Why perfectly good websites quietly rot
Nothing dramatic happens. That is the point. A site is launched, everyone is pleased, and then the slow decay starts, invisibly, for about eighteen months, until something breaks in a way that costs real money.
A plugin stops being maintained. A PHP version gets deprecated. A payment gateway changes its API. Someone uploads a 4MB hero image straight from a phone and the homepage gets a second slower. A contact form starts failing silently, and nobody notices for six weeks because an absence of enquiries looks exactly like a quiet month.
That last one is the expensive one. We have been called in to fix forms that had been dead for a quarter. The business assumed demand had softened. It had not, the leads were simply going nowhere.
What maintenance actually includes
Some agencies sell “maintenance” that amounts to clicking update once a month and emailing you a report generated by a plugin. Here is the real list.
WordPress and WooCommerce specifically
WordPress powers a large share of the web, which makes it the most attractive target on the web. Its vulnerabilities are almost never in WordPress core, they are in plugins, and specifically in plugins that stopped being maintained and that nobody thought to remove.
So WordPress maintenance means keeping an inventory of everything installed, watching disclosed vulnerabilities against that inventory, patching on disclosure, and, the part people skip, removing plugins that are no longer maintained, even when they still appear to work. A plugin that has not been updated in two years is not stable. It is unattended.
For WooCommerce, add order-flow verification after every update. A theme update that subtly breaks the checkout on mobile Safari will not announce itself; it will just quietly reduce your conversion rate until someone investigates.
Security and backups
Security work is unglamorous and mostly consists of not doing stupid things: strong credentials, two-factor authentication on admin accounts, an admin URL that is not the default, file permissions set correctly, and no abandoned dependencies.
Backups deserve their own paragraph because most people have one and most people have never tested it. A backup that lives on the same server as the site is not a backup, if the server is compromised or fails, both are gone. A backup nobody has ever restored is a hypothesis. We keep them off-site and we test the restore, because finding out your backup is corrupt during an incident is a genuinely terrible way to spend a day.
What it costs
Maintenance pricing is driven by moving parts and by what downtime costs you, not by page count. A ten-page WordPress site with a booking integration is more work than a forty-page static brochure site, and a store taking orders every hour is a different risk profile from either.
Send us the URL. We will tell you what is installed, what is out of date, what is already exposed, and what it would take to keep it healthy. If the honest answer is that your site needs very little, we will tell you that too, an unnecessary retainer is a bad trade for both of us.