Website maintenance for small business: why 'launched' isn't 'done'

Most small business owners treat their website like a project with an end date. It launches, it's done, and it doesn't cross their mind again until something breaks or a customer mentions it looks dated. That's the wrong mental model. A website is closer to a car than a piece of furniture: it needs upkeep, and the upkeep is what keeps it safe and working, not optional polish.

I'll keep this proportionate. There's a whole industry that sells maintenance through fear, and that's not how I want to make the case. Here's the honest version: what actually goes wrong when a site is left alone, what maintenance actually covers, and what it realistically costs.

---

What actually goes wrong

Two things, mostly: security and drift.

Security. If your site runs on WordPress (still the most common small business platform), the numbers are consistent across every source I've checked: roughly 90-97% of WordPress vulnerabilities live in plugins and themes, not WordPress itself. The core software gets patched fast. The plugin you installed for a booking form three years ago and never updated is a different story. Small businesses aren't a low-priority target either: they account for around 43% of all cyberattacks, and automated bots scan for known, disclosed vulnerabilities within hours, not weeks. A compromise often sits undetected for 30 to 90 days before anyone notices, quietly harvesting emails or sending spam through your server, which is a worse outcome than an obvious crash because nobody's looking for it.

Drift. Content goes stale, plugins stop working properly with each other, page speed creeps down as the platform and your competitors' sites move on without you. None of this is dramatic on its own. All of it compounds.

The cost of not maintaining it

I won't pretend this is the biggest risk most small businesses face day to day, but it's a real one worth sizing honestly. UK small and medium businesses lose an average of somewhere between £137 and £450 per minute of website downtime, and 92% of UK businesses take more than 24 hours to fully recover from a serious incident. Across the country that adds up to an estimated £3.7 billion a year lost to IT downtime, a figure that's grown fivefold since 2018 even as the total hours of downtime have fallen, simply because businesses depend on their sites more than they used to.

That's not a reason to panic. It's a reason to treat maintenance as insurance with a genuinely favourable trade, not a discretionary extra.

What maintenance actually covers

Not a vague "we'll keep an eye on it." Specifically:

• Core, plugin and theme updates, applied on a schedule rather than whenever someone remembers.
• Server-level basics that owners never think about, like keeping PHP on a current, supported version. PHP 7.x has been end-of-life for a while now and gets no security patches at all, which is a surprisingly common thing to find on sites nobody's touched since launch.
• Regular backups, tested, not just scheduled and forgotten.
• Uptime and security monitoring, so a problem gets caught in hours, not the 30-to-90-day window attackers rely on.
• Small content refreshes, so the site doesn't quietly go stale while everyone's attention is elsewhere.

What it realistically costs

UK maintenance pricing spans a wide range depending on what's included, roughly £35 to £500 a month across the providers I've looked at, with solid, genuinely monitored protection typically landing somewhere in the £75 to £150 a month range. Below that, you're usually paying for updates alone with no monitoring. Above it, you're often paying for reporting and account management most small businesses don't need.

What to actually do

If your site hasn't been touched since launch, that's the first thing worth checking, not the plugin count or the design. Ask whoever built it when the platform, theme and plugins were last updated, and whether backups are actually running and have ever been tested. If nobody can answer that confidently, that's your answer.

Beyond that, this isn't really a one-off fix. It's an ongoing relationship between you and whoever looks after the site, the same way a car needs a mechanic you trust rather than a single repair. If you want a straight read on where your own site stands, that's a conversation I'm happy to have, not a sales pitch.

References

• Websitesetup (2026). Website Security Statistics 2026: How Every Type of Website Gets Hacked, citing Sucuri and multiple industry sources on WordPress plugin vulnerability share. https://websitesetup.org/website-security-statistics/
• SQ Magazine (2026). Small Business Cybersecurity Statistics 2026: Threats, Costs, etc. https://sqmagazine.co.uk/small-business-cybersecurity-statistics/
• RedEagle Tech (2026). IT Downtime Cost UK: Calculator & Statistics Guide, citing Gartner-sourced downtime cost research. https://redeagle.tech/blog/cost-of-it-downtime
• Web Michael Bell (2026). Website maintenance cost UK: what you'll actually pay in 2026. https://web.michaelbell.co.uk/blog/website-maintenance-cost-uk