How often does a business website need maintenance?

Basic checks - SSL certificate, backups, domain status, and whether forms and third-party scripts still work - should happen at least every month or two. Security updates for platforms with plugins, like WordPress, need much tighter, ongoing monitoring, since new vulnerabilities are disclosed constantly.

Does a custom-coded website need maintenance the way WordPress does?

Not at the same intensity, but yes. Custom code isn't exposed to third-party plugin updates, but it still depends on SSL certificate renewal, domain renewal, backups, and third-party scripts - analytics, pixels, your CRM - that change their API without warning. The difference is the scope of risk, not whether maintenance is needed at all.

What actually happens if an SSL certificate isn't renewed in time?

The browser blocks access to the site with a security warning, and lead forms stop receiving submissions - often without the business noticing for days. It's one of the most common causes of a site going down that has nothing to do with the code or design.

← All Articles

Websites · Oct 30, 2026 · May I

Website Maintenance After Launch - What Actually Needs Ongoing Care, and Why "The Site Is Live" Is Only the Midpoint

Short answer: a live business website needs ongoing attention - renewing the SSL certificate before it expires, security updates, backups, and checking that third-party scripts (analytics, pixels, your CRM connection) haven't quietly changed and broken something. That's true for custom-coded sites too, not just WordPress - the difference is the scope of the risk, not whether it exists. "We're done, the site is live" is the midpoint of the project, not the end of it.

Why this is even a problem

Unlike a printed brochure, a website isn't a static thing that's finished the moment you click "publish." It runs on a security certificate with an expiration date, sits on a domain that needs renewing, loads scripts from outside vendors that update themselves without asking, and if it's built on a platform with plugins, those plugins are discovered to be vulnerable on an ongoing basis. None of this looks "broken" on a casual visit to the homepage. It breaks quietly - until the lead form stops receiving submissions, or the browser starts showing a security warning to a customer trying to leave their details.

The SSL certificate - the small thing that takes down entire sites

An SSL certificate is what turns an http address into the padlocked prefix visitors recognize. It has an expiration date and requires renewal - automatic on most modern hosting, but not on all of it, and not always without a hiccup. Keyfactor's annual State of PKI and Digital Trust Report found that organizations experienced an average of about three outages caused by expired SSL certificates over the 24 months surveyed (source: keyfactor.com). When an SSL certificate expires, the browser doesn't show a small warning off to the side - it blocks access to the site entirely, which means your lead form simply stops receiving submissions, often with nobody at the business noticing for days.

WordPress vs. custom code - the maintenance is different, not absent

We've written here before about the scale of security vulnerabilities disclosed in WordPress plugins each year. What gets mentioned less is the patch rate: Wordfence's Annual Security Report found that about 35% of the vulnerabilities disclosed in the WordPress ecosystem in 2024 were still unpatched as of April 2025 - meaning that months after a vulnerability goes public, in many cases the site is still exposed (source: wordfence.com). That doesn't fix itself - it needs someone tracking it, applying updates, and checking that an update didn't break something else on the site.

A custom-coded site isn't exposed to third-party plugins the same way, so it's spared most of that specific risk. But "no plugins" doesn't mean "no maintenance" - the SSL certificate still expires, the domain still needs annual renewal, and analytics providers, pixels, and CRM systems change their API occasionally without advance notice. The real difference is the scope of the risk and how often checks are needed, not whether maintenance is required at all.

What actually goes into a maintenance plan

Tracking and renewal reminders for the SSL certificate and domain, before they expire - not after.
Regular backups of the code and database, stored separately from the server running the site.
Security updates to the platform and plugins, when the site is built on one.
Verifying lead forms actually reach the CRM - not just that the browser says they were "sent."
Checking that third-party scripts (GA4, Meta Pixel, widgets) still load and aren't being blocked by ad blockers or a cookie policy change.
Speed and uptime checks - not just once at launch, but every few weeks.

What definitely isn't a good idea

The most common mistake is treating a website as a project that's finished the moment it goes live, and only discovering a problem when a customer calls and says "I tried to fill out the form and it didn't work." By that point, the site may have lost days or weeks of leads with no outward sign anything was wrong. A simple maintenance plan - even one that's just a short monthly check - is the difference between catching a problem within an hour and discovering it through a frustrated customer.

Is your website running with nobody watching it?

We offer ongoing maintenance plans for the sites we build - including SSL monitoring, backups, and checks that forms and CRM connections keep working.

Get started