Website Maintenance UK: Practical Small Business Guide
Website maintenance in the UK is the ongoing work that keeps a live site secure, fast, backed up and legally usable after launch. For most small businesses that means software updates, backups, security patches, content tweaks and hosting, not a full redesign every year.
What website maintenance actually covers
Launch is not the end. Plugins, themes, shopping carts and PHP versions go stale. Hosts change server rules. Google updates how it ranks pages. A neglected site can be hacked, slow, or fail cookie and privacy rules. Maintenance is the regular work that stops that.
Typical UK small-business sites (WordPress, Shopify or similar) need four pillars: software updates, backups you can restore, security monitoring, and content or form checks. Hosting sits underneath all of that. Ignore any one of them and you usually find out the expensive way.
How often each job should happen
Frequencies are not optional if you want a site that still works in 12 months.
- Core, theme and plugin updates: weekly for security patches, monthly for feature updates. Test on a staging copy if you can.
- Backups: daily files and database, kept off the same server, with a restore test at least every quarter.
- SSL and domain: auto-renew. Check expiry 30 days out. A lapsed certificate kills trust and rankings overnight.
- Security: firewall and malware scan running continuously; login attempts limited; admin users reviewed twice a year.
- Speed and uptime: monthly Core Web Vitals check; uptime ping if you take bookings or payments.
- Content and legal: privacy policy, cookie banner and contact details reviewed when the law or your services change. Broken links and 404s every couple of months.
- Forms and email: test contact, quote and booking forms after any plugin update. Spam filters and SPF/DKIM records matter in the UK because Gmail and Outlook are strict.
UK market costs (typical ranges)
Agencies and freelancers quote in different ways. You will see hourly, retainers and “all-in” hosting-plus-care packages. Rough 2020s UK ranges for a standard brochure or small e-commerce site:
| What you buy | Typical UK range | What you usually get |
|---|---|---|
| Hourly ad-hoc work | £50 - £120 per hour | Fixes only when something breaks. No proactive updates. |
| Monthly retainer (updates only) | £40 - £150 per month | Core/plugin updates, backups, basic security. Hosting often extra. |
| Hosting plus care plan | £20 - £80 per month after setup | Hosting, updates, backups, support. Suits businesses that want it hands-off. |
| Emergency hack clean-up | £300 - £2,000+ | One-off. Often more than a year of proper maintenance. |
Cheap shared hosting at £3 - £8 a month rarely includes real backups or malware removal. Managed WordPress hosts in the UK often sit at £15 - £40 a month and still leave plugin updates to you unless you add a care plan.
DIY versus paying someone
You can maintain a simple site yourself if you are comfortable in the dashboard, keep a written checklist, and never skip backups. The risk is time and mistakes: a bad plugin update can take the shop offline on a Friday night.
Pay someone when any of these are true: you sell online, you take bookings, you have no time to test updates, or you would not know how to restore a backup. A retainer or pay-monthly plan is usually cheaper than one emergency rebuild.
I build sites both as one-off projects and as pay-monthly plans (setup then a monthly fee covering hosting, updates and ongoing management). Pay monthly exists because many small firms cannot or will not put a large sum down and then remember to patch WordPress themselves. One-off still makes sense if you already have a developer on tap or you are happy owning the hosting and updates.
Security and UK legal basics you cannot skip
UK GDPR and PECR still apply. A cookie banner that does nothing, or a privacy policy copied from another country, is a maintenance failure as much as a design one. Keep a record of what you collect and why. If you use Google Analytics or a live chat tool, say so.
Passwords: unique admin logins, 2FA where the platform allows it, no “admin” usernames. Limit login attempts. Keep PHP and the CMS on supported versions. Hosts in the UK will eventually force PHP upgrades; delaying them is how sites break.
Backups that actually restore
A backup on the same cheap host as the live site is not a backup. Use off-site storage (another provider or object storage). Test a restore on a staging URL. If you cannot restore in under an hour, the backup is theatre.
A simple monthly checklist
- Apply pending security updates. Note what changed.
- Confirm the latest backup completed and is off-site.
- Scan for malware and failed logins.
- Submit a test enquiry through every form. Check it arrives and is not in spam.
- Glance at Search Console for crawl errors and sudden traffic drops.
- Check SSL expiry, domain renewal date and invoice from the host.
- Fix broken images or 404s if you changed pages.
Quarterly, add a speed test, plugin audit (delete unused ones), and a read-through of privacy and cookie text.
When maintenance is not enough
If the theme is abandoned, the design is from a page builder you cannot edit, or Core Web Vitals are stuck in the red after updates, you need a rebuild, not more patches. Maintenance keeps a healthy site healthy. It does not rescue a site built on outdated code.
Shop around on hosting separately from design if you go one-off. For pay-monthly, hosting is usually bundled so you are not juggling three suppliers. Either route, write down who owns the domain, who holds the backups, and how you get the files if you leave. That paperwork is part of maintenance too.
Frequently asked questions
Is website maintenance the same as hosting?
No. Hosting is the server and domain connection. Maintenance is updates, backups, security and content checks. You can buy them separately or in one monthly plan.
How much should a UK small business budget?
Plan for £40 - £150 a month if you want proactive updates and backups, or £50 - £120 an hour if you only call when something breaks. Emergency clean-ups often cost more than a year of care.
Can I maintain a WordPress site myself?
Yes, if you follow a weekly update and backup checklist and can restore from a copy. Skip it if you take payments or bookings and have no time to test changes.
What happens if I never update plugins?
Known security holes stay open. Attackers automate scans for old plugins. Sites get injected with spam or ransomware. Recovery costs far more than routine updates.
Do I still need maintenance on Shopify or Wix?
The platform patches its own core. You still need app updates, theme checks, backups of custom content, form tests and legal text. Apps go stale the same way WordPress plugins do.
How do I know a care plan is doing real work?
Ask for a monthly log: what was updated, backup confirmation, any security events. If they cannot show that, you are paying for a phone number, not maintenance.