Website maintenance and support is the ongoing work that keeps a website secure, fast, working and up to date after launch: software updates, backups, monitoring, fixes, small changes and help when something goes wrong. For European businesses, good website maintenance and support is a written plan with clear tasks, response times and owners, so that security patches are applied promptly, personal data stays protected under the GDPR, and the site keeps improving instead of slowly ageing. This guide covers where to start, what maintenance involves, how support levels compare, what drives the cost, the EU obligations, how to choose a provider and how to measure whether it works.
Last updated: 3 November 2026.
What is website maintenance and support?
Website maintenance is the planned, regular care of a site: updating its software, backing it up, checking its security and speed, and fixing what breaks. Support is the help available when you need something: a question answered, a change made or an incident handled.
Together they protect the investment you made in building the site. A website is software, and software that is not maintained becomes slower, less secure and less compatible with browsers, devices and search engines every month.
At Odduel, a creative and technology agency in Barcelona and São Paulo, our maintenance and support service covers the sites we build and sites built by others, after a technical review.
In short: know who is responsible for your site today. Write down what maintenance covers and how quickly problems are handled. Apply updates on a schedule, tested first. Keep backups off the server and test restoring them. Monitor uptime, security and speed. Budget for small improvements, not just fixes. Review the plan every year.
Why does a website need ongoing maintenance?
A website needs maintenance because everything around it keeps changing: the software it runs on, the browsers that display it, the threats that target it and the business it represents.
- Security: content management systems, plugins and server software receive security fixes regularly. Unpatched sites are among the most common targets of automated attacks.
- Compatibility: new browser and operating system versions can break features that worked at launch.
- Performance: sites slow down as content, images and scripts accumulate.
- Search: broken links, errors and slow pages hurt visibility in search engines.
- Content: outdated prices, team pages, offers and policies damage trust.
- Legal: privacy notices, cookie consent and accessibility must keep pace with the site and the rules.
Where should a company start with website maintenance and support?
Start by finding out what you have and who looks after it. Many companies discover at this step that nobody does.
- List your assets. Domain, hosting, DNS, the CMS and its plugins or modules, integrations, analytics and the accounts for each.
- Check access and ownership. Every account should be in your company’s name, with at least two people able to sign in.
- Check the current state. Software versions, last update, last backup, known errors and speed.
- Define what matters most. Which pages, forms and functions must never be down: checkout, booking, contact.
- Set response expectations. How quickly a critical issue must be handled, and during which hours.
- Choose the model. In-house, a freelancer or an agency plan, based on the site’s complexity and importance.
Our website maintenance checklist gives the full list of recurring tasks by frequency.
What does website maintenance involve in practice?
Website maintenance involves a set of recurring tasks, grouped by how often they are done.
Weekly or continuous
- Uptime and error monitoring, with alerts.
- Security scanning and blocking of suspicious traffic.
- Automated backups of files and database, stored off the server.
- Checks that key forms and the checkout still work.
Monthly
- Updates to the CMS core, theme, plugins and server software, tested on a staging copy first.
- Speed checks and fixes for slow pages.
- Broken link and error log review.
- A short report of what was done and what was found.
Quarterly and yearly
- A test restore from backup, to prove the backups work.
- A review of users and access rights, removing people who have left.
- An accessibility and content review of the main pages.
- A review of plugins and integrations: is each still needed and supported?
- Renewal checks for domains, certificates and licences.
For sites built on WordPress, security deserves its own routine; our guide to WordPress security covers the specific steps.
What support levels are there?
Support levels describe how quickly a provider responds and what is included. Compare them carefully, because two plans with similar names can promise very different things.
| Level | Typical scope | Response to critical issues | Best for |
|---|---|---|---|
| Basic care | Updates, backups, uptime monitoring | Business hours, next working day | Small brochure sites |
| Standard support | Basic care plus security, monthly reports and a small allowance of changes | Business hours, same day | Company sites with forms and integrations |
| Priority support | Standard plus faster response, staging tests for all changes and regular improvements | Extended hours, within hours | Lead generation sites and online stores |
| Critical support | Priority plus round-the-clock monitoring and response | Around the clock | Sites where downtime directly stops revenue |
What matters is not the label but the written commitment: what counts as critical, how fast someone starts working on it, and how you reach them.
In-house, freelancer or agency: who should maintain your website?
The right choice depends on the site’s complexity, how critical it is and the skills you have.
