Service · Maintenance
Your site stays live, secure, and current without you thinking about it
Monthly plans covering content updates, nightly backups, uptime monitoring, and security patches, handled by the developer who built the code, not a helpdesk ticket bounced between three people. Month-to-month, no annual contract, no cancellation fee.
Six things that have to be actively managed to keep a site working
A website doesn't stay healthy on its own: software needs applying, forms can silently break, certificates expire, content goes stale. None of it announces itself; it accumulates until something breaks or a prospect notices. Each item below is one category, and what happens when no one owns it.
Continuous uptime monitoring
Uptime monitoring is the difference between hearing your site is down from a client, and catching it from an automated alert first. External checks run at regular intervals; if the site stops responding (server failure, DNS issue, SSL error, bad config change), I'm alerted and diagnosing before you know there's a problem. For lead-driven businesses, an undetected outage during business hours is a direct revenue loss.
Nightly backups with offsite storage
Every night, the full site (codebase and database) backs up to a server physically separate from your live one: real disaster recovery, not a copy that dies with the primary if it's compromised or fails. A clean snapshot from within 24 hours is always available, and 30-day rolling retention means a problem discovered late (subtle corruption, a bad code error) still has a clean pre-problem snapshot to restore from.
Security patches applied before problems surface
A hand-coded PHP site has a much smaller attack surface than WordPress with 20 plugins, but not zero. The web server, PHP, and database engine all get periodic security updates; for a critical vulnerability, exploitation can follow publication within days. Proactive patching applies updates (and any third-party libraries) on release, not after exploitation.
Monthly content edits handled by the original developer
Content needs change: pricing, team members, hours, services, images, copy. Requests go directly to me by email and get handled within your tier's response window, no helpdesk queue, no contractor re-learning the codebase. Care includes one hour of edits monthly (most clients use 30 to 45 minutes, but the hour covers the busier months); Priority gets three hours, for active promotional or seasonal content calendars.
SSL certificate management and renewal
An expired SSL certificate is the fastest way to lose a visitor: browsers show a full-page warning and most people leave rather than click through. Entirely avoidable, yet common with no dedicated owner. Managed hosting renews it proactively, before expiration, not after a client reports the warning. For any site handling forms or payments, valid SSL isn't optional.
Direct, same-person support with no ticket queue
The worst support outcome is explaining a problem to a helpdesk rep who escalates to someone who escalates again to whoever reads the code. Maintenance support goes directly to me by email: I built the codebase, so no diagnostic overhead. Response follows plan tier: Core within 24 to 48 hours, Care same business day, Priority same day for anything critical.
What an unmaintained site looks like at 3, 6, and 12 months
Website neglect doesn't announce itself, it accumulates quietly, each problem minor until several compound at once. This is the common timeline for a site that launched clean and never got a dedicated maintenance owner, drawn from reviews of sites clients brought to me after managing them alone.
Month 1–3: the site runs clean, but drift starts
A freshly launched site has no backlog, so nothing visible breaks at first. Under the surface, small things start piling up: a server security update not yet installed, a content item (phone number, service line, staff photo) no one owns, a third-party widget's version update slightly changing how it displays. None are crises alone, but together they're the start of a maintenance backlog, invisible from the outside.
Month 3–6: the first silent failure appears
By three to six months, something usually breaks invisibly, most often the contact form quietly stopping delivery: a settings change, an email problem, or an update incompatibility can make it show a success message while the submission never reaches you. Without monitoring or testing, this runs until leads drop off. Every site I've taken over had at least one broken form like this, and this is also when the first security updates start going unapplied.
Month 6–9: content staleness becomes visible to anyone vetting the business
A prospect checking the site before a call sees a team member who left six months ago. A referral sees a service description that no longer matches. The footer's copyright year is two years behind. None of it breaks anything technically, but all of it tells anyone doing due diligence: this business isn't managing its web presence, quietly damaging credibility in the background of every sales conversation.
Month 9–12: the SSL certificate approaches expiration
SSL certificates run 90 days (Let's Encrypt) or one year (commercial). By nine to twelve months, the certificate either auto-renewed unwatched or is approaching expiration with no one managing it. Expiration triggers a full-page browser warning; the fix takes under ten minutes, but the damage, visitors leaving, leads lost, search engines skipping the site, happens first. By now the site has also accumulated months of unapplied server updates, making it noticeably more vulnerable than at launch.
Month 12+: the emergency edit arrives with no developer relationship in place
Something needs fixing urgently: a wrong price a prospect flagged, a departed team member before a board presentation, a discontinued service still listed live. Now the business must find a developer, explain the codebase, negotiate a rate, and hope the edit doesn't break something unfamiliar, days of work costing more than a year of maintenance would have. Reviews of these sites almost always turn up two or three compounding issues underneath that a maintenance plan would've caught months earlier.
