Do you actually need website maintenance?

Some organizations do not need a website maintenance plan, and I would rather tell you that here than after you have paid for one. The test is simple. If your site is a brochure on a hosted builder, nothing on it changes, one person logs in every month to test the form, and the domain is on auto-renew with a card that works, you can skip the plan and keep the money.

That describes fewer organizations than think it does. Most sites I am asked to look at run WordPress with a dozen plugins that were current on launch day, carry a form someone relies on, and belong to an organization where nobody’s job includes the website. For those, the question is not whether the maintenance happens. It is whether it happens before or after something breaks.

Who can skip it?

You can run without a plan if all of the following are true.

• The site is on a hosted platform such as Squarespace, Wix, or Shopify, which patches its own software.
• Nothing on the site changes more than a few times a year.
• One named person logs in monthly, submits the contact form, and confirms the email arrives.
• The domain and the platform subscription are on auto-renew, on a card that is not going to expire, with renewal emails going to an inbox someone reads.
• You know every login, and they are in the organization’s name, not a former volunteer’s.

Meet all five and you need discipline, not a vendor. Miss one and you have found the place the site will fail.

Who cannot?

Anything on WordPress with plugins. Patchstack counted 11,334 new WordPress vulnerabilities disclosed in 2025, up 42 percent on the year before, with 91 percent in plugins and 46 percent lacking a patch on the day they were disclosed. The weighted median time to first exploit was five hours. Nobody on your staff is going to beat that with a monthly login. Weekly updates after a backup are the only defense, and they have to happen every week.

Anything with a form people rely on. Intake, applications, referrals, donations, quote requests. Forms fail silently, and the organization is the last to know.

Anything that takes money. A donation page or a store has a payment processor, a tax configuration, and a checkout that has to be tested with a real transaction, because the platform will not tell you when it stops working.

Any organization with standing obligations. A Minnesota charter school posts board minutes within 30 days under state law, and a public entity has an accessibility deadline. A nonprofit holding a Google Ad Grant must keep a 5 percent click-through rate every month and a site with no broken links. A Medicaid-funded provider has an accessibility deadline of its own. The website is not a project for these organizations; it is a standing duty with dates on it.

What happens if you don’t maintain your website?

Nothing, for a while. That is the problem. Here is what is happening underneath, with the figures.

The software goes out of date and gets used against you. The numbers above are the whole argument. Sucuri’s forensic report on hacked sites found that 39 percent of compromised content systems were out of date at the point of infection and that nearly half of compromised sites had a backdoor left behind. Google’s spam policies say sites with hacked content “may rank lower in results or not appear in results at all,” its help pages describe the “This site may be hacked” label that appears in results, and recovery is all or nothing: fixing some pages earns no partial return, and the review can take weeks.

The forms stop sending. Since February 2024, Google’s sender guidelines require every sender to authenticate with SPF or DKIM and keep a valid reverse DNS record. A form that sends from an unauthenticated domain, which describes the default setup on most small sites, is junked without an error. The plugin that handled it gets updated and changes the sending address. The inbox it forwarded to gets closed when the volunteer leaves. The organization finds out from a person who says they tried to reach it.

The links rot and the embeds go blank. The Pew Research Center found that 38 percent of web pages that existed in 2013 were gone a decade later, and that about one in five pages from 2021 had vanished within two years. Your site links to pages that disappear. The embeds break on their own schedule: Instagram’s Basic Display API stopped answering on December 4, 2024, so every feed built on a personal account went blank; a Google Maps embed shows a dark “for development purposes only” tile when its key or billing lapses.

The certificate or the domain lapses. An expired SSL certificate puts a full-page “Your connection is not private” warning in front of every Chrome visitor. An expired domain is worse: GoDaddy’s published timeline parks it on day five, when “any connected website or email will stop working,” charges a redemption fee from day 18, and releases it for good on day 72. The email about the renewal went to the person who set it up in 2021.

The analytics disappear. Google stopped processing Universal Analytics hits in July 2023 and deleted the data in July 2024. Organizations that never moved to the new version lost years of history and have had no numbers since.

The content starts lying. Hours from before the move. A board member who left. A lottery date from last year. A program that ended. A donate button pointing at a platform you stopped using. None of it is dramatic, and all of it tells a funder, a parent, or a customer that the organization is not paying attention.

