Why a website needs maintenance even when nobody touches it

A published website does not stand still. The files uploaded a year ago are exactly the same files, but everything around them keeps moving: the certificate that encrypts it, the server that delivers it, the browser that opens it and the service that sends its forms. That is why an abandoned website does not stay as it was. It decays.

It is worth understanding what decays, because that is precisely what separates maintenance you actually need from a fee that only shows up on the bank statement.

The certificate expires, and rarely during office hours

The padlock next to the address comes from a security certificate with an expiry date: usually three months, sometimes a year. As long as it renews itself, nobody knows it exists. The day renewal fails (because a domain setting changed, because the server restarted halfway, because the card paying for it expired), the browser stops showing the site and puts a warning screen in its place saying the site is not secure.

Almost no visitor gets past that screen. And since certificates do not expire on a Tuesday morning, the usual way to find out is a customer ringing on Monday to ask whether the business has closed down.

Security flaws are discovered after launch

A website rests on software other people wrote: the content management system, its extensions, the version of the language the server runs. That software is audited continuously and, when a flaw appears, it is published together with its fix. Publication is open by design, because the whole point is to get everyone to update.

The side effect is that it also informs anyone who makes a living finding sites that have not updated. Attacks on small business websites are almost never targeted. They are automated sweeps testing known vulnerabilities against thousands of domains an hour. You do not need to be an interesting target to be found; you only need to be out of date.

Browsers change several times a year

Chrome, Safari and Firefox update every few weeks. Most of those changes break nothing, but some retire old features, tighten security requirements or change how third-party cookies are handled. A site built with what was correct in 2022 can find itself in 2026 with a map that no longer loads, an embedded video showing an empty box or a typeface that has stopped applying.

None of this raises an alert. The site still opens perfectly well; one part of it has simply stopped working, and the only way to see it is to go and look.

The form that stops sending and says nothing

This is the most expensive failure and also the quietest. A contact form does not send email by itself: it relies on a delivery service with its own key, its own monthly allowance and its own configuration requirements on the domain. Any of those three pieces can break on its own. A key that expires, a free plan that runs out of its limit, an authentication record left out of date so the message lands in the junk folder.

Meanwhile the form keeps showing "Thank you, your message has been received". The person writing believes they have written. The person who should have received it believes nobody wrote that month. By the time anyone notices, months have passed and there is no way to recover those enquiries.

What proper maintenance covers

Maintenance that deserves the name includes, as a minimum:

• Updates to the system and its components, with a backup taken first and a check afterwards that the site still works.
• Automatic backups, stored away from the server itself and restored from time to time. A backup that has never been tested is a backup nobody knows anything about.
• Active monitoring: downtime, certificate status and a regular test that the contact form genuinely reaches its destination.
• Domain and certificate renewed before the date, not after the warning.
• A response time in writing. "Support" means nothing. "A reply within 24 working hours" does.
• A number of changes included each month, with what falls outside stated as clearly as what falls inside.

How to tell it apart from a fee

A fee with no maintenance behind it gives itself away by what it cannot show. Four questions are usually enough:

1. What was done last month? Real maintenance leaves a trail: updates applied, incidents resolved, backups verified. If the only answer is "monitoring", there is nothing to show because there is nothing to tell.
2. Where are the backups kept, and when was one last restored? If they sit on the same server as the site, they are not backups: they are the same point of failure, twice.
3. How is an outage detected: by automated monitoring, or by a customer ringing?
4. What happens if maintenance is cancelled? If it is maintenance on a site that is yours, the site stays and what leaves is whoever looked after it. If the fee also hosts it, the site stops being published, and then the question is whether the work is kept and comes back when you take a fee out again, or whether it is deleted. Both arrangements are legitimate; the one that is not is the one that does not tell you before you sign.

The order of magnitude

Almost everything above describes a website built to measure on a content management system: there are extensions to update, a server to administer and a person who goes in and does it. For a freelancer or a small business in Spain, that maintenance, covering updates, backups, monitoring and a reasonable number of monthly changes, runs between €35 and €150 a month, VAT included, depending on the size of the site and the response time committed to. What is being paid for there is somebody's time, and that is why it costs what it costs.

There is another way for the sums to work, and it is not working for less: it is not having that work in front of you. A site served as static files carries no content management system and no extensions, so there are no versions to chase and none of the familiar surface that automated sweeps go looking for. The certificate and the backups are handled by the system, and content changes are made by the owner in the editor, there and then, without waiting for anybody's turn.

That is the approach at Díaz Oliva: a monthly fee depending on the plan, and all the maintenance sits inside it. The site served with its certificate, its backups and the editor open to change whatever you want as often as you want. There is no maintenance fee on top, and no extra to contract separately.

Comparing the two figures without looking at what sits underneath tells you nothing: the higher one pays somebody to go in and maintain a system, and the lower one pays for that system not to be needed. What to ask is the same in either case, and it is the list above: what was done last month, where the backups are and what happens if you cancel.

Either one is cheap next to rebuilding a website left untouched for two years, and certainly cheaper than six months of contact forms going nowhere.

If what you want is not to have to remember any of this, the site is built here and the maintenance sits inside it from day one: building it and trying it costs nothing, and the fee starts when you decide to publish.