A website is never really finished. Software underneath it needs updates, certificates expire, plugins go out of support, forms quietly stop sending, and pages drift out of date. For South Australian small businesses, not-for-profits and councils, most website problems we see are not dramatic hacks but slow neglect: a contact form nobody noticed was broken, a plugin with a known security hole, or a domain that lapsed because the renewal email went to someone who left. This guide explains, in plain words, what ongoing website care should cover, how often each task needs doing, what to ask a provider for in a care plan, and how to keep control of it yourself. It is general guidance, not legal advice, and products and requirements change, so check current details before you rely on them.
What can go wrong when nobody looks after a website
- Security holes in old software. Content management systems such as WordPress, and especially their plugins and themes, regularly publish security fixes. A site that is months behind is an easy target for automated attacks that add spam pages, redirect visitors or steal form data.
- Broken forms and lost enquiries. Email settings change, spam filters tighten and form services update. If enquiries stop arriving, many organisations only find out weeks later.
- Expired domains and certificates. A lapsed domain or HTTPS certificate takes the whole site offline or shows a security warning. Public certificates are also getting shorter lifetimes, with the industry moving from about a year to 200 days in 2026 and shorter again over the next few years, so renewal must be automatic rather than a calendar reminder.
- Slower pages and lost search visibility. New images, tracking scripts and plugins add weight over time. Our guide to website speed, Core Web Vitals and local SEO explains why that matters.
- Accessibility drifting backwards. A site that met WCAG 2.2 AA at launch can fail it after a year of new content, such as images without alt text, PDFs that screen readers cannot read or buttons with poor contrast. See our WCAG 2.2 guide for SA government and council websites.
- Out-of-date information. Old phone numbers, opening hours, staff names and service descriptions confuse customers and also feed search engines and AI summaries with the wrong facts.
A practical maintenance schedule
| How often | Tasks |
|---|---|
| Continuously (automated) | Uptime monitoring with alerts to two people, automatic certificate renewal, daily backups for sites with a database, and security alerts from the hosting provider. |
| Weekly | Apply security updates to the content management system, plugins and themes (on a test copy first for larger sites), and check that backups actually ran. |
| Monthly | Send a test enquiry through every form, check Google Search Console for errors and security warnings, review broken links, and remove plugins and admin users nobody needs. |
| Quarterly | Restore a backup to a test site to prove it works, run accessibility and speed checks on key pages, review who has admin access, and check contact details, hours and key service pages are current. |
| Yearly | Review the domain renewal date and registrant details, hosting plan and costs, privacy policy and cookie or analytics settings, and whether the platform itself is still supported or needs replacing. |
Small brochure sites need less than this; busy sites with online payments, bookings or member logins need more. The point is to agree in writing who does each task and how you will know it was done.
Security basics every site should have
- Multi-factor authentication on every admin login, including the content management system, hosting control panel, domain registrar and DNS host. Our password manager and MFA rollout guide covers how to do this without locking people out.
- Named admin accounts only. No shared “admin” login, and remove access the day a staff member or contractor leaves, as in our onboarding and offboarding checklist.
- Fewer plugins. Every plugin is code someone else maintains. Remove unused ones and avoid plugins that have not been updated for a long time.
- Backups stored away from the website, kept for at least a few weeks so you can go back to before a problem started, and tested by restoring them. Our backup and disaster recovery guide explains the principles.
- Protected forms. Spam protection, sensible limits on file uploads, and no sensitive personal information sent by plain email where you can avoid it. If a form collects personal information, your privacy obligations apply; see our Privacy Act and notifiable data breaches guide.
- Security headers and HTTPS everywhere, set at the hosting or CDN layer so every page gets them.
- Email authentication for your domain, so form notifications are delivered and criminals cannot send email as you. See our SPF, DKIM and DMARC guide.
A static website, where pages are built ahead of time and served from a content delivery network, removes much of this work because there is no database or server-side code on the live site to attack. It still needs its forms, scripts, domain and accounts looked after.
What to ask for in a website care plan
- A written task list matching the schedule above, with what is included and what is charged separately.
- Response times for an outage or hacked site versus routine content changes, and how you report a problem out of hours.
- A short monthly or quarterly report covering updates applied, uptime, backup and restore tests, form tests, and any security or search issues found.
- Your ownership of everything. The domain, hosting, code, content, analytics and Google Search Console should be in your organisation’s name with the provider added as a user. Our domain, DNS and admin account ownership checklist explains how to check.
- A clean exit. How you get a full copy of the site and content if you change provider, and how long the handover takes.
- A content allowance for small text and image changes, so updates are not left waiting for a quote.
Many of the same questions apply to any IT support arrangement; our managed IT provider checklist has more on service levels and contracts.
If your site has been hacked or is offline
- Do not delete anything yet. Take the site offline or put up a maintenance page if it is sending visitors to harmful content, and keep a copy for investigation.
- Change passwords and remove unknown admin users for the content management system, hosting, registrar and DNS, from a clean device.
- Restore from a known good backup, then apply all updates before going live again, or the same hole will be used again.
- Check Google Search Console for security warnings and request a review once the site is clean.
- Decide whether personal information was exposed, and report the incident to ASD’s Australian Cyber Security Centre through ReportCyber. Our incident response plan guide covers the first 72 hours.
When it is time to replace the site instead
If the platform is no longer supported, every update breaks something, the site is slow on phones or it fails accessibility checks across many pages, ongoing care can cost more than a rebuild. Our website and CMS migration checklist explains how to move without losing search rankings, and our guide to writing a brief and comparing quotes helps you scope the replacement.
How EITSAA can help
If nobody is sure when your website was last updated, backed up or tested, talk to us about a website care review or call 0402 401 584. We can quote a short review that checks updates, backups, forms, accounts, speed and accessibility, then gives you a prioritised list of fixes and a care schedule your team or ours can follow, with your organisation owning every account. Learn more about our website design and development and managed IT and cyber security services. Before choosing a supplier, see our guides to choosing a web designer in Adelaide, what affects the cost of a website and WordPress vs custom vs Next.js.