Security · Server
Website maintenance: what you are really paying for, and what you risk without it
Many people turn maintenance down because it looks like paying for nothing: the site is up, it works, why keep paying? Because a website is software, running on other software, the server, and software ages even if nobody touches it.
There are two things to update, not one
The first is the site: the system it is built with, the plugins, the theme. The second is the server the site runs on: usually a virtual machine, a computer rented in a data centre, with its own operating system and programs. When people talk about maintenance they think of the site. The server is almost always forgotten.
Why a site left alone becomes dangerous
Every week new security holes are found and made public in the most widely used programs. From that moment, automated programs roam the internet looking for whoever has not updated yet. They do not pick you: they try everyone, day and night. An outdated site is not a target, it is an opportunity.
In the sites we audit, among those built with WordPress 71% had the core or some plugin out of date.
The biggest risk: the server left to itself
Automatic security updates for the operating system take a few minutes to switch on. Yet few people do it: on the servers we end up taking over we find them switched off almost every time, sometimes for years. A server like that is the easiest way in, even more than the site.
What intruders do: usually, mine cryptocurrency
Whoever breaks into a small business's server is usually not after your data. They want the computing power: they install a program that mines cryptocurrency for them, and your server works day and night for someone else. You notice because the site becomes very slow, or because the provider suspends the machine. Sometimes the server is also used to send spam or attack other sites, and then your domain lands on blacklists and even your ordinary email starts going to spam.
What proper maintenance includes
- Automatic security updates on the server, and checked.
- Updates to the site, tested before going live.
- Regular backups, kept off the server, and tested: a backup you cannot restore is no use.
- Renewing the domain and the HTTPS certificate before they expire.
- A check that the site answers, with an alert if it stops.
That is what we do for the sites we manage: we look after server, domain and updates, and the logins stay with you anyway.
If you do not want maintenance
It is a legitimate choice, as long as it is made knowing what it means. The bare minimum: automatic security updates on the server, backups off the server, and every login in your hands, so that if something goes wrong someone can step in. More in Who builds your website: the questions to ask.