Website maintenance and security for a Kenyan business

Maintenance covers more than software updates

A maintained website still sends enquiries, loads current information, keeps recoverable backups and limits access to people who need it. Updating a plugin while the contact form has been broken for six weeks is not enough.

Split the work into routine checks, planned changes and incident response. Routine checks catch expiring domains, failed backups and stale user accounts. Planned changes cover content and software. Incident response says who acts when the website is unavailable or altered.

Patch with a rollback available

Keep the content system, framework, plugins and server packages within supported versions. Read release notes for changes that affect the site. Test bigger updates on a staging copy when the website handles payments, customer accounts or business-critical forms.

Take a usable backup before risky work and know how to restore it. Automatic updates can reduce exposure for small fixes, but they do not remove the need to check the website afterwards. Open the main pages and complete the primary customer action.

Back up the parts needed for recovery

A website may depend on code, a database, uploaded files, environment settings and outside storage. A backup of one folder may miss orders or media. Document what must be restored and in which order.

Keep at least one copy outside the live hosting account. If an attacker or billing fault removes the account, a backup stored only there can disappear with it. Run a restore test on a safe environment. An untested backup is a promise, not proof.

• Database and uploaded media

• Code or deployment source

• Environment and service configuration

• DNS zone and domain account details

• A written restore procedure

Review access when people change roles

Give each administrator an individual account. Use multi-factor authentication on the registrar, hosting, email, repository, cloud and payment accounts. Shared passwords make it hard to remove one person or understand who changed a setting.

Review access after a staff departure, agency handover or device loss. Remove accounts that are no longer needed and rotate exposed secrets. Do not send production credentials through ordinary group chats.

Check the customer paths

Submit every public form and confirm that the message reaches a monitored inbox. Test phone and WhatsApp links on mobile. For shops, place a controlled order and check payment status, stock changes and confirmation messages.

Watch for silent failures. An email provider may reject mail while the page still displays ‘Thank you’. A payment callback may fail while the customer sees a completed browser screen. Server-side records and alerts catch faults the front end hides.

Monitor what matters

Track uptime, server errors, failed background jobs and certificate expiry. Review logs for repeated login attempts or unexpected admin changes, but avoid collecting personal data with no business reason. Keep log access restricted.

Set alerts to reach a person who can act. Fifty routine emails a day train staff to ignore the one real incident. Alert on sustained downtime, repeated failures and events that threaten orders or customer access.

Use a short maintenance calendar

Weekly, check forms, backups and visible errors. Monthly, review updates, user access, performance and the most important pages. Quarterly, test a restore, inspect account ownership and review content that affects prices, services or policies.

Adjust that rhythm for the site. A shop taking orders all day needs closer payment and stock monitoring than a small brochure site. Write down who owns each check. ‘The developer handles it’ is not a maintenance plan unless the contract says exactly what that means.

Related guides

Read next: Website maintenance in Kenya

Read next: Website redesign service

Read next: Discuss a maintenance plan