Your website is a revenue asset. Like any asset, it depreciates without maintenance — except websites depreciate fast, invisibly, and while you're still paying to send traffic to them. Every month without maintenance, your site gets a little slower, a little less secure, and a little worse at turning visitors into customers.
This isn't a scare story to sell retainers. It's the mechanics of how websites decay, what that decay costs in online sales, and what proper maintenance actually involves.
Websites rot: the four kinds of decay
1. Software decay. Your site runs on software — a CMS like WordPress, plugins, themes, libraries, server software — and all of it gets updated constantly. Each update fixes bugs and patches security holes, but it also changes behaviour. Skip updates for a year and you're running code with known vulnerabilities, on a PHP version your host is about to retire, with plugins that conflict with each other. The site still loads, so nobody notices — until it doesn't.
2. Security decay. This is the expensive one. Outdated software is the number one way small business websites get compromised — not sophisticated hacking, but automated bots probing for known vulnerabilities in old plugins. A hacked site can mean defaced pages, stolen customer data, Google blacklisting ("This site may be hacked" in search results), and a cleanup bill far larger than a year of maintenance would have cost. For UK businesses, there's also the GDPR angle: a breach of customer data carries notification obligations and potential ICO fines.
3. Speed decay. Sites get slower over time almost by default. Image libraries grow unoptimised, plugins accumulate, databases bloat with revisions and transients, tracking scripts multiply. Meanwhile, Google's expectations get stricter and users get less patient. The data here is well-established: as page load time increases, bounce rates climb steeply — and every extra second of load time measurably reduces conversions. A site that converted at 3% when it was fast can quietly slide to 2% as it slows, which on £500k of annual online revenue is £167k walking out the door.
4. Content and UX decay. Prices go stale, team pages show people who left two years ago, blog dates scream "abandoned", seasonal banners linger into the wrong season. Visitors notice. An outdated site doesn't just look neglected — it actively undermines trust at the exact moment you're asking someone to hand over money or personal details.
What revenue is actually at risk
Let's make this concrete. Take a UK ecommerce site doing £40,000/month in online sales:
- A 0.5% conversion rate drop from slower load times and accumulated friction: roughly £6,000–£7,000/month in lost revenue. That's £75,000+ a year, silently.
- One security incident with Google blacklisting: traffic from organic search can drop to near zero for days or weeks while you clean up and request review. For a site getting half its traffic from Google, that's potentially tens of thousands in lost sales per week — plus the cleanup cost (£1,000–£5,000 for professional malware removal) and the reputational damage.
- A checkout-breaking plugin conflict after an untested update (or a never-applied update that finally collides with a payment gateway change): every hour of downtime is lost sales, and most businesses discover it when a customer complains, not when it starts.
Against that, professional maintenance typically costs £100–£500/month for a small business site — a fraction of what's at stake. The maths isn't close.
What proper maintenance actually includes
"Maintenance" is vague, so here's what a proper plan covers. If your current arrangement doesn't include most of these, you're paying for hosting with a nicer name:
- Core, plugin and theme updates — applied on a schedule, tested on a staging copy first, with rollbacks ready. Updates should never be applied blindly to a live revenue-generating site.
- Security monitoring and hardening — malware scanning, firewall rules, login protection, and monitoring for known vulnerabilities in your specific stack. See our WordPress security tips for what this looks like in practice.
- Automated off-site backups — daily at minimum for active sites, stored somewhere other than your web server, and tested periodically. A backup you've never restored is a hope, not a backup.
- Uptime monitoring — automated checks every few minutes with alerts. You should know about downtime before your customers do.
- Performance monitoring — regular speed checks against Core Web Vitals. Speed decay is gradual; without measurement, you won't see it until it's cost you months of conversions.
- Broken link and form checks — links rot, forms break silently when plugins update, payment flows need periodic end-to-end testing. A contact form that's been broken for three weeks is three weeks of lost enquiries.
- Content freshness reviews — quarterly at least. Stale prices, dead team pages, expired offers.
- Reporting — a plain-English monthly summary: what was updated, what was found, what was fixed, and what needs your decision. If your maintenance provider can't tell you what they did last month, they probably didn't do much.
DIY vs professional maintenance
Can you maintain the site yourself? For a simple brochure site, possibly — if someone on your team actually does it, on schedule, every month, including the boring parts. In practice, DIY maintenance fails the same way gym memberships do: enthusiastic in January, forgotten by March.
The honest test: when did you last update everything, check the backups restore properly, and review site speed? If you can't answer confidently, DIY isn't working. Professional maintenance isn't about technical inability — it's about consistency. The value is that it happens every month without depending on anyone remembering.
One warning: don't confuse maintenance with your hosting company's "managed" plan. Most managed hosting covers the server, not your site. They'll keep PHP running; they won't test your plugin updates, monitor your checkout, or notice your contact form broke. Those are different jobs.
Maintenance as a sales protection strategy
Reframe maintenance and the conversation changes. It's not an IT cost; it's revenue protection — the digital equivalent of locking the shop at night and servicing the tills. You wouldn't run a physical shop with a broken front door, flickering lights and a card machine that fails every third transaction. An unmaintained website is exactly that, except the decay is invisible to you and obvious to your customers.
The businesses that treat maintenance as optional are the same ones that end up paying emergency rates for a hack cleanup, a rushed rebuild, or a lost month of sales. Planned maintenance is always cheaper than emergency repair. Always.
If your site generates revenue — or enquiries that become revenue — it deserves a maintenance plan. Our website development team offers maintenance plans built around the checklist above: tested updates, security monitoring, off-site backups, uptime and performance monitoring, and plain-English monthly reporting. No jargon, no mystery line items. To get your site properly looked after, contact us and we'll start with an honest assessment of where your site stands today.
FAQs
How much does website maintenance cost in the UK?
For a small business site, expect £100–£500/month depending on complexity, traffic and what's included. Ecommerce sites and complex platforms cost more because there's more to test and more at stake. Be wary of very cheap plans (£20–£30/month) — at that price, nobody is actually testing updates or monitoring anything; you're buying a plugin licence, not a service.
What happens if I don't maintain my website?
Gradually, then suddenly. Gradually: slower load times, lower conversion rates, stale content, accumulating security vulnerabilities. Suddenly: a hack, a Google blacklisting, a broken checkout, or a forced emergency rebuild when your host retires the PHP version your ancient site depends on. The gradual part costs you revenue every month; the sudden part costs you a crisis.
Isn't my hosting company handling maintenance?
Almost certainly not. Hosting companies maintain the server — the operating system, the web server software, network security. Your website's CMS, plugins, content, forms, checkout and performance are your responsibility (or your maintenance provider's). "Managed hosting" manages the hosting, not the website.
How often should a business website be updated?
Security updates should be applied promptly — within days for critical patches. Routine plugin and theme updates work well on a monthly cycle, tested on staging first. Major CMS version upgrades deserve their own planned window. Content should be reviewed quarterly. Anything less frequent than monthly for the routine cycle is where decay starts winning.
Can I do website maintenance myself?
Technically yes, if you have the time, the discipline and a staging environment to test updates safely. In practice, most businesses start well and trail off within months — and the one update you skip is the one containing the critical security patch. If your site generates meaningful revenue, professional maintenance is cheap insurance by comparison.
