Launch day feels like a finish line: the website is online, paid for, done. In reality, that day starts a second phase that quotes rarely mention. A website runs on software that keeps evolving, shows content that goes stale, and sits under rules that change. None of this is dramatic, as long as someone looks after it. If nobody does, you notice nothing at first, and then suddenly a lot.

Software ages, even when the site looks the same

A typical WordPress website consists of the WordPress core, a theme, a handful of plugins, and the PHP version on the server. All of these receive continuous updates: bug fixes, security patches, adjustments for new browsers. For the sites we look after, update rounds run monthly, and there is practically no month where nothing is due.

Postpone updates for years and you end up with a different problem: the version jumps grow so large that a single update can break the site, because an old plugin no longer works with the new core. A routine task of minutes turns into a repair project of days. Regular small updates are cheaper than a rare big rescue.

Security: attackers aren’t looking for you, they’re looking for your gap

The most common objection is: ‘Who would bother hacking our little website?’ The question misses how this works. Attacks on small websites are automated: scripts scan the web for installations with known vulnerabilities, usually in outdated plugins, and take over whatever they find. There is no shortage of material: according to Patchstack’s report ‘State of WordPress Security’ (2025), 7,966 new security vulnerabilities were documented in the WordPress ecosystem in 2024, around 22 per day; 96 percent of them sat in plugins, while WordPress core itself accounted for seven. Whether a Viennese flower shop or a corporation is behind the site makes no difference to the script.

A compromised site then sends spam, redirects visitors to scam pages, or lands on blocklists, so browsers warn against it and Google drops it from the results. The cleanup costs a multiple of any maintenance fee. Up-to-date software and working backups are not a luxury here, they are the insurance.

Content goes stale faster than technology

A technically well-maintained site can still feel abandoned: last year’s opening hours, a team photo featuring someone who left long ago, prices that differ from the ones at the till. For visitors this is not just inconvenient, it erodes trust. If they are sloppy with their opening hours, goes the silent conclusion, maybe they are sloppy with their work too.

Our practical advice: put two fixed dates a year in the calendar on which someone clicks through the entire website and checks it against reality. One hour, twice a year, catches most embarrassments before customers find them.

Opening hours, holiday schedules, phone number, address
Prices and service descriptions
Team page and contact persons
References and ‘news’, nothing looks older than a news item from three years ago
Submit the contact form yourself once: does the message actually arrive?

The legal side doesn’t stand still either

Legal notice, privacy policy, and cookie consent are not one-off checkboxes. It is enough to add a new analytics tool, or for a plugin to suddenly send data to a third party, and your privacy policy is out of date. On top come new requirements such as the accessibility obligations that have applied to many businesses selling online since mid-2025.

We do not give legal advice, and this article is no substitute for it. But the technical side, meaning which tool loads which data and whether the cookie banner actually controls that, is part of maintenance. This is exactly where website reality and privacy text drift apart most often.

Do it yourself, or have it looked after?

Both are legitimate. If you maintain the site yourself, you need a routine: apply updates and check the site afterwards, not only create backups but occasionally test-restore one, and do the half-yearly content review. Realistically that is a few hours per month, and they have to happen reliably, in December and during holiday season too.

A maintenance contract buys exactly that reliability. Depending on scope, agencies typically charge around €30 to €150 a month for updates, security, backups, and small changes. Whether that pays off depends simply on what your own time costs and whether the routine would actually happen without a contract. You know the honest answer to that better than anyone.

Criterion	Maintain it yourself	Maintenance contract
Running costs	only your own time	around €30 to €150 a month
Time required	a few hours per month, reliably	practically none
Updates, security, backups	your own routine, December included	handled continuously by the agency
Typical risk	the routine quietly lapses	dependence on the provider

How we handle this in our projects

For us, a web project does not end at go-live. If you want, the site goes into ongoing care: we handle updates, security, and backups, and make changes when you get in touch. If you prefer to maintain it yourself, we hand the site over completely, including all access credentials and a training session, and you contact us only when needed. Either way the website belongs to you; with us, a maintenance contract is an offer, not a condition.