Website Maintenance and Support

A site nobody updates drifts out of shape quietly. Plugins fall behind their releases, TLS certificates come up for renewal, dependencies pick up published vulnerabilities, and the PHP or Node version your host runs reaches end of life. None of that announces itself in advance. The first signal is usually a broken form, a warning email from the host, or a customer who cannot finish checkout.

An ongoing retainer moves that work onto our calendar. We keep updates tested and reversible, keep backups you can restore from without guesswork, and absorb the small changes that come up between projects. You get a written record of what changed and what needs a decision.

What an ongoing retainer covers

A retainer is a block of engineering time each month, spent on the health of a site we built or took over. In practice it covers:

• Core, plugin, and dependency updates, applied to staging first and released once the checks pass
• Security patching, including emergency patching when a widely exploited advisory lands, which for WordPress plugins happens most months
• Backups on the schedule we agree, plus a restore drill at least once a year so the archive is proven instead of assumed
• Uptime and error monitoring, with alerts routed to a channel your team already watches
• Small content and code changes: a new page, a price update, a form field, a banner, a redirect
• A monthly report listing what was updated, what was monitored, and what needs your input

Larger work rolls into a planned piece quoted separately, either at our hourly rate or as fixed scope once we understand it. The pricing page explains both models.

Who this suits, and who should skip it

A retainer fits a site that carries revenue or risk. Online stores, booking systems, client portals, and content sites that publish often all belong here. So do sites on platforms where updates matter, which is why much of this work sits inside WordPress development.

Some sites do not need a monthly retainer, and we say so. A static site on a CDN has no plugins, no database, and no server to patch, so most of the monthly checklist has nothing to act on. We built those sites for exactly that reason, and you can see how one behaves on the zero-maintenance static website page. If your site falls into that group, we will offer a small block of hours to use when a change comes up rather than a standing fee. Charging for upkeep a site cannot use takes your money and leaves us with nothing useful to report.

How the engagement runs

We start with an audit rather than an invoice. The audit covers the platform and version, the dependency tree, plugin or package licensing, where backups go today, whether a staging environment exists, and who holds access to the domain, hosting, and any third-party accounts. Clients regularly discover that only a former developer can log in to something important.

Month one usually ends up as cleanup: a staging environment, backups stored off the host, monitoring wired in, a documented update policy, credentials moved into a shared password manager with two-factor authentication.

From month two the cadence is steady. We pick an update window that matches your traffic, apply changes to staging, check the pages and forms that matter, then release. Anything that fails is rolled back and the upstream fix is tracked. At month end you get the report.

Response times, and what we promise

Response time and fix time are separate commitments, and confusing them causes most of the arguments in this kind of work. We agree a response window per severity:

• Site down or checkout broken: acknowledged within two business hours
• Security incident or suspected data exposure: acknowledged the same business day
• Standard content or code change: scheduled into the next working window, usually within two to three business days
• Advisory questions: answered in the monthly report or by email

An acknowledgement means a person has read the report, given you a plan, and told you what the fix involves. We do not promise a fix time for a problem nobody has diagnosed yet. If you need 24/7 coverage with a contractual fix window, say so during scoping so we can answer honestly about whether we can staff it.

What is billed separately

Work outside the monthly block is quoted before it starts. The usual candidates:

• New features, new integrations, redesigns, and platform migrations
• Recovery of a site that was already compromised before the retainer began, which is handled as security audit and malware removal
• Content writing, photography, translation, and design assets
• Third-party costs such as hosting, CDN plans, premium plugin licences, backup storage, and domain renewals, billed by the vendor to your account
• Performance projects such as Core Web Vitals work, quoted as a project and described under website speed and performance optimization
• Sites with no source access and no workable staging path. We will say so in writing before you sign anything.

What a retainer is not

Monitoring reduces surprise, and it does not prevent every outage, because data centres have bad nights like any other piece of infrastructure. The monthly block is finite, and the report shows the hours used so you can see whether the size is right. Patching keeps a healthy platform healthy; a site running on an abandoned theme or an unsupported framework will keep producing emergencies, and when repairs start costing more than a rebuild we will tell you. Hosting stays in your name and on your account, since we manage the site rather than resell server space.

What it costs

Retainer work runs at our flat rate of $39 per hour, with the monthly block sized to the site. A small content site with a handful of plugins typically needs two to four hours a month. An online store with payment integrations, custom code, and active marketing changes needs more, and we will estimate that from the audit instead of guessing. Month one cleanup is usually a short project measured in weeks.

Monthly capacity plans from $2,699 are a different product, meant for teams that need sustained engineering time across a product line rather than site upkeep alone. The pricing page sets out the hourly rate, the monthly plans, and the published typical order budgets.

Proof

design.vasilkoff.com is our own designer portfolio, built static on Next.js and hosted on Vercel as a fixed-scope project. It has run since launch without a maintenance call, which is the reason we do not sell a retainer for sites built this way.

Vasilkoff.info is our AI estimator and support application, where the marketing pages stay static while the estimator logic, chat service, and the Vanilla JS and React widget packages need dependency and API upkeep. It sits on the other side of the line: a live service with moving parts, which is what a retainer is for.

Related services

• Web development for building or extending the site the retainer looks after
• WordPress development for plugin-heavy sites, where updates carry the most risk
• Security audit and malware removal if the site is already compromised
• Website speed and performance optimization for Core Web Vitals and caching projects
• Zero-maintenance static website and vibe-coded app rescue when ongoing upkeep is the wrong answer

Next step

Send us the site URL, the platform it runs on, and how often the content changes. We will tell you whether a retainer makes sense for it, what block of hours fits, and what month one would involve.

Contact us with the details, or run the site through the Vasilkoff.info estimator for a first scope and cost range before you talk to anyone.