Website maintenance and security: protect the work done
It is the activity you notice only when it is missing.
A site without updates accumulates known vulnerabilities; without backups, a problem becomes a loss; without monitoring, an outage can last days before anyone notices. The maintenance is insurance on the work done, not an ancillary cost.
The scopeWhat routine maintenance includes
The maintenance of a website is the set of recurring activities that keep a site working, fast and secure over time: updates of the CMS and components, regular and verified backups, security and uptime monitoring, periodic checks of performance, broken links and errors, verification of contact forms and integrations. The cybersecurity is its critical component: a compromised site loses visibility, trust and, where data is involved, exposes you to liability. I offer maintenance as an ongoing service or as a procedure to hand to the in-house team, and it is a natural part of website creation: building a site well and then leaving it uncared for destroys its value.
Updates
They are the heart: CMS core, theme, plugins or modules, libraries, runtime version. They must be applied regularly and, for major updates, tested first on a staging environment to check they don’t break anything.
Backups
They must be automatic, frequent in proportion to how much the site changes, stored off the main server and — a point often neglected — periodically verified by restoring them: a backup you have never tried to restore is not a guarantee.
Monitoring
It covers uptime (is the site reachable?), server errors, domain and certificate expiry, the appearance of malware or unauthorized file changes.
Periodic checks
Performance (do the Core Web Vitals stay within threshold?), broken internal and external links, errors in Google Search Console, working of forms, checkout and integrations, cleanup of obsolete content, indexing and consistency of structured data.
Security in practice
Most compromised sites are so for trivial reasons: an outdated plugin or module with a known vulnerability, a weak or reused password, file permissions that are too open, no limits on login attempts. The basic measures that cover the largest part of the risk are therefore simple and about discipline: update promptly, install only actively maintained components, use strong, multi-factor authentication for administrative access, assign the minimum necessary permissions, protect the login page, and keep backups that let you quickly return to a clean state.
On top of this basic layer, depending on the value and exposure of the site, further measures are added: an application firewall that filters malicious traffic, periodic malware scanning, file integrity monitoring to detect unauthorized changes, hardening of the server configuration, and for e-commerce and sites that handle personal data a more rigorous review in line with applicable regulations. Security is an ongoing practice that adapts to the risk, not a product to install once.
What happens when a site is compromised
A compromised site can show itself in different ways: hidden content or links injected into pages, redirects of users to external pages, new pages that were never created, a security warning in the browser or in Google Search Console, a sudden drop in traffic. The SEO consequences are concrete: Google can flag the site as unsafe, remove pages from the index or apply a manual action. Recovery requires finding and closing the entry point, cleaning files and database (or restoring a clean backup from before the compromise), regenerating credentials, and then asking Google for a review. It is a process that can take days and during which visibility suffers. For this intervention there is a dedicated service: hacked WordPress site recovery.
How I work on maintenance
Initial assessment
State of updates, presence and validity of backups, active security measures, known vulnerabilities, performance, errors.
Basic hardening
Overdue updates, working and tested backups, strong authentication, permissions, login protection.
Maintenance plan
Schedules for updates, backups and checks, definition of what is included and what is on request.
Active monitoring
Uptime, security, certificate and domain, errors, with notifications.
Periodic report
Interventions made, updates applied, security and performance status, recommended actions.
Managed maintenance or in-house procedure
| Activity | Maintenance managed by me | Procedure handed to the in-house team |
|---|---|---|
| Updates | Applied and tested on a defined schedule | Checklist and calendar provided, internal execution |
| Backups | Automatic, periodically verified | Configuration set up, verification by the team |
| Monitoring | Uptime, security, errors, with alerts | Tools configured, internal oversight |
| Interventions | Included according to the agreed level | Support on request |
| Suited to | Those who want to delegate and have a single point of reference | Those with internal skills who want autonomy |
Preventing, with maintenance and backups, costs a fraction of what it costs to fix.
Where maintenance matters most
Maintenance and SEO
A site that is slow because it isn’t updated loses ground on Core Web Vitals; broken internal links accumulated over time disperse authority; unresolved crawl errors reduce indexed pages; structured data that doesn’t follow the site’s changes stops working; a compromise can wipe out months of work. Part of the periodic check is therefore in fact SEO maintenance: checking Search Console, redirects, sitemap, consistency of structured data. On a site also followed on the SEO consulting side, the two activities integrate.
