Website Maintenance for UK Stores and B2B Sites, With Every Update Tested First

The baseline is keeping the platform, theme and add-ons current, plus backups, security checks and fixes when something breaks. For a UK business site that takes orders or leads, we add tests of forms and checkout after every update, checks that the links to Xero, Sage, Linnworks or your courier still post correctly, speed checks on real pages, and a written log of every change that month.

If it earns money, yes. Software around your site changes every month whether you touch it or not. PHP 8.2 loses security support on 31 December 2026, and Shopify ships a new API version every three months. A site left alone for a year usually has a backlog of updates that are riskier to apply all at once.

The words overlap, and UK agencies use them loosely. Maintenance usually means keeping the site safe and working: updates, backups, security and fixes. Management often adds the work of changing the site: new pages, content, campaign landing pages and reporting. Ask any provider for a written list of tasks. The list tells you more than the name of the plan.

On most UK business sites, three parties share it. The host runs the server. The owner or an in-house marketer edits content. A developer or agency handles updates, code and integrations. “Webmaster” is an older name for one person doing all three. Whoever does it, put the split in writing, so a failed update or a broken Xero sync has a named owner.

At least once a month, with urgent security fixes going out sooner. Cyber Essentials sets 14 days for fixes to critical or high-risk flaws. Plugin and theme updates, a backup restore test and a traced test order fit a monthly cycle. Bigger jobs, such as a PHP upgrade, are planned a few times a year around your trading calendar.

A care plan is a monthly maintenance service sold as a named package, often with tiers. Cheaper tiers are mostly automated updates and backups. Higher tiers add developer time, testing and change requests. The useful questions are whether updates are tested on a copy of the site before going live, and whether anyone ever restores a backup to prove it works. If both happen every month, it is worth paying for.

Yes. We start with a takeover check: who owns the domain, hosting and licences, what is installed, which systems the site talks to, and what is out of date. You get that list in writing, with urgent items marked, before any monthly work is agreed.

Start with what is in your company’s name. The domain registrar, the hosting account and any paid plugin licences can usually be recovered by the account holder through the provider’s own support, with proof of ownership. We help you work through each one. Where an account sits in the old agency’s name, we plan a move to a new account in yours.

Rattlesnake, a London studio, sampled 15 UK providers in August 2026 and found entry care plans at £15 to £59 a month, managed business care at £60 to £149, and ecommerce or advanced CMS care at about £100 to £250 a month or a custom quote. Those are market figures, not our prices. VAT treatment varied between providers in the sample.

In Rattlesnake’s August 2026 sample of 15 UK providers, care for stores, memberships and integrated platforms sat at about £100 to £250 a month or a custom quote, and development retainers for revenue-critical sites at £149 to £379 or more. Stores cost more because checkout, payments and stock sync need testing after every update. Each system the store talks to adds work.

Both, which is why like-for-like comparison is hard. In Rattlesnake’s sample of 15 published plans, some providers quoted plus VAT, one included it and several did not say. At the standard 20% rate, a £79 fee before VAT becomes £94.80. Ask every provider for a figure that states VAT either way before you compare.

Because the plan includes more than maintenance. Red Evolution, a UK agency with offices in Aberdeen, Edinburgh and London, puts basic website management at £50 to £300 a month and full management at £500 to £2,000 or more, where the higher figure adds SEO, content, analytics and ongoing development. Check which of those you need before paying for all of them.

There is no FactoryJet rate card on this page, because two sites on the same platform can need different care. After a free check of your site, FactoryJet quotes the takeover work and any ongoing support you choose as fixed prices in writing. Changes outside that scope are quoted and approved one at a time, with no monthly minimum for work you do not use.

Yes. WordPress maintenance and WooCommerce care take the most work, because plugins are the usual way in for attackers and the usual cause of a broken checkout. WordPress.org recommends PHP 8.3 or newer, and says PHP 7.4-era versions have reached end of life and may expose a site to security vulnerabilities. PHP.net ends security support for PHP 8.2 on 31 December 2026. We plan each PHP upgrade on a staging copy, test the plugins against it, then move the live site.

Yes. Magento and Adobe Commerce need security patches and extension updates applied with care, and we have a separate UK Magento page for that work. Shopify patches its own platform, but custom apps, theme code and integrations still need planned updates as Shopify retires API versions, each supported for at least 12 months. Custom Next.js and headless builds are covered too.

It should be, and it is the part most care plans leave out. A plugin update can quietly stop orders reaching Xero, Sage, QuickBooks, NetSuite, Business Central, Odoo, Brightpearl, Linnworks or Mintsoft, and nobody notices until month end. We check those links after each update by following a real test order through to the other system and comparing the totals.

If staff fill the gap by copying totals across by hand, that step is no longer a digital link. HMRC’s VAT Notice 700/22 says copy and paste does not count as one, while API transfer and CSV import do. Fixing a broken connector quickly, rather than working around it for weeks, keeps your VAT records inside the rules. Confirm any VAT question with your accountant.

Yes, where they run through your site. That covers stock and order feeds to Amazon.co.uk, eBay UK, OnBuy, ManoMano and the B&Q marketplace, payments through Stripe, GoCardless, Klarna and Clearpay, and labels and tracking from Royal Mail, DPD and Evri. Each one is a place an update can break something, so each one is on the monthly test list.

The NCSC’s Cyber Essentials requirements, version 3.3 from April 2026, say updates fixing flaws the vendor rates critical or high risk must be applied within 14 days of release. Off-the-shelf web applications are in scope by default; bespoke custom code is out of scope. Even if you are not certified, 14 days is a sensible ceiling for a site that handles customer data or payments.

First we stop the damage, switching the site to a holding page if that is safer, put back the last copy we know is clean, trace how the attacker got in and shut that route, rotate every password and key, and ask Google to review any warnings. If personal data may have been exposed, the ICO says a notifiable breach must be reported without undue delay and no later than 72 hours after you become aware. That decision is yours, and we give you the facts fast.

We maintain the technical parts: the cookie banner works and blocks tags until consent, forms send data only where they should, old admin users are removed and backups are stored securely. We do not give legal advice. Your privacy notice and the decisions about what data you collect stay with you and your adviser, and we make the site match what you decide.

Not usually. Every update runs on the hidden staging copy before anything else, and the live site changes only after it passes there. Larger jobs, such as a PHP upgrade or a Magento patch that needs a database change, are scheduled outside your busy hours, agreed with you in advance, and done with a fresh backup ready to restore.

You do, from day one. The domain, hosting, store, licences, code and analytics stay in your company’s name, and we work through logins you can remove. If you leave, you get a full backup and our notes on how the site and its integrations are set up. Nothing is held back.

Yes. Many UK businesses have a marketing team that edits content and an IT provider that runs email and laptops. We take the developer side: updates, code, integrations and fixes. We agree in writing who owns what, so a broken form or a failed Xero sync never falls between three parties. Calls run in UK business hours.

Please do. A written brief gets a more useful reply than a form. Include the site address, platform and host, the systems it connects to, who built it, what went wrong in the last year, and any supplier questionnaire or data processing agreement your procurement needs. The founder replies within 24 hours, and we answer every question in writing.