A website launches, everyone is pleased, and the person who built it moves on to the next job. Two years later the site is slow, a plugin has not been updated since the launch, the contact form stopped sending in March and nobody noticed, and the hosting bill goes to an inbox that no longer exists.
None of that is unusual. A website is software, and software needs looking after. Here is what that looks like when it is done properly.
Updates, then checks
WordPress core, the theme and every plugin get updates, and so does the framework under a custom site. Applying them is the easy part. The work is checking afterwards: pages load, forms send, checkout works, nothing has shifted. An update applied and not checked is how a site breaks on a Saturday and stays broken until Monday.
Nightly backups, kept elsewhere
Files and the database, every night, stored off-site, with a restore tested so that a bad update or a hack is a rollback rather than a rebuild. A backup that lives on the same server as the site is not a backup.
Uptime watched every minute
If the site goes down, someone should know before the customers do. A check every minute from outside the network does that. Our own status page runs on the same checks we use for client sites.
Security kept tight
Admin accounts tidied up, two-step sign-in on, abandoned plugins removed, a firewall in front. Sites we host sit behind Cloudflare Enterprise. The common hacks go through old plugins and weak admin logins, and both are maintenance, not magic.
Speed measured, not guessed
Caching, image sizes and the one plugin that is slowing everything down. Measured before and after a change, so the improvement is real.
Small changes, done by a person
A new team photo. A price change. A holiday notice. A new page from your copy. Nobody in a small business wants to learn the editor for one change a month. Send it to the help desk and a person does it, then tells you it is done.
Forms, mail and integrations
Contact forms that actually deliver. Booking widgets that work. The payment, CRM and newsletter connections kept alive when a provider changes something. These break quietly, and a form that has been failing for three months has cost you three months of enquiries.
Domain, DNS and certificate
Renewals tracked, DNS managed, the certificate renewing on its own. Nothing lapses on a Sunday.
The signs a site is not being cared for
The copyright year in the footer is two years old. The last blog post is from the launch. A browser warning about the certificate appeared once and someone clicked past it. The contact form has not produced an enquiry in months and nobody is sure whether that is the market or the form. Each is a small thing. Together they are a site nobody is responsible for.
Why it costs less than the alternative
A hacked site costs a rebuild, a week of lost enquiries and a conversation with customers about why the site was serving spam. A broken form costs the enquiries you never saw. Care is a small monthly amount against both.
Honest advice when the site is beyond care
Sometimes the right answer is that the site is too old, too broken or too slow to keep patching, and a rebuild would cost less than another year of care. A good provider says so and shows you the numbers, rather than charging to keep a lost cause alive.
For sites we did not build
Website care is not only for ALCO-built sites. A site built elsewhere can be brought under care. It starts with a review of hosting, updates, backups, security, speed and plugins, a short written report and a price. The urgent fixes come first: out-of-date software, missing backups, open admin accounts. Then monitoring goes on, backups run, and the help desk is ready for changes. Every month you get a short note: uptime, what was updated, what changed.
The scope is at https://alcohq.com/services/website-care and the sites we look after are at https://alcohq.com/work
If your site has not been touched since it launched, the review is the place to start. Most of what it finds is cheap to fix now and expensive to fix later.