Website maintenance is the ongoing work that keeps a site online, secure, fast and accurate: hosting, the SSL certificate, software and security updates, backups, uptime and performance monitoring, and the small content fixes that stop a site going stale. Skip it and sites do not fail gracefully. They get labelled "Not secure" by the browser, drop out of Google, get hacked, or quietly stop sending enquiries. In New Zealand it is sold either as a monthly care plan on top of a site you paid for upfront, or bundled into a subscription like ours. This guide explains each part, what it costs to ignore, how maintenance is priced, and the questions to ask any provider, including us.
What is included in website maintenance?
Nine things, roughly in the order they cause trouble when neglected.
Hosting
The server your site lives on, its renewal, and someone watching that it stays up. Hosting is the one part everyone remembers to pay for; the rest of this list is what people assume is included and often is not.
The SSL certificate
The certificate is what puts the padlock in the address bar and encrypts what visitors type into your forms. It expires, and an expired certificate produces a full-screen browser warning that most visitors will not click through. Certificates from Let's Encrypt, which most modern hosts use, are free and, in the organisation's own words, "valid for 90 days," so renewal has to be automated and checked. Running without one at all is worse: since Chrome 68 in July 2018, Google's browser has marked "all HTTP sites as 'not secure'" in the address bar, as announced on the Chromium blog. Google also uses HTTPS as a ranking signal, which it described in its 2014 announcement as "a very lightweight signal," so the padlock is mainly about trust and security rather than rankings. The Let's Encrypt FAQ has the certificate details.
Software and security updates
This is where the difference between platforms shows. A WordPress site is a core program plus a theme plus, typically, a dozen or more plugins, each written by a different author and each a possible way in. According to the WordPress documentation, minor core releases update automatically by default, and new installations since version 5.6 also update major core releases automatically, but "by default, automatic background updates only happen for plugins and themes in special cases, as determined by the WordPress.org API response, which is controlled by the WordPress security team for patching critical vulnerabilities." In other words, on most WordPress sites a person has to update the plugins, test that nothing broke, and do it again next month. A custom-coded site without a plugin ecosystem has far less to patch, but its underlying libraries still need updating; "no maintenance" is not a real category, only "less."
Backups and restores
A backup is only useful if someone has tested restoring from it. The questions to ask are how often backups are taken, where they are stored, how long they are kept, and how quickly the site can be put back if it is hacked, broken by an update, or deleted by mistake. Ask us the same questions; a provider that cannot answer them in a sentence does not have a real backup process.
Uptime monitoring
Something that checks the site every few minutes and tells a human when it is down. Without it, the first person to notice an outage is usually a customer, and the second is nobody.
Performance
Sites slow down over time as images, scripts and plugins accumulate. Google's Core Web Vitals, published on web.dev, set the bar: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1, measured at the 75th percentile of visits. Maintenance includes checking those periodically and fixing what has crept in. Our guide to speeding up a slow website covers the usual causes.
Security beyond updates
Spam protection on forms, a firewall or equivalent in front of the site, limits on login attempts if there is a login, and a plan for what happens if the site is compromised. Small business sites are attacked automatically, not personally; the bots do not care that you are a two-person plumbing firm.
Content accuracy
The least technical item and the one customers notice most. Prices that changed, hours that changed, staff who left, a service you no longer offer, a "Christmas hours" banner in March, a broken link to a supplier, a contact form that stopped delivering after an email change. Maintenance means someone checks these on a schedule and tests the form by actually submitting it.
Domain renewal
Strictly, a domain is not part of website maintenance, but a lapsed domain is the most common reason a small business site vanishes. The Domain Name Commission's guidance, covered in our .nz domain guide, is to enable auto-renewal; an expired .nz domain sits in a 90-day redemption period and then goes back on the market. Whoever maintains your site should know the renewal date even if they do not hold the domain, which, as we explain in our post on who owns your website, they should not.
What happens if you do not maintain a website?
Usually nothing, for a while, which is why it gets skipped. Then one of these:
- The certificate expires and every visitor sees a security warning instead of your homepage.
- A plugin is exploited and the site starts serving spam or malware, at which point Google flags it and your hosting company may take it down.
- An update breaks something nobody notices, such as the contact form, and enquiries silently stop.
- The site slows down until visitors leave before it loads, and rankings drift with them.
- The content goes stale and customers ring to ask whether you are still in business.
- The domain lapses and email stops along with the website.
Each is cheaper to prevent than to fix, and the fix for a hacked or lapsed site is frequently a rebuild. Our guide to telling whether your website is working is how you would notice most of these before a customer does.
How is website maintenance priced in NZ?
Three models, and the right one depends on how the site was bought. You will find no market price ranges below, because none can be sourced to anything better than another agency's blog; what we can tell you is how each model works and what our own prices are.
- Do it yourself on a builder. Wix, Squarespace and similar include hosting, SSL and platform updates in their subscription, and leave content accuracy, performance and everything above the platform to you. Cheapest in cash, most expensive in your evenings, and you cannot leave with the site.
