Key takeaways
- Security patching is the floor of maintenance, not the ceiling — dependency scanning needs a defined response time.
- Monitor uptime from outside your own infrastructure; an application cannot reliably report that it has stopped working.
- A small recurring allocation to performance and conversion work is far cheaper than the same work delivered as emergency scope.
A web application that sells, processes orders or handles customer data is not finished at launch. It is entering the phase where the cost of neglect grows faster than the cost of attention.
Security Patching Is the Floor, Not the Ceiling
- Framework and dependency updates applied on a schedule, not reactively
- Dependency vulnerability scanning with a defined response time
- Regular review of access permissions as teams change
- Backup restores actually tested rather than merely configured
Performance Monitoring
Performance degrades gradually — usually through accumulated data, growing query volume and third-party scripts. By the time a customer complains, the regression is weeks old. Monitoring with thresholds and alerts catches it while the cause is still fresh.
Uptime and Incident Response
Uptime monitoring should be external to your own infrastructure, since an application cannot reliably report that it has stopped working. Response commitments matter more than the headline percentage: define what happens at 2am on a Sunday when checkout fails.
Content and Data Integrity
- Catalogue and content accuracy reviewed on a schedule
- Form submissions and transactional email delivery monitored
- Redirects checked after any structural change
- Analytics implementation verified after plugin or theme updates
Proactive Improvement
The most valuable part of maintenance is work that prevents future effort rather than responding to present problems. A small recurring allocation to performance, accessibility and conversion improvements is considerably cheaper than the same work delivered as emergency scope later.
Maintenance is not the cost of keeping software alive. It is the cheapest point at which to keep it improving.
Frequently asked questions
What does web application maintenance include?
A credible scope covers security and dependency updates, uptime monitoring with a defined incident response, backup restores that are actually tested, performance monitoring, and a small allocation of proactive improvement. Maintenance covering only security patches is underdelivery for an application that handles customer data or transactions.
How much does web application maintenance cost?
It depends entirely on the application, its hosting and the response commitment you buy. A simple marketing site needs very little, while a transactional application needs monitored uptime, tested restores and a guaranteed response time. The meaningful comparison is between a retainer and the cost of an outage or emergency rebuild, not between providers in isolation.
How often should a web application be updated?
Security and dependency updates should run on a fixed schedule rather than reactively — for most applications monthly is a reasonable baseline, with critical vulnerabilities patched immediately. The cadence should be written into the maintenance agreement so it is a commitment rather than an intention.
Do we need a maintenance retainer after a website launch?
If the site generates revenue or handles customer data, yes. After launch it accumulates updates, growing data and third-party changes that quietly degrade performance and reliability. Without maintenance, the realistic choice becomes a larger and more expensive rebuild within a couple of years.
Written by Immortify Digital, support and maintenance team at Immortify Digital.
The engineers who monitor, update and improve the web applications we have launched for clients.
