It’s always been true that websites need maintenance from time-to-time. The amount and frequency depending on lots of factors: the site’s technology stack, frequency of new features and design tweaks, etc.
One of the predictable and disappointing harms of broad LLM-use is a new pace of security issues. The PHP vulnerability from October 2026 is one recent example, but there are plenty of other vulnerabilities being discovered and exploited.
I’ve always encouraged clients to take a pragmatic view of support and maintenance. For marketing sites developed on a flat-file content management system, occasional/major version updates have often been sufficient.
I still believe in taking a sensible approach to maintenance, but it would be remiss of me not to acknowledge that things are a little different now.
At the time of writing, I’m recovering a hacked site that was on a reasonably recent version of its content management system. Previously, this would probably have been fine, but not today.
It’s important to say there’s no such thing as total security when it comes to websites. But keeping website and security software up-to-date is one of the best ways to prevent a site becoming vulnerable.
Doing this work on a regular cadence means that updates are small, and reduces the chance of a large, unexpected bill.
Practical support at an accessible price
Maintenance costs £400 per year and it works on a time bank model.
What does that mean? You’re buying four hours of work per year that covers:
4x content management system updates each year that you don’t need to schedule or worry about
You can email me small requests at any point
If we use those four hours before the year is over, we can start a new block of hours
This package is designed to strike a balance between being small enough to reduce vulnerabilities, without being prohibitively expensive.
If your site is running an old version of the content management system, we may need to set aside some time to get that updated first.
This package is exclusively for existing clients.
What if I don’t do this?
This package is meant to be a proactive measure to keep sites up-to-date and reduce security risks. But there are plenty of cases where not doing this is a totally fine and reasonable decision to make.
For simple marketing sites, an exploit could mean:
Troubleshooting and assessing the situation
Updating the site to the latest content management system version
Redeploying the site
Possibly deploying a new server if the current one is unsalvageable (which could be more expensive, thanks also to AI)
Impacts from the exploit itself: reputational, email issues, fraud, SEO
I’ll always do my best to make myself available for situations like this, but I might not have immediate availability.
It’s difficult to predict exactly what the situation might be: it could be that nothing happens or an exploit results in some inconvenience and an unexpected bill, but not the end of the world.