Website maintenance FAQs

Website maintenance is the ongoing work of keeping a website secure, working and up to date after it launches. It covers software and plugin updates, security patching, backups, hosting, uptime and performance monitoring, checking forms and integrations, and making content changes. The Australian Cyber Security Centre’s own advice is to regularly back up website data and keep software and plugins up to date. Without it, problems build up quietly until something breaks or gets hacked.

Website maintenance includes software, theme and plugin updates, security patching and monitoring, regular backups you can restore from, hosting, uptime and performance monitoring, and checks that forms and integrations still work. A good plan also includes reporting, so you can see what was done, and time for small content changes. The Australian Cyber Security Centre also recommends multi-factor authentication for every admin account and limiting admin access to the people who need it. What’s included varies a lot between providers, so ask for the list.

Security updates should be applied within days, not months: Australia’s Essential Eight guidance sets 48 hours for critical vulnerabilities in online services and two weeks for the rest. Speed matters because, according to Patchstack, about half of high-impact WordPress vulnerabilities are exploited within 24 hours. Content should be reviewed at least every few months, and a full redesign is usually needed every few years. On hosted platforms like Webflow and Shopify, the platform handles core updates, which reduces the work.

WordPress plugins need updating because that’s where almost all WordPress security holes are found. Patchstack’s 2026 report found 91% of new WordPress vulnerabilities in 2025 were in plugins, with 11,334 new vulnerabilities across the ecosystem, up 42% on 2024. Updates also keep plugins compatible with new versions of WordPress. Updating isn’t enough on its own, though: 46% of vulnerabilities had no fix available when they were made public, so fewer plugins and active security monitoring matter too.

Most attacks on business websites are automated, looking for known weaknesses rather than a particular business. The most common ways in are outdated software, themes and plugins with known vulnerabilities, and weak or reused passwords that attackers guess. Heavily targeted vulnerabilities are often attacked within hours of becoming public. Keeping software updated, using multi-factor authentication and limiting admin access close most of these gaps.

Uptime monitoring is a service that checks your website automatically, every few minutes, from outside your hosting, and alerts someone the moment it stops responding. It means problems are caught and fixed before customers or Google notice, not when a customer calls to say the site is down. Ask whether monitoring also checks SSL certificates, because an expired certificate makes the site look broken. A site can be up but broken, so forms and integrations need checking too.

Back up as often as your website changes. A brochure site that rarely changes can be backed up weekly, while an online store or a site taking bookings needs daily backups at least. Keep several recent copies, stored somewhere other than your hosting account, and test that they actually restore. The Australian Cyber Security Centre recommends storing backups offsite and checking whether your hosting provider backs up, and how often.

An SSL certificate encrypts the connection between your website and its visitors, which is what makes the address start with https. When Chrome shows “Not secure”, it means the site isn’t using a private connection, so information someone types in could be seen or changed, and Chrome tells visitors not to enter personal details. The fix is to install a certificate and send all traffic to the https version; basic certificates are free from providers like Let’s Encrypt. Certificates expire on a cycle, so renewals should be automatic and monitored.

When your website goes down, visitors see an error instead of your business, enquiries and sales stop, and paid ads keep sending people to a dead page. If it stays down, Google slows its crawling and will eventually drop pages from its index. Short outages are usually fixed quickly when monitoring alerts someone straight away; longer ones can be caused by expired hosting, domains or certificates, a failed update or a hack. Recent backups are what make recovery fast.

Yes, websites usually slow down over time as images, plugins, tracking tags, chat widgets and other third-party scripts are added after launch. In 2024, JavaScript became the most requested file type on web pages, and any significant amount of it can slow a page down. Google’s target is for the main content to load within 2.5 seconds. Regular performance monitoring catches the slowdown before it costs you rankings and enquiries.

After launch you can take the website in-house or keep us on. Our care plans cover hosting, maintenance, security, monitoring and a monthly allowance for changes, and we can keep improving SEO, AI search and conversion. We also do one-off changes outside a plan: we estimate the time and you approve it before we start, and we offer retainers if you’d rather book regular hours. You also get video training and a walkthrough, so your team can manage content themselves.

Nothing goes live without your approval. Changes are built and tested on a staging copy of the site, or a duplicate theme on Shopify, and you sign them off before we publish. On platforms with an activity log, like Webflow, you can see who changed what. If something does go wrong, we tell you straight away, fix it and explain what happened.

Our Growth plan includes defined response times and Advanced includes priority response times. Uptime monitoring alerts us when your site stops responding, so we often know about a problem before you do. If your site breaks, contact your named point of contact or call 1300 106 020.

On our Growth and Advanced care plans you have a named point of contact who knows your website, and you send change requests to them. Otherwise, email info@thewebhaus.com.au or call 1300 106 020. Requests within your plan’s allowance are simply done; anything bigger is quoted before we start.

Yes, subject to a technical audit. We need to understand how the site was built, what condition it’s in and whether anything needs fixing before we take responsibility for maintaining it. We take over Webflow, Shopify and WordPress sites built by other developers, and we’ll tell you if patching would cost more than rebuilding the key pages.

Yes. Webflow and Shopify sites are hosted by those platforms, custom-coded sites can run on Vercel in your own account, and we can host WordPress sites for you or keep them with their current host if it’s a good one. If you’re not technical, we handle the domain and DNS changes, and we check with your IT provider before changing anything that could affect your email. We test the move first to keep downtime to a minimum.

We set up Google Analytics 4 and Google Tag Manager, plus Meta and LinkedIn pixels if you advertise on those platforms. Nothing is added without your approval, and you own the accounts.

Every team member has a named account with multi-factor authentication, and we don’t use shared logins. We keep platforms, themes and plugins patched, monitor for security issues, take regular backups we can restore from, and limit admin access to the people who need it. We build on platforms with independent security certification, such as Webflow and Vercel.