Website Maintenance & Support

Website Maintenance Services

Nothing about an unmaintained website tells you it is unmaintained until the week it costs you something. That is the whole problem with the category: the failure is silent right up until it is expensive, and the fix — patches applied before the exploit window opens, performance watched as an operating number rather than an annual audit, updates staged and tested instead of deferred — is invisible when it works. Facet runs website maintenance services as a continuous Agent Loop rather than a ticket queue, and the first site we ran it on was our own. The page you are reading is served from a property under that loop, on that patch cadence, producing that cycle report at the end of every month. You can ask to read ours before you buy yours.

How could AI agents run your site's maintenance? Book a site audit — bounded, run on your real environment, with a written findings report at the end.

We are the first client of this service

Facet is a web firm. Our own sites, our division sites, and the client environments we already operate run on the same loop this page describes — Pantheon-hosted, on the same advisory feeds and the same staged-deploy discipline. That is not a positioning line; it is the reason the audit you get is worth reading. The checklist we run against your environment is the one we run against ours, and the failure modes below are ones we hit first, on our own properties, where being wrong cost us rather than a client.

• Agents carry the volume; a named Facet engineer approves every production deploy. Nothing reaches a live site because a loop decided it was fine. The loop's job is to make the decision cheap and well-evidenced, not to make it alone.
• We name the failure modes because we have caused them. An agent handed "keep this current" with no boundary will take a major version bump when a point release was the fix, and spend a week on a migration nobody asked for. A monitoring loop tuned to catch everything trains your team to ignore it inside a month — alert fatigue is a configuration defect, and it is the most common one in this category.
• You get the record, not a reassurance. Every pass the loop makes is logged, including the ones that found nothing. That log is what separates a maintained site from a lucky one, and it is the part of this service most providers do not hand over.

What the loop actually does

Four passes run continuously against your environment. Each is here for the same reason: high volume, mechanically checkable, and almost always fine — which is exactly the work a person does badly and a loop does well.

• Match published advisories against your actual dependency inventory. Not "there is a WordPress vulnerability this week" but "CVE-2026-XXXX affects the version of this module you are running, on this site, on this environment." Most days this pass matches nothing. That is precisely why nobody was doing it by hand.
• Stage every update and test it before production. Build the candidate on a clone, run the regression pass, diff the rendered output, check the critical paths still work. Human attention does not survive the two-hundredth visual diff at the quality it brought to the first, and pretending otherwise is how a staging step becomes a formality.
• Watch the numbers, continuously. Core Web Vitals against your own baseline rather than a generic threshold, uptime, error rates, certificate expiry, database growth. A daily check that almost always finds nothing could never justify a salary, which is the only reason it was not already being done.
• Write the record as it goes. Every check, every patch, every deploy, every rollback, timestamped. The monthly cycle report is assembled from that log rather than composed for you at month end.

What a person still decides

Everything the loop reports arrives without a severity attached. Attaching one — urgent, scheduled, or safely ignored — is yours, and it is agreed in writing before the loop starts escalating against anything.

• What "broken" means for your business. A loop can tell you a page returns a 500. Whether that page is a legal disclaimer nobody visits or the form your entire pipeline arrives through is a business fact, and it sets the severity ladder the loop escalates against.
• Whether to take the major version. A point release is maintenance. Drupal 10 to 11, or a PHP runtime jump that half your modules have not certified against, is a project with a budget and a date. We will tell you which one you are looking at; you decide when it happens.
• What is worth fixing at all. Some findings are real risks. Some are a linting opinion about a template nobody has edited since 2021. Ranking them is a judgment call about your business, not a severity score.
• Every production deploy. A Facet engineer signs off, and on anything with customer-facing consequence, so do you.
• Whether the site should be maintained or replaced. Sometimes the honest answer from an audit is that the platform underneath is the problem and maintaining it is paying rent on a decision that should be reversed. That finding costs us a retainer, and we still write it down.

The cost of patch lag, on your own numbers

For operators who want the arithmetic before the argument. The figures below are illustrative — the shape matters, the numbers are yours to replace.

(Illustrative scenario.) A professional services firm runs a site averaging 800 visits a week. A plugin vulnerability disclosed four weeks earlier is exploited on a Tuesday. Search flags the domain and drops it by Thursday. The site is restored in five days; organic position takes roughly six weeks to come back. At an illustrative $35 average lead value and a 2.1% conversion rate, that stretch represents on the order of 56 leads and $1,960 of pipeline — before the emergency remediation invoice, and before the clients who reached a browser security warning instead of your contact form.

Re-run that with your own traffic, your own lead value, and your own close rate. The number that does the work is not the total — it is patch lag, the distance between "advisory published" and "patch applied on your site." It is measurable today, on your environment, whether or not you ever call us.