- A care plan on a site you paid for upfront. The common model for WordPress sites built by an agency or freelancer: a monthly fee for updates, backups, monitoring and a small allowance of changes, with larger work billed by the hour. Inclusions vary enormously between providers, so the questions below matter more than the headline price.
- A subscription that bundles the build with the upkeep. Our model. Every Go Digital plan, from $49 a month, includes hosting, the SSL certificate, ongoing maintenance and security updates, the mobile-responsive build and on-page SEO, with $0 upfront and no lock-in. Content changes after launch are an add-on at $80 an hour, and extra pages are $30 a month each, so the monthly price is the whole cost of keeping the site running. Because we build without a plugin ecosystem, the patching surface is small, and because we host what we build, an update that broke something would be our problem to notice, not yours.
What should you ask a maintenance provider?
- Exactly which of the nine items above are included, and which are billed extra?
- How often are backups taken, where are they kept, and how quickly can you restore?
- What is your response time when the site is down, and how would you know it was?
- Are content edits included, and if so how many; if not, what is the hourly rate?
- What happens if the site is hacked: is the clean-up included?
- Who owns the domain, the hosting account and the content, and what do I get if I leave?
- Do you test the contact form, and how often?
Any provider should be able to answer all seven in writing. Ours are on the straight answers page.
Does a simple website still need maintenance?
Yes, less of it. A five-page brochure site built as static pages has no database and no plugins, so there is little to patch and little to exploit, and that is a genuine advantage of the way we build. It still needs a valid certificate, a renewed domain, a working form, current prices and hours, and someone to notice when any of those stops being true. The maintenance bill for a simple site should be small; it should not be zero.
How do you check your own site's health today?
Three free or nearly free checks. Our website audit runs automated checks across 24 dimensions, including SSL, performance, security headers, broken links and content freshness, and the free report shows the score for each. Google Search Console, which is free, reports pages Google could not index and Core Web Vitals problems it has measured on real visits. And if you want the check repeated without remembering to do it, the audit tool's Monthly Monitor at $9 a month re-audits the site every month, tracks the score over time, and emails you when something critical changes, including certificate and security issues. It is a useful safety net for a site someone else maintains.
Do this today
- Open your site and check the padlock; click it and read the certificate expiry date
- Submit your own contact form and confirm the email arrives
- Find out who renews your domain and when it expires; turn on auto-renewal
- Ask your current provider the seven questions above, in writing
- Run a free audit and note anything marked critical
Where we come in
If you would rather not think about any of this, that is the point of our model: the build, hosting, SSL, updates, monitoring and support are one monthly price from $49, and the site is ours to keep running for as long as you stay. If you already have a site you are happy with and just want to know whether it is being looked after, the free audit will tell you in a few minutes, and the Monthly Monitor will keep telling you. And if the audit says the site is beyond maintaining, our redesign service rebuilds it with migration and redirects included.
Frequently Asked Questions
What does website maintenance include?
Hosting, the SSL certificate and its renewal, software and security updates, backups and tested restores, uptime monitoring, performance checks against Google's Core Web Vitals, security measures such as form spam protection, keeping content accurate and forms working, and tracking the domain renewal date. Inclusions vary by provider, so ask for the list in writing.
How much does website maintenance cost in NZ?
It depends on the model. DIY builders bundle hosting and platform updates into their subscription; agencies and freelancers sell monthly care plans on top of a site paid for upfront, with widely varying inclusions; and subscription providers bundle build and upkeep together. Go Digital includes hosting, SSL, maintenance and security updates in every plan from $49 a month, with content edits at $80 an hour as an add-on. No independent NZ market price range can be sourced, so compare inclusions rather than headline fees.
Is website maintenance included in Go Digital's plans?
Yes. Every plan, from $49 a month with $0 upfront, includes hosting, an SSL certificate, ongoing maintenance and security updates, monitoring and support. Content changes after launch are billed at $80 an hour, and extra pages are $30 a month each. Domain registration and renewal are not included because the domain stays in the client's own registrar account.
Do I need website maintenance for a small brochure site?
Yes, but much less of it. A static brochure site has no plugins or database to patch, so the security workload is small. It still needs a valid SSL certificate, a renewed domain, a tested contact form, accurate prices and hours, and monitoring so that someone notices when any of those fails. Expect a small ongoing cost, not none.
What happens if my SSL certificate expires?
Browsers show a full-screen security warning instead of the site, and most visitors will not click past it, so traffic and enquiries drop immediately. Let's Encrypt certificates, which most hosts use, are valid for 90 days, so renewal must be automated and checked. Since Chrome 68 in 2018, sites with no certificate at all are marked "Not secure" in the address bar.
The bottom line
A website is not finished when it launches; it is finished when it is switched off. Between those two dates someone has to keep the certificate valid, the software patched, the backups real, the content true and the form working. Decide who that is, get their inclusions in writing, and check their work with a free audit now and then. If you would like that someone to be us, get in touch.