Maintenance is the least exciting thing we sell and the one clients get the most out of. It is also the one people most often decline, because it is hard to feel the value of something whose whole purpose is that nothing happens.
What actually goes wrong
Nothing dramatic, at first. A dependency gets a security advisory. The PHP version the site runs on reaches end of life. An SSL certificate does not renew. A form stops delivering because an email provider tightened its rules. A plugin update conflicts with another plugin. Backups have been failing quietly for four months.
Every one of these is trivial to deal with while it is small. Left alone they compound, and eventually you get the version people do notice: the site is down, or defaced, or so far behind that updating it safely is a project rather than an afternoon.
The worst cases we have been called into were not sites that were attacked. They were sites nobody had looked at in three years, where the fix was to rebuild, because there was no safe path from where they were to a supported version.
What should be in a maintenance package
At a minimum, someone applying security patches and framework updates on a schedule and testing that nothing broke afterwards. Backups that are actually verified rather than assumed, because an untested backup is not a backup. Uptime monitoring, so you find out from your developer rather than from a customer. And a named person to contact when something is wrong.
Beyond that, the useful extras are a staging environment where changes get tried before they go live, error monitoring so problems surface before anyone reports them, and a block of time each month for the small changes every business needs. That last one is what most clients use it for. Prices change, a member of staff leaves the team page, a new service needs adding.
How to tell whether yours is being looked after
Ask whoever hosts your site three questions. What version is it running, and is that version still supported? When was the last backup restored to check it worked? And what would happen, specifically, if the site went down on a Sunday?
A confident answer to all three means you are fine. Vagueness on any of them is worth following up on. This is a fair question to ask us too, and we would rather you did.
The sites we have looked after longest
We still maintain sites we built years ago. The Northern Ireland Social Care Council runs four of them, which have to stay secure, accessible and current because a public body cannot afford otherwise. Haymarket Belfast changes every time the menu or the events schedule does. Tom Morrison sells to members worldwide, so downtime has a direct cost.
None of those relationships involved anything dramatic. That is rather the point.
If you are not with us
We take on maintenance for sites other people built, including ones in poor shape. The first thing we do is tell you honestly what state it is in and what it would take to bring it current, and you get that assessment whether or not you go on to hire us.
Our packages are on the website maintenance page, or get in touch and we will look at what you have.
