Website Management: What It Covers and What It Should Cost

Website management is a bundle, and the bundles vary wildly. Two retainers at the same monthly price can mean an automated backup and a quarterly plugin update, or a named person who answers within an hour when checkout breaks — and the sales pages for both look identical.

The useful thing is to unbundle it. Once you can see the individual tasks, you can tell which ones your host already does, which ones a script does better than a person, and which genuinely require somebody’s judgement. That is what decides whether a retainer is good value or a subscription to something you already have.

Table of contents

• The actual task list
• What your host probably already covers
• Automate the boring parts
• What to ask before signing a retainer
• A proportionate approach
• How this fits the rest of the stack
• FAQ

The actual task list

Everything sold as website management is some subset of these, grouped by what they are really for.

Keeping it running:

• Uptime monitoring, and someone who responds when it fires.
• Certificate renewal, which should be automatic and verified.
• Backups taken, stored off the server, and periodically restored to prove they work.
• Software updates — core, plugins, themes, language runtime.

Keeping it safe:

• Vulnerability patching, promptly rather than on a schedule when something is being actively exploited.
• Malware scanning and a documented recovery path.
• Access review — who still has admin, and should they.

Keeping it working well:

• Performance checks, particularly on mobile.
• Broken link and form checks — the contact form that silently stopped is the classic.
• Analytics that someone actually reads.

Changing it:

• Content edits, new pages, design tweaks — usually the part clients most want and the part most often capped in hours.

Notice how different these are. Backups and certificate renewal should be automatic and unattended. Responding to an outage at 9pm is a human on call. Content edits are project work. Bundling them into one number makes it impossible to tell what you are buying.

What your host probably already covers

Before paying for management, check what is already included, because a good managed platform covers a surprising amount of the first group.

• Certificates — issuance and renewal should be automatic and free. If a line item bills for this, question it.
• Server-level patching — on managed hosting, the operating system and web server are not yours to maintain.
• Backups — many hosts take them daily. What varies is retention and whether you can restore yourself without a support ticket.
• Uptime monitoring — often included, though frequently only alerting rather than responding.
• A firewall and basic protection — usually present at the platform level.

What hosting does not cover, and what a retainer legitimately adds: your application’s plugins and themes, your content, your integrations, and somebody who looks at the site as a whole rather than at whether the server responded.

So the honest question to ask any provider is: which of these do you do that my host does not already? A good one will answer it directly.

Automate the boring parts

A lot of the checklist is better done by a script than a person, because a script does it every day without getting bored.

• Uptime checks that assert content, not just a 200 status code — a blank white page returns 200 quite happily.
• Certificate expiry alerts at 30 and 7 days, from outside your own network.
• Automated backups with a restore tested on a schedule. An untested backup is a belief.
• Dependency and plugin update alerts, so you learn about a vulnerability from a feed rather than from a compromise.
• Broken link crawls monthly.
• A synthetic check on the critical path — a scripted submission of your contact form or a test transaction, so you learn it broke before a customer does.

The last one is the highest-value item on this page and the least commonly done. The contact form that silently stopped forwarding is the most expensive quiet failure a business website has, because nothing looks wrong and the enquiries simply stop.

What cannot be automated: judging whether an update is safe to apply, deciding what to do at 2am, and noticing that the site is fine but the business changed and the copy is now wrong.

What to ask before signing a retainer

1. What is the response time, and to what? An hour for a down site and three days for a content edit are both reasonable — but they should be stated separately.
2. Who is on call, and when? A retainer with no out-of-hours cover is a business-hours retainer, which may be fine, but should be known.
3. Where do backups live and can I restore one myself? Backups on the same server as the site are not backups.
4. How many content changes are included? Unlimited never means unlimited. Find the actual number.
5. Do I own the hosting account and the domain? This is the important one. If the provider holds them, leaving is hard by construction.
6. What happens if I cancel? Get the answer to the previous question in writing before you need it.

Question five is the one that causes genuine pain. A relationship that ends amicably is fine; one that ends badly with the domain in someone else’s account is an expensive problem. Register domains yourself, in your own account, with your own payment method — always, regardless of who builds or manages the site.

A proportionate approach

Scale it to what the site is worth.

A brochure site that rarely changes: managed hosting with automatic backups, automatic certificates, and a content-asserting uptime check. Update quarterly. That is genuinely enough, and it costs very little.

A site that generates enquiries: the above, plus a synthetic check on the contact path, plus monthly updates with a backup taken first, plus someone identified to call.

A site that takes money: the above, plus staging for updates, plus tested restores, plus real out-of-hours cover. Here a retainer is straightforwardly worth it, because downtime has a per-hour cost you can calculate.

The mistake in both directions is common: paying a retainer for a brochure site that needed managed hosting, or running a revenue-generating store with no cover because nothing had gone wrong yet.

How this fits the rest of the stack

Half the standard management checklist is hosting behaviour rather than labour — certificates, server patching, backups, logs — so it is worth seeing what the platform covers before pricing a retainer on top. The RunxBuild hosting calculator shows the service, database, storage and bandwidth on one screen. On RunxBuild, certificates are issued and renewed at deploy, managed databases include backups, deploys keep a history you can roll back in one action, and build and runtime logs sit together rather than behind an SFTP login.

Useful related references:

• Cloud Management Platforms: The Tools and Patterns
• SSL Console: What Certificate Management Screens Are Actually For
• PHP Composer: Dependency Management, and the Two Files That Matter
• Services on RunxBuild

FAQ

What does website management include?

Some subset of: uptime monitoring and response, certificate renewal, backups, software updates, security patching, malware scanning, performance checks, broken link and form checks, analytics review, and content edits. Bundles vary enormously, which is why unbundling the list is the only way to compare two quotes.

Is website management worth paying for?

It depends on what the site does. A brochure site is usually well served by managed hosting plus a content-asserting uptime check. A site that takes money justifies a retainer straightforwardly, because downtime has a calculable per-hour cost. The question to ask any provider is which tasks they do that your host does not already.

What should a website management retainer cover that hosting does not?

Your application layer rather than the server: plugin and theme updates, content, integrations, and someone who looks at the site as a whole. Certificates, operating system patching, platform backups and basic firewalling are usually the host’s job already.

What is the most commonly missed maintenance task?

A synthetic check on the critical path — a scripted contact form submission or test transaction. A form that silently stopped forwarding is the most expensive quiet failure a business site has, because nothing appears broken and enquiries simply stop arriving.

What should I insist on before signing a maintenance contract?

That you own the domain and the hosting account, in your own name with your own payment method, and that this is written down. Everything else can be rebuilt if a relationship ends badly. A domain held in a provider’s account cannot easily be.