The accessibility obligation that makes this a standing job

For some organizations, maintenance stopped being optional in a legal sense.

The Department of Justice’s ADA Title II web rule requires state and local government entities, which include public schools, to meet WCAG 2.1 Level AA, with compliance dates of April 26, 2027 for entities serving populations of 50,000 or more and April 26, 2028 for smaller entities and special districts, after the April 2026 extension published in the Federal Register. The HHS Section 504 rule applies the same standard to recipients of HHS funding, which on HHS’s own reading includes Medicaid providers, by May 11, 2027 for those with 15 or more employees and May 10, 2028 below that, after a May 2026 extension.

The reason this is a maintenance problem and not a launch problem: a site can meet WCAG 2.1 AA on launch day and fail by the following quarter through nothing but uploads. A PDF without tags, a staff photo without alt text, a slideshow plugin someone installed. Keeping a standard requires someone checking every new page and document, which is a quarterly item on a care plan and nobody’s item otherwise.

Private businesses have no technical standard under ADA Title III, but they have the lawsuits. Seyfarth Shaw counted 3,117 federal website accessibility suits in 2025, up 27 percent, with 162 of them in Minnesota, the fourth-highest state. Our accessibility guide covers what to fix first.

Three situations I see every month

The nonprofit site a volunteer built. It is on WordPress, it looks fine, and the volunteer moved to Denver in 2024. Nobody has logged in since. The donate button points at a platform the organization stopped using, the contact form forwards to the volunteer’s old address, and the plugins are three years behind. Nothing is visibly wrong until the week before Give to the Max Day, when a donor emails to say the page would not load. This site needed the bottom band of maintenance from the day the volunteer left, and now it needs a cleanup first.

The charter school in January. The site was built properly two years ago. The office manager posts closures from her phone and does it well. What nobody owns is the board page, which is four months behind on minutes the law says go up within 30 days, and the enrollment page, which still shows last year’s lottery date. The software is fine because the host patches it. This school does not need a security plan; it needs two hours a month of someone posting what the board clerk sends.

The home care agency’s careers page. The site runs on a hosted builder and the owner updates the services page herself. The careers page lists a wage range from 2024 and two shifts that were filled months ago, because the applicant tracking link was never updated when the agency changed systems. Applicants on phones, which is where more than 70 percent of job applications now come from according to Appcast’s 2026 benchmark report, hit a dead link and leave. One hour a month fixes it; a plan is not required if someone will own that hour.

The pattern across all three: the failure is never the thing the owner was watching. It is the page nobody was assigned.

What maintenance does not fix

A site that needs a redesign is not a maintenance problem, and I will not sell you a plan to postpone the conversation. If the structure is wrong, the design is from another era, or the content was never good, patching the plugins keeps a bad site safe and nothing more. Our redesign checklist tells you in twenty minutes which problem you have.

Likewise, maintenance does not bring traffic. It keeps a site from losing what it has. If nobody finds the site today, start with why your website is not showing up on Google, not with a care plan.

A six-question self-check

Answer honestly.

1. Has anyone updated the site’s software in the last month?
2. Has anyone submitted the contact form in the last month and seen the email arrive?
3. Do you know, today, where the domain is registered and whose card renews it?
4. Has a backup ever been restored, anywhere, to prove it works?
5. Is every fact on the site true this week: hours, staff, dates, prices?
6. If the site went down tonight, do you know who would notice and who you would call?

Two or more no answers means the site is already going wrong. You just have not found out yet.

When is a care plan overkill?

When the site rarely changes and you are disciplined. If the platform patches itself, nothing needs posting most months, and your needs are a handful of small edits a year, a plan’s included hours sit unused and hourly help is cheaper. I say so on the first call rather than selling the plan.

The plan earns its keep when something needs posting most months, because included hours cost less than buying the same work one task at a time; when forms must be tested because people rely on them; and when a standing obligation, board minutes, a careers page, an accessibility standard, has to stay current with or without anyone remembering. I laid out the market prices for each level in how much website maintenance costs, and the options for who does the work in hiring someone to update your website.

What to do next

Run the six questions. If you passed, keep the money and put the checklist on someone’s calendar. If you did not, send us the URL. We will tell you what is out of date, what is at risk, and what it would cost to keep right, as a fixed monthly quote in writing, whether or not you hire us. What each plan covers is on the website maintenance page.