Your website is live. So who's actually running it?

There is a particular moment most business owners will recognise. The new website is finished. It looks far better than the old one, the build agency has been paid, and there is a collective sense of a job completed. The site is, as everyone keeps saying, live.

Then nothing happens to it for two years. Not deliberately — nobody decides to neglect it. It simply falls between the cracks. It is no longer a project with a budget and a deadline, and it is nobody's actual job, so it sits there, slowly drifting out of date and out of repair, until the day it breaks somewhere visible or someone finally notices that the contact form has not produced an enquiry in a month.

A website is a system, not a project

The root of the problem is a category error. A website build is a project: fixed scope, fixed price, a start and an end. The website itself is not a project at all. It is a piece of operational infrastructure that runs continuously, exposed to the public internet, dependent on software that updates constantly and on a business that keeps changing underneath it.

The day after go-live, your site begins to drift from the state it launched in. The platform it runs on issues updates. The plugins and components that make it work issue their own updates, on their own schedules, some of them weekly. Browsers change. Google changes what it rewards. And your business changes — you take on new people, retire old products, move premises, adjust prices — while the website carries on telling last year's story to everyone who visits.

Treating launch day as the finish line is the mistake. It is the start line. Everything that determines whether the site keeps earning its keep happens afterwards, in the unglamorous business of keeping it current, secure and working. That work has a name — website management — and for most mid-market businesses, nobody is doing it.

A website is not a project that finishes. It is a system that runs — and the day you stop running it is the day it begins to decay.

What website management actually involves

"Managing a website" sounds vague, which is part of why it gets skipped. So here is the substance of it, layer by layer. None of it is glamorous. All of it matters.

Hosting and uptime. Your site physically lives on a server somewhere. The questions that matter are whether anyone is watching that server, what happens when it goes down, and how quickly. Plenty of businesses discover their site has been offline only when a customer rings to tell them. Monitoring that checks the site every few minutes and alerts a human is the difference between a five-minute outage and a five-day one.

Updates and security. The most common platforms power an enormous share of the web, and that popularity makes them a target. The single most common way a business site gets compromised is an out-of-date plugin with a known vulnerability that was never patched. Updates need applying — but applied carelessly, an update can break a site as easily as a hacker can. The discipline is test-then-apply: update in a safe copy first, check nothing has broken, then push it live. Click-and-hope is how you turn a routine task into an outage.

Backups. Everyone assumes they have backups. Fewer can answer the questions that count: when was the last one taken, where is it kept, and — the one that catches people out — has anyone ever actually restored from it? A backup you have never tested is a hope, not a safeguard. The measure of a good backup regime is not that the files exist; it is how fast and how cleanly you can get the site back when you need to.

Performance. Speed is not a vanity concern. Visitors leave slow sites, and search engines quietly favour fast ones, so a sluggish site loses you traffic at both ends. Performance also degrades over time on its own, as content accumulates, images pile up and each new plugin adds a little more weight. A site that loaded quickly at launch can be noticeably slower two years later without anyone having done anything wrong — just by being lived in.

Content. The least technical layer, and often the most neglected. Prices that are no longer right. A team page listing people who left in 2023. A "latest news" section whose latest item is eighteen months old. Case studies that stop before your best recent work. Every one of these tells a prospective customer that the business is either not paying attention or not doing much — neither of which is the impression you want to give someone deciding whether to call.

SEO maintenance. Not campaigns — the housekeeping kind. When a page moves or is removed, it needs a redirect, or you leave visitors and search engines hitting dead ends. Broken links accumulate. Indexing drifts. This is the quiet structural upkeep that keeps a site findable, and it decays steadily if left alone.

Accessibility and compliance. Cookie consent, a current privacy policy, and a site that works for people using assistive technology are no longer optional niceties. They are a legal and reputational matter, and the bar keeps rising. A site built to the standards of three years ago may not meet today's.

Analytics and monitoring. Finally, knowing whether any of it is working. Are enquiries arriving? Does the contact form actually deliver? Which pages turn visitors into leads, and which lose them? Without this, you are flying blind — and, as we will come to, blindness here has a specific and expensive failure mode.

The real cost of a neglected site

It is worth being concrete about what neglect costs, because the costs are mostly invisible until they are not.

The one that does the most quiet damage is the broken contact form. A configuration changes, a plugin updates, an email setting lapses — and enquiries stop being delivered. The site looks completely normal. Nothing is visibly wrong. And here is the trap: the absence of enquiries looks exactly the same as a quiet month. So the form can swallow leads for weeks before anyone joins the dots, and by then you have no way of knowing who tried to reach you, or what they would have been worth.

The absence of enquiries looks exactly the same as a quiet month — which is why a broken contact form can cost you for weeks before anyone notices.

Then there is the slow bleed. Page speed creeps up, conversion creeps down, and because it happens gradually there is no single moment that prompts anyone to act. You simply do a little worse than you should, indefinitely.

