A website rarely fails at a convenient time. The enquiry form stops sending messages during a campaign. A plugin update breaks the mobile menu before a product launch. A domain-renewal notice goes to a former employee. The homepage still promotes an offer that ended months ago, while management assumes the website is taking care of itself.
These problems feel sudden to the customer, but most develop quietly. Updates accumulate, backups go untested, integrations change, forms collect spam, content ages and responsibility becomes unclear.
Website maintenance in Kenya should be treated as business continuity, not occasional technical housekeeping. A working website protects customer access, lead flow, brand accuracy, search visibility and the investments already made in advertising and content. The objective is not to keep every element unchanged. It is to make controlled improvements while detecting problems before customers have to report them.
A useful maintenance plan defines what is checked, how often it is checked, who owns the result and what happens when a test fails.