A plain-spoken look at what website maintenance really covers, why skipping it costs more than you think, and how to check if you're covered.
A few years back, we watched a perfectly good website go down because of a $0 SSL certificate. Nobody had set it to auto-renew. The cert expired on a Saturday, every browser started throwing scary red warnings, and by Monday the organization had fielded a dozen calls from people convinced they'd been hacked. Total fix time: about ten minutes. Total damage to trust: harder to measure.
That's website maintenance in a nutshell. The work itself is small and boring. The cost of not doing it is neither.
What Maintenance Actually Covers
When we say "maintenance" to a client, we can usually see the word slide right off. It sounds like a line item invented to pad an invoice. So here's the actual list, the stuff we do month in and month out:
- Security updates for your website's software, plugins, and themes
- Backups, so you can restore your site if something goes wrong
- Uptime monitoring, to catch outages before your community does
- Broken-link checks, especially after you update pages or move content
- Content updates, like new staff bios, event dates, or program pages
- Accessibility checks, so people using screen readers or keyboard navigation can actually use your site
The backups line deserves a second look. Having backups and having tested backups are two different things, and the gap between them has ruined more than one organization's week. A backup you've never tried to restore is a hope, not a plan.
None of this work is glamorous. Honestly, that's how you know it's being done well. Good maintenance is invisible.
Why Skipping It Costs You Quietly
Skipped maintenance almost never blows up on day one. That's what makes it so easy to defer.
The most common failure we see is the out-of-date plugin. WordPress powers a huge share of the nonprofit web, and every unpatched plugin on a WordPress site is a door someone forgot to lock. Nobody is sitting in a basement targeting your food bank specifically. It's bots, thousands of them, scanning constantly for known vulnerabilities and slipping in wherever they land. We once inherited a site that looked completely normal from the homepage. Buried underneath it: several hundred spam pages selling knockoff handbags, quietly torching the organization's search rankings for months before anyone noticed.
Updates can bite in the other direction too. We've had a routine plugin update take down a site's donation form on a Friday afternoon (of course it was a Friday). Because we caught it within the hour and had a backup from that morning, it was an annoyance instead of a lost weekend of donations. That's the whole value proposition right there.
Then there's the quieter stuff. A site that's down for six hours when nobody's watching. A contact form that silently stopped sending email in March, discovered in July. An accessibility regression that shuts out screen reader users, who typically won't file a complaint. They just leave, and you never learn why.
Not one of these problems announces itself. They surface as a slow traffic decline, a dip in rankings, or a donor mentioning offhand that your form "didn't seem to work." By then the bill has been quietly accumulating for a while.
How to Know If You're Covered
You don't need to be technical to audit this. Five plain questions will do it:
- Who updates our website's software, and how often?
- Where are our backups stored, and has anyone tested restoring one?
- Do we get alerted if the site goes down?
- When did we last check for broken links or outdated content?
- Has anyone reviewed our site for accessibility in the last year?
If the honest answer to most of these is "no idea," you're in good company. We ask these questions at the start of nearly every project, and "no idea" is the most common answer by a wide margin. It's not negligence. It usually means the site was built by a contractor who moved on, or a volunteer who changed roles, and maintenance quietly became nobody's job. Lean teams doing real work with limited staff end up here all the time.
Maintenance as Care, Not Overhead
Here's how we frame it for ourselves: your website is often the first place someone meets your organization. A family looking for services at 11 p.m. A funder doing due diligence before a grant decision. An Elder checking whether your office is open Friday. Keeping the site steady, secure, and accessible isn't overhead. It's part of keeping your word to the people you serve, the same way you'd keep the front door working and the lights on.
If you're not sure what's covered right now, or you'd like a plain-language check-up on where things stand, talk to us.
