrective and perfective maintenance depend on knowledge of the business.

I consider a division along the four types to be right: technology with the service provider, content in-house, responsibility with the owner. The service provider handles updates, backups and certificates and reports once a month on what it has done. In the business, one person checks content, forms and links. And the owner makes sure that the domain, hosting and access run in the company’s name, as also applies when choosing an agency.

The maintenance calendar: what to do when

A calendar follows from the four types. I call it the maintenance calendar. It spreads the tasks so that no week involves much work and no task is forgotten.

For the monthly check of search data, the report on pages and security issues is enough, as described in the article on understanding Google Search Console. For the half-yearly load time measurement, the values from the article on website load time apply: the largest visible element appears within 2.5 seconds, measured across three quarters of visits.

What does maintenance cost?

The costs consist of two parts: time in the business and the service provider’s fee. The following worked example shows the time in the business for a website with around 40 pages.

Three hours a month is little compared with what a neglected website costs. A form that does not arrive for four weeks costs, at 24 inquiries a month as in the example from the article on a website that brings inquiries, exactly those 24 inquiries. With a maintenance contract, it is worth looking at the services: it should include updates, backups with a restore test, certificates and a brief monthly report, with a response deadline for security vulnerabilities.

The bigger picture

Website maintenance is an example of a task that falls between responsibilities in many businesses. The technology seems to belong to the service provider, the content seems to belong to marketing, and in the end nobody feels responsible. The model of four maintenance types makes visible that each type needs its own owner. Preventive maintenance matters most, because its absence only shows once the damage is done. What the basic rules of IT security look like across the business is described in the article on basic IT security for small businesses. If the website is so old that maintenance is no longer enough, the article on planning a website relaunch helps.

The limits lie in the evidence. The security study is older and more a tutorial than a field study; the analyses of decaying links concern news pages, government sites and holiday businesses. The hours in the worked example are guide values. The direction is robust: unmaintained websites lose content, and unmaintained extensions open doors.

What remains and how to start

The question was
needs to be done regularly on a website, how often and by whom. Four types of work are needed: correcting errors, adapting the site to updates, certificates and law, improving content and preventing damage, above all through tested backups and few, current extensions. Weekly and monthly it is about updates, forms and error reports; quarterly about links, details and a restore test; yearly about extensions, law and access. A service provider handles the technology, a person in the business handles content, and the owner holds responsibility. Maintenance follows the calendar, not the occasion.

• Fill in the contact form yourself today and check who receives the message and when.
• Ask the service provider when a backup was last restored.
• Clarify whether certificates are renewed automatically.
• List all installed extensions and have every one without benefit removed.
• Transfer the maintenance calendar with owners into the business calendar.