What actually takes small business websites down
It is rarely hackers first — it is expirations. A domain renewal on a dead credit card, an SSL certificate nobody set to auto-renew, hosting suspended over a failed payment. The site vanishes, and the owner finds out from a customer. A renewal watch is the least glamorous part of maintenance and prevents the most embarrassing failures.
Second: updates applied blind, or never. Unpatched CMS and plugin software is how automated compromise happens — scanners probe known vulnerabilities against every site on the internet, yours included. But updates applied with no backup and no check afterwards are how sites break themselves. Maintenance is the discipline of doing both: patch promptly, with a way back.
Third: the person who built the site is gone. No credentials, no documentation, DNS in someone’s personal account. Half of taking over a new client site is first recovering control of it — which is why our first deliverable is always a written inventory you own.
When you do not need a maintenance plan
A static brochure site on a reputable managed platform, registrar auto-renew on a live card, and an owner willing to glance at it monthly — that setup does not need a monthly plan, and we will say so at the free review rather than sell you one.
The trigger points where that stops being true: forms feeding your sales pipeline, e-commerce, a CMS with plugins, or nobody checking at all. Whatever you decide, the minimum bar is the same — backups verified by an actual restore, and renewal alerts that reach an inbox somebody reads.