There is the public failure: the hack, the defacement, the warning Google shows next to your listing telling visitors the site may be compromised. For a business whose buyers check you out online before they ever make contact, that is reputational damage at precisely the wrong moment.

There is downtime when it matters most — the site falling over during a trade show, a campaign, or a burst of press attention, exactly when the traffic you have worked to attract arrives to find nothing there.

And there is compliance exposure, which sits quietly in the background until a complaint or an audit brings it sharply into focus.

None of these are exotic. They are the ordinary, predictable consequences of running a piece of infrastructure without maintaining it. The reason they keep happening to good businesses is not carelessness. It is that no single person was ever clearly made responsible.

Who should own it — four common arrangements

In practice, ownership of a website tends to land in one of four places. Each can work. Each has an honest downside worth knowing before you settle on it.

The original build agency, ad hoc. You go back to whoever built it when something breaks. This feels economical because you pay nothing in the meantime. The catch is that it is purely reactive: there is no one watching the site, nothing is being prevented, and when you do need them you join a queue and are billed by the hour to fix a problem that maintenance would have stopped. Their incentives and yours are not aligned.

A freelancer. Often genuinely capable and good value. The risk is concentration. One person means one point of failure — and if they get busy, go on holiday, take on a bigger client or simply move on, you can find the site down and the only person who understands it unreachable. If you have been let down this way before, you already know the feeling, and you know it tends to happen at the worst possible time.

An internal hire. Usually this means the marketing person, or whoever is nearest, absorbs the website on top of their actual job. They are stretched, rarely a specialist across every layer above, and when they leave they take the knowledge with them. The whole thing rests on one person who was never really resourced to do it, which is fine right up until it is not. It is worth asking honestly whether one hire can realistically cover the whole job.

A managed retainer with a team. Someone is accountable, the site is monitored, updates and backups happen on a schedule rather than in a panic, and there is more than one person who understands how it all fits together. It costs more month to month, and the honest downside is precisely that: you are paying a steady amount for something that, when it is done well, looks like nothing happening. The value is in the absence of incidents — which is real, but quiet.

There is no universally right answer. A simple brochure site that rarely changes can sit safely with a trusted freelancer. A site that generates meaningful enquiries, handles any data, or would genuinely hurt the business if it went down for a day deserves something more robust than goodwill and a phone number.

What "managed" should actually mean

If you do decide the site warrants proper management, the word "managed" gets used loosely, so it is worth knowing what to insist on. Real management means:

It is proactive, not reactive. The site is monitored, updates are scheduled and tested, and problems are caught and fixed before you ever see them — rather than the arrangement waiting for you to report a fault you may not even know how to spot. This is the line between maintenance and support, and a good arrangement covers both.

There are defined response times. When the site is down, you know how quickly someone will be on it, because it is written down, not left to whoever happens to be free.

Backups are tested and recovery is a known quantity. Not "we take backups" but "we have restored from them, and here is how long it takes."

The reporting is in plain English. You should be told, in language you can act on, what was done and what it protected you against — not handed a technical log, and certainly not handed nothing.

And someone owns it. A name, not a ticket queue. The single most useful thing any arrangement can give you is a person you can point to when you ask who is responsible for the website, and get an answer.

This is the work we do for clients, and it is worth being plain about why: not because website management is exciting, but because for an established business the site has usually become a real source of enquiries, and a real liability if it fails. It deserves to be run like the operational asset it is.

A ten-minute diagnostic

You do not need a technical audit to find out where you stand. Sit down and answer these honestly. If you cannot answer one, that gap is itself the answer.

1. If your site went down at nine o'clock on a Friday evening, who would notice — and how would they find out?
2. When did someone last apply updates to the site, and were they tested before going live or simply pushed?
3. When were your backups last actually restored, rather than merely taken?
4. Right now, go and submit your own contact form with a test message. Did the enquiry arrive in the right inbox?
5. Who, by name, is responsible for the website? Not who built it — who runs it.
6. When was the content last reviewed for prices, people and products that have changed?
7. How fast does your homepage load on a phone, on mobile data, away from your office wifi?
8. Is there a current privacy policy and working cookie consent, reviewed against today's rules rather than the year it launched?
9. If the person who knows most about your site left tomorrow, what would you lose?
10. Can you see how many enquiries the site produced last month — and would you notice if that number quietly fell to zero?

If those questions made you uncomfortable, that is useful information. It means the site is running on luck, and luck is a poor maintenance strategy for something that has become part of how the business brings in work.

A website is not a thing you build and own. It is a thing you run. The businesses that get the most from theirs are not the ones with the flashiest sites — they are the ones who decided, deliberately, who was going to look after it, and then made sure that person actually did.

If you are not sure who that is for your business, it is worth a conversation before something forces the issue. Thirty minutes, no pitch deck: hello@ninestones.co.uk.