- In-house: works when you have developers who know the stack and time set aside for maintenance. The risk is that urgent projects always push maintenance aside.
- Freelancer: flexible and personal, suitable for simpler sites. The risk is availability during holidays or illness, and a single point of knowledge.
- Agency plan: several people know the site, with defined response times and processes. Best for business-critical sites and those with integrations.
Whatever you choose, keep documentation of the site and its accounts in your company, so you can change provider without losing control.
What drives the cost of website maintenance and support?
The cost of website maintenance and support depends on the site’s complexity, the response time you need and how much improvement work is included. We do not publish price ranges because a fair figure follows a short technical review, but every plan is built from these lines. Our article on website maintenance cost explains each in more depth.
- Site complexity: the number of plugins, integrations, custom features and languages.
- Platform: some platforms need more update and security work than others; hosted platforms include part of it.
- Response time and hours: faster response and wider hours cost more.
- Hosting: managed hosting with backups and security included can reduce maintenance effort.
- Change allowance: the hours included each month for content changes and small improvements.
- Reporting: a short monthly summary costs a fraction of detailed performance and security reporting.
- Starting state: a neglected site needs a one-off clean-up before a regular plan can start.
What are a business’s obligations for website security in the EU?
If your website handles personal data, such as contact forms, accounts, newsletter sign-ups or orders, European rules expect you to keep it secure.
- Security of processing: the General Data Protection Regulation requires security appropriate to the risk, including the ability to restore data after an incident and regular testing of security measures. Updates, backups and test restores are part of meeting this.
- Breach notification: a personal data breach that is likely to put people’s rights at risk must generally be reported to the supervisory authority within 72 hours of becoming aware of it, and affected people informed where the risk is high. A maintenance plan should include how incidents are detected and escalated.
- Processors: a provider with access to personal data on your site acts as a processor and needs a written processing agreement.
- Accessibility and consent: accessibility of covered services and correct cookie consent must keep working as the site changes; maintenance includes checking that updates have not broken them.
How do you choose a website maintenance provider?
Choose a provider who starts with a review of your site and puts commitments in writing.
- Ask for a technical review first. A provider who quotes without looking at the site is guessing.
- Read the response times. What counts as critical, and how quickly work starts.
- Ask how updates are tested. A staging copy before live is the standard.
- Ask where backups are kept and how often restores are tested.
- Check access and ownership. Accounts stay in your name; the provider gets its own access.
- Ask for a sample report. It should say what was done, what was found and what is recommended.
How do you measure whether maintenance and support work?
You measure maintenance by the problems that did not happen and the speed with which those that did were solved.
- Uptime: the share of time the site was available, from independent monitoring.
- Response and resolution times: against the commitments in the plan.
- Update currency: how far the site’s software is behind the latest secure versions.
- Speed: Core Web Vitals and load times on key pages over time.
- Errors: broken links, form failures and server errors found and fixed.
- Incidents: security events and their impact, ideally none.
Review these every quarter with your provider, and adjust the plan as the site and business change.
Questions people ask
What does website maintenance include?
Website maintenance includes software updates for the CMS, theme, plugins and server, regular off-site backups with tested restores, uptime and security monitoring, speed checks, broken link and error fixes, and checks that forms and checkout work. Many plans also include a monthly allowance for small content changes and a short report.
How often should a website be updated?
Security updates should be applied as soon as they are released and tested, especially for critical vulnerabilities. Other software updates are usually grouped monthly and tested on a staging copy first. Content should be reviewed at least every quarter, and the whole site, including plugins and access rights, once a year.
Can a different agency maintain a website we did not build with them?
Yes, usually. A new provider should start with a technical review of the code, plugins, hosting and accounts, then fix urgent issues before a regular plan begins. Make sure you hold the access to every account, so you can hand it over without depending on the original builder.
What happens if a website is not maintained?
An unmaintained website gradually becomes less secure, slower and less compatible with browsers and devices. Outdated software is a common route for automated attacks, which can deface the site, steal data or harm search visibility. Content also drifts out of date, and fixing years of neglect costs far more than regular care.
Is website maintenance required under the GDPR?
The GDPR does not mention maintenance by name, but it requires security appropriate to the risk for any personal data you process, including the ability to restore data and regular testing of security measures. For a website with forms, accounts or orders, regular updates, backups and monitoring are a practical way to meet that duty.
List your site’s accounts and check when it was last updated and backed up: that answer tells you how urgent a plan is. When you want it handled, see our maintenance and support service or tell us about your website.
