Maintenance is the line most businesses cut first, and the one that produces the most expensive surprises. A site without it does not degrade visibly — it works fine until the day it does not.
What proper maintenance includes
Updates. Platform, plugins, themes and dependencies. Applied with staging and testing, not blindly on a Friday afternoon.
Security. Monitoring, patching known vulnerabilities, restricting administrative access, enforcing strong authentication.
Backups. Automated, stored separately from the site, and restored occasionally to prove they work. An untested backup is a hope.
Uptime and function monitoring. Not only whether the site loads, but whether the things that make money still work.
Performance. Checking Core Web Vitals with real field data and addressing regressions before they compound.
Small changes. Text edits, new images, a price update. Usually a defined allowance.
A named channel. Someone to contact who knows the site, with a stated response expectation.
What it costs
Prices vary by site complexity, but the shape is consistent.
Basic. Updates, backups, uptime checks. Suitable for a small brochure site with little risk attached.
Standard. Adds security monitoring, performance checks, a content-change allowance and defined response times. What most business sites should have.
Comprehensive. Adds proactive improvements, priority response and deeper monitoring. Appropriate for stores and sites where downtime costs money directly.
WebAktive also offers ongoing capacity arrangements for businesses with continuous work: Standard at €4,999 per month for one project at a time with an expert-level developer, and Extended at €9,999 per month for up to two concurrent projects with two developers. Both include unlimited requests and a dedicated communication channel. Those are development capacity, not maintenance plans — different things, often confused.
What happens without it
Compromise. Unpatched software is how sites get hijacked. Cleanup costs more than years of maintenance, and Google may flag the site meanwhile.
Silent breakage. The failure mode nobody plans for. A contact form that stops delivering, an expired API credential, a payment method quietly rejecting cards.
This site is a real example. Its contact form once returned a success message while sending nothing, because a hidden anti-spam field named website was being autofilled by browsers. Uptime monitoring showed everything green. Every enquiry was being discarded.
Slow decay. Performance drifts, dependencies fall far enough behind that updating becomes a project rather than a task.
Judging a plan
Ask what is actually done each month, whether backups are tested, what response time is promised, and what is excluded. A plan that cannot answer those is an invoice with a label on it.
Can we do it ourselves?
The basics, yes, if someone reliably does them. The failure is not capability, it is that it never reaches the top of anyone's list until something breaks.
Is it necessary for a small site?
Some level, yes. An unmaintained site is a security liability regardless of size, and it is not only your risk — a compromised site is used to attack others.
What if we only need occasional changes?
Then a small plan plus hourly work for changes is usually better value than a large retainer.