A site under a running loop and a site without one do diverge. The mechanism is the patch cadence and the regression gate, though — not the passage of time. A patched site and an unpatched one look identical on the day the advisory drops. They stop looking identical only because somebody staged the patch, ran the regression gate and pushed it — a person's action on a stated cadence, not a property of the loop existing. That action is what the fee buys, and patch lag is how you audit whether you are getting it.

What is included

Security. Advisory monitoring against your dependency inventory, patches applied on a stated cadence rather than at a quarterly maintenance window, malware detection and remediation, certificate monitoring, login hardening, file permission and firewall review.

Updates. CMS core, module, plugin and theme updates staged and regression-tested before production. Dependency conflict detection before a conflict becomes a visible error. A rollback protocol on every deploy, tested rather than assumed.

Performance. Core Web Vitals monitored weekly against your baseline, image and caching configuration, database query analysis and cleanup, hosting environment health checks. The monthly report shows the delta, not a snapshot — a single number tells you nothing about direction.

Availability. Uptime monitoring with sub-minute alerting, triage and escalation on detection rather than on your phone call, and a post-incident note naming the cause and the prevention step. Facet's team of 40 spans 9 timezones and 6 continents, so a 2am alert in Sydney is inside someone's working day.

Scope and pricing. Engagements begin at $6,000 and scale with site complexity, environment count and support tier. We quote after the audit, because we have inherited "simple" sites with eighty plugins and no staging environment, and genuinely low-complexity enterprise installs. The audit is where honest scoping happens.

What we will not promise. A traffic lift, a ranking improvement, or a conversion increase as a direct output of maintenance. Search responds to variables that do not live in your codebase. We will tell you what ran, what changed, and what the numbers did — every cycle.

Where this sits on the ladder

Website maintenance is the run layer applied to one system. The same pattern scales.

• AI Managed Services — the run layer generalized. A named Facet team keeps your systems earning as data, integrations and goals move, not just your website.
• Agentic Engineering — the build layer, for when the audit finds that the thing needing attention is the application rather than its patch cadence.
• Agentic Operating System — the same loop discipline installed across every operating area, reviewed monthly.

A site under a clean maintenance loop and no further engagement is a complete outcome, and we will say so if it is the right one.

FAQ

How much do website maintenance services cost?

Engagements begin at $6,000 and scale with site complexity, environment count (staging, production, multisite), platform, third-party integration surface, and support tier — business hours against 24/7 incident response. We quote after the site audit rather than before it, because the variance between two sites that look alike from the outside is larger than the variance between platforms.

Do you only maintain sites you built?

No, and most engagements are not. A significant share start with a site built by another agency or an internal team that has since moved on. The audit exists to document what we are inheriting — technical debt, security gaps, undocumented customizations — before we commit to an SLA. We are direct about what we find, including when what we find changes the price.

What is the difference between managed hosting and website maintenance services?

Managed hosting — WP Engine, Pantheon, Kinsta — owns the infrastructure layer: server uptime, PHP version availability, platform backups, CDN. It does not own plugin compatibility testing, custom code updates, remediation when your own theme introduces a vulnerability, application-layer performance work, or the judgment calls that come with operating a living system. This service runs at the application and business-logic layer on top of whatever host you are on, including Pantheon, which we use for our own environments. They are complementary, and a provider telling you otherwise is selling one of the two.

What happens when something breaks at 2am?

Detection triggers triage, not a voicemail. The loop escalates against the severity ladder you set during scoping, a named engineer picks it up, and you get a post-incident note with the cause and the prevention step. Our team spans 9 timezones, which is the unglamorous reason overnight response is a rota rather than a heroic.

On this service, the report is the product

Maintenance is the only work you buy whose entire successful output is an absence. Nothing broke. Nobody called. Search did not flag you. And an absence is indistinguishable from luck — which is why a site can go two years unmaintained and its owner can be completely certain it is fine, right up until the Tuesday it is not.

A ticket queue cannot resolve that, because a ticket is generated by a failure. A queue's complete record is a list of the times something went wrong; it has nothing to say about the weeks it went right, and no way to tell you whether that was the work or the weather. A loop produces the opposite record: every check that found nothing, logged, with a timestamp and a version number against it.

That record is the deliverable. It is what makes a quiet month evidence rather than a hope, it is what a new CTO reads on day one to find out what they have inherited, and it is the thing you should ask any maintenance provider for before you sign — ours included.

How could AI agents run your site's maintenance? Book a site audit: bounded, run on your actual environment, with a written findings report at the end — security posture, performance baseline, dependency and patch-lag inventory, and a ranked remediation list. We will show you a cycle report from our own loop in the same session, so you know what the monthly output looks like before you commit to it. If the audit finds your site is simple enough and your host already covers what you need, we will tell you to stay where you are. Either way you leave with a useful technical document.