What the audit looks like when a neglected site gets handed off
A comprehensive review of a neglected site turns up predictable findings: an out-of-date server software version, a broken feature (usually the contact form) the owner didn't know about, inaccurate content in multiple places, no tested offsite backups, and a backlog of updates the owner had no way to make. The audit takes hours; fixing what it finds takes longer, none catastrophic, all preventable at a fraction of the cost.
How maintenance fits the full lead flow and where it breaks without it
The path from search to client runs through your website at every stage. Maintenance keeps each stage functional, it's not a background concern. Here's how the funnel works, and where unmaintained sites quietly lose leads.
Search and rank
Google ranks partly on technical health: load speed, mobile display, working links, no browser security warnings. An unmaintained site accumulates small problems in all of these, a slow server, broken links, an expired certificate, and each one nudges rankings down while maintained competitors hold their positions.
Land and evaluate
A visitor from search judges fast: current and trustworthy, or not? Stale content, outdated photos, mismatched descriptions, or a broken mobile layout signal inattention, and the bounce happens before the contact form.
Fill out the contact form
A prospect fills out the form. If it's broken (a config change, a delivery issue, an update), they see a success message, leave, and you never hear from them, gone and invisible unless someone's testing for it.
Receive and respond
The form delivers, the business responds promptly, the prospect is still warm. This works only when everything upstream is maintained; it fails when the form didn't deliver, the site was down, or contact info was outdated. Maintenance protects that handoff.
Convert and close
The prospect becomes a client, and may refer others who'll check the site first. Here it functions as a credibility artifact: stale content undercuts a referral, while a fast, current site reinforces it.
Where it breaks most often
By frequency: form stops delivering (fix: testing); certificate expires (fix: renewal); content goes stale (fix: edit allotment); a weakness gets exploited (fix: updates); site goes down unnoticed (fix: monitoring). All preventable.
Why "I'll just handle it myself" rarely works in practice
Self-managing maintenance sounds straightforward. In practice it requires consistent attention to technically specific work that competes with every other business priority. Here's how it tends to fail, for structural reasons, not personal ones.
Security patching requires knowing what's running, monitoring advisory feeds, and applying patches on a risk window sometimes days wide. Most owners aren't watching PHP or web server vulnerability publications, a specialization mismatch, not an effort failure. Uptime monitoring, backups, and SSL automation need the same ongoing attention.
Content edits fail differently: owners edit in bursts when they remember, so the site's accurate for a week then drifts for months; "I'll get to it this weekend" Editing a codebase you rarely touch also raises the risk of a formatting error or adjacent breakage. A maintenance owner means the update happens on the business's timeline, not whenever there's an opening.
| Maintenance task | Self-managed | ArdinGate maintenance plan |
|---|---|---|
| Uptime monitoring | Requires external tool setup; client gets notified, not a developer | Configured by default; alerts come to me first and I act immediately |
| Nightly backups | Manual process or separate tool subscription to configure | Included: offsite, automated, 30-day rolling retention |
| Security patching | Requires monitoring vulnerability feeds and applying server-level updates | Applied proactively when advisories publish, before exploitation |
| Content edits | Done when time allows; quality varies; risk of adjacent breakage | Submitted by email, handled by the original developer within SLA |
| SSL certificate renewal | Requires calendar reminder and manual renewal or auto-renewal setup | Managed proactively: no expiration warnings reach visitors |
| Break/fix response | Find a developer, explain the codebase, wait for a quote | Email to me (the original developer); priority SLA applies |
The cost of deferred maintenance
Self-managing doesn't save the cost, it defers it into bigger scenarios: an SSL outage during a busy period can cost more in lost leads than a year of Core payments, and a compromise isn't a recoverable afternoon. The question is whether that cost lands monthly and predictable, or not.
Pricing
Three tiers, month-to-month, no annual contract.
Core ($60/month) is infrastructure only: uptime monitoring, nightly offsite backups, SSL certificate management, and server-level security patches (PHP, web server, database engine), for businesses that handle their own content and just need the site to stay live and secure. No content edit hours or codebase-level patching included.
Care ($100/month) is the most common choice: everything in Core, plus one hour of monthly content edits, proactive application-level security patching (codebase and dependencies), and same-business-day response. Most small business sites use 30 to 45 minutes of that hour, enough for regular updates without paying for capacity you don't need.
Priority ($180/month) is for active content needs: everything in Care, plus three hours of monthly edits, same-day response on critical issues, a monthly analytics summary, and test environment access for previewing changes. Built for promotional calendars, seasonal content, or frequent service updates.
Additional content edit time beyond the monthly allotment is $100/hour, prorated. Hosting is billed monthly from launch on every new build.
Common questions
What do the three maintenance plan tiers cover?
