Maintenance is often framed as a cost. The better framing is risk reduction: fewer emergency weekends, fewer embarrassed emails to customers, and less chance of SEO damage from a hacked site serving spam.
What should every SME website have on day one?
- Backups: automated + a restore test at least once.
- Updates: cms-websites">CMS, plugins, themes, PHP—on a schedule.
- Monitoring: uptime alerts and a known support path.
- Access hygiene: unique passwords, MFA where possible, least-privilege accounts.
What does a reasonable update workflow look like for WordPress?
Stage changes when possible, update in batches, verify checkout/contact forms after updates, and keep a rollback path. If you cannot do that internally, buy a maintenance retainer—cheap hosting without care is expensive eventually.
What are early signs you have been compromised?
- Unexpected admin users or login failures spikes.
- New pages you did not create, weird JavaScript, or search console “hacked content” warnings.
- Email blacklisting or spam complaints tied to your domain.
How do you balance security with convenience?
Use MFA for email and hosting, limit plugin installs, and avoid sharing one “master password” across staff. Document who owns DNS, registrar, and hosting—so you can respond fast.
Need professional maintenance support?
See website maintenance and security on NZDH if you want a NZ team involved—this guide defines what “good” looks like.
Frequently asked questions
How often should backups be tested?
At least quarterly for most SMEs; monthly if you change the site frequently.
Is free security scanning enough?
It helps, but it is not a substitute for updates and good hosting isolation.
What is the #1 password mistake?
Reusing the same password across registrar, hosting, and email—one breach becomes total loss.
A minimum viable maintenance calendar
Weekly: verify backups completed; scan for failed form submissions.
Monthly: apply CMS/plugin updates on staging first; review admin users; check SSL expiry.
Quarterly: test restore from backup; review security headers; audit plugin list.
Annually: rotate passwords; review hosting plan; confirm domain renewal dates.
CERT NZ publishes actionable guidance at cert.govt.nz—worth bookmarking for incident response.
If something goes wrong
Isolate the site (maintenance mode), preserve logs, restore from clean backup if compromised, and rotate all credentials. Our incident response guide expands first steps. Prevention beats recovery—invest in reliable hosting and disciplined updates.
More guides in this topic
- Incident response basics: first steps if your site is compromised
- Suspicious files and permissions: what they can indicate
- Least-privilege credentials and break-glass access for owners
- Malware scans vs clean restores: picking the fastest recovery path
- Security headers beginners should know (high-level)
Browse the full Security & maintenance guide hub or return to the guides home.
Explore on NZDH.co.nz
- All practical guides
- Website design services
- SEO services
- Recent website projects
- Frequently asked questions
- Web hosting — NZ-friendly hosting with support that answers clearly
Authoritative further reading
These independent resources complement this guide. Search engines and customers both reward accurate, helpful information—we link out where official documentation or regulators explain the topic better than a generic blog post could.