E-commerce maintenance
An e-commerce requires more frequent maintenance: it handles orders and personal data, has a checkout that must always work, integrates couriers and payments that can change, and is under stress in peak periods. Updates must be tested carefully because an incompatible payment module blocks sales; backups must be frequent because every hour of lost data is lost orders; monitoring must include the cart and the purchase process, not just the reachability of the home page.
Content aging
Content degrades too: pages with prices, services, hours or regulatory references that are no longer current, undated data that seems recent, external links pointing to vanished resources. This erodes user trust and, in AI answer engines, makes a source less reliable. The periodic check includes a review of key content, which ties in with content creation.
Compliance: cookies, consent and personal data
Maintenance includes oversight of technical compliance: verifying that the consent management system works, that third-party components activate only after consent when required, that forms collect only the necessary data, that legal texts are linked and reachable. I take care of the technical side of the framework; drafting the legal texts remains with the owner or their consultant.
Service levels and response times
A serious plan defines what is included and with what timing. Scheduled activities have a fixed cadence; unscheduled interventions — an outage, a compromise, an error blocking a function — have agreed response times based on criticality: an e-commerce with the checkout down is an emergency, a typo on a secondary page is not.
How maintenance is measured
The indicators are about continuity and risk: uptime, timeliness of updates (the gap between the release of a patch and its application), outcome of test restores of backups, number of security incidents and resolution time, trend of crawl errors and broken links, resilience of the Core Web Vitals over time. A well-maintained site has few events to report: it is precisely the absence of problems that is the result you are buying.
Frequently asked questions about maintenance and security
What does website maintenance include?
It includes controlled updates, verified backups, monitoring, error checking, performance checks and recovery interventions when needed.
How often should updates be done?
Security patches should be applied as soon as possible; ordinary updates on a regular schedule, typically monthly, tested on staging for the major ones. Postponing for long increases the risk and the difficulty of the next update.
Why does security affect SEO?
A compromised, slow or unreachable site loses trust, user experience and crawlability. Google can flag it as unsafe or remove its pages from the index: security is therefore part of organic continuity.
Is a security plugin enough?
No: a plugin helps but doesn’t replace updates, backups, strong authentication and correct permissions. Security is a set of practices, not a single tool.
How often should a site be backed up?
In proportion to how much content and data change: daily for a site that publishes often or for an e-commerce, less frequent for a static showcase site. In any case backups should be stored off the server and tested with trial restores.
Doesn’t my hosting already do backups?
Many hosts offer backups, but often with limited retention, no guarantee of point-in-time restore and on the same server that might be compromised. An independent, verified backup is an extra safeguard, not a useless redundancy.
What happens if the site is compromised during maintenance?
You intervene to contain and clean: finding the entry point, cleanup or restore from a clean backup, regenerating credentials, requesting a review from Google if necessary. Having recent, verified backups drastically reduces time and impact.
Is maintenance mandatory after the site is created?
It is not mandatory, but a site without maintenance degrades and exposes itself. It can be handled by me or by the in-house team with a defined procedure: what matters is that someone does it, with method.
Can I do maintenance only “when needed”?
It is the riskiest approach: security updates don’t wait, and “when needed” often means when the site is already compromised or already out of threshold on performance. Maintenance is effective precisely because it is regular and preventive.
How do I know if my site has been compromised?
Typical signs: warnings in Google Search Console, a sudden drop in traffic, unexpected redirects, unknown pages in the index, the browser’s antivirus blocking the site. Active monitoring catches many of these signs before a user does.
Does the TLS certificate fall under maintenance?
Yes: monitoring includes certificate and domain expiry, because an expired certificate makes the site inaccessible with a security warning, and a domain that isn’t renewed can be lost altogether. They are among the most damaging and easiest-to-prevent events.
To learn more about website creation
Blog guides on the topic of this page.
Hacked WordPress site: anatomy of a real case
A website is not a business card: it is an acquisition asset
Request a maintenance and security plan
I assess the state of your site, secure the basics and set up a plan of updates, backups and monitoring — handled by me or by your team — with periodic reports.