Core ($60/month): infrastructure only, round-the-clock uptime monitoring, offsite nightly backups, SSL renewal, and server-level security patches (PHP, web server, database), 24-48 hour response. Care ($100/month) adds one hour of monthly content edits, proactive application-level security patching, and same-business-day response; most clients land here. Priority ($180/month) adds three hours of edits, same-day response on critical issues (site down, broken form, payment error), a monthly analytics summary, and test environment access. Full plan comparison on the pricing page →
What counts as a "content edit" under the monthly hour?
Content edits are changes to existing content: text, images, team members, hours, pricing, a new service card, a link, copy tweaks. Most Care clients use about 45 minutes of their monthly hour. Structural changes (a new page, a rebuilt section, a new feature) are separate scope, quoted before work begins, and you'll never get a surprise bill because overages are flagged first. See what website maintenance includes.
How quickly do you respond when something breaks?
Response follows plan tier: Core within 24 to 48 hours, Care same business day, Priority same day for critical issues (site down, form not delivering, SSL error, payment failure), a commitment, not best-effort. Overnight or weekend problems get caught automatically by uptime monitoring regardless of tier, and I'm notified right away.
Is this different from the managed hosting plan?
Core ($60/month) covers infrastructure: server uptime, SSL, nightly backups, DNS management, server-level security patches, no content edits. Care and Priority add edit hours plus application-level security patching (codebase and dependencies) on the same foundation. Some clients host elsewhere and use the plan just for content edits and support, not infrastructure; that's a workable option worth discussing. See website security basics.
What happens if I need more than the included edit hours?
Extra time beyond your monthly allotment is $100 per hour, prorated to the actual time taken. Any overage gets flagged before it happens so you can approve it or defer it to next month, no surprise bills. If you're consistently going over, I'll tell you directly that moving up to Priority usually costs less than frequent overages.
What if my site breaks and it is not covered under the included hours?
Breaks caused by something on my end (a patch conflict, a server config issue, a code error from an edit) are fixed free, regardless of tier. Breaks from external factors (a plugin you installed, a third-party API change, a registrar issue) are handled quickly but may count against edit hours or get quoted separately. Either way, the site gets fixed first; billing is a conversation after.
Do I own my site and data if I cancel?
You own the code, content, images, and database outright, plan or no plan. Cancel managed hosting and you get a full export (codebase and database dump) before shutdown, hostable with any PHP-capable provider, no lock-in, no proprietary format. Cancellation is month-to-month with 30 days notice; the site stays live through those 30 days for the transition, no cancellation fee.
Can you maintain a site you did not build?
Yes, with conditions. Your clean, well-structured PHP or HTML/CSS site (no page builder) can be taken over after an onboarding review. WordPress, Wix, or Squarespace builds need a different model since those platforms require their own tools and access; WordPress maintenance is possible, but the plugin-update cycle is a burden a custom build eliminates, so migrating off it eventually is the clearer long-term path. Send me specifics and you'll hear what's possible.
What does "nightly backups with offsite storage" mean in practice?
Every night, the full codebase and database back up to a server physically separate from your live one, never sharing infrastructure. If the primary server fails, is compromised, or a bad update corrupts the database, a snapshot from within 24 hours is available for restoration. 30-day rolling retention covers problems that surface late, like subtle corruption discovered a week in.
What kind of security patches do you apply proactively?
Server-level patches (PHP, web server, database engine) are included on every plan, Core included, applied on release. Care and Priority add proactive review of the codebase and its third-party libraries, updated or replaced when advisories publish. A hand-coded site has no weekly plugin ecosystem to patch like WordPress does, smaller attack surface by design. You find out about a vulnerability because it got patched, not because it got exploited.
How does uptime monitoring work and who gets notified?
An external service pings the site at regular intervals. If it stops responding for any reason (server issue, DNS problem, SSL error, config change), an alert fires immediately to me first, not you, so I'm usually fixing it before you'd notice. If there is an outage longer than a few minutes or visible client-side, you get a status update on what happened and what was done.
Is there an annual commitment or cancellation penalty?
No. Plans are month-to-month with 30 days written notice, no annual contracts, no early termination fees, no lock-in. Cancellation is straightforward whether you're bringing maintenance in-house or shutting the site down. Annual payment for a discount is available but never required.
How do I submit content edit requests?
Email is the standard channel: describe what needs to change, attach any new text, images, or files, and I'll handle it within your tier's response window. More complex requests (multiple pages, layout changes) usually just need a quick back-and-forth to scope. No ticketing portal or helpdesk queue, it goes to me, gets done by me, and you hear back when it's live.
Related services: What website maintenance includes · Website security basics · Managed hosting plans · Website redesign · All services
Take the maintenance off your plate.
Tell me what you are running and what is not being handled. You get the monitoring, backups, and support coverage, then focus on the rest of running your business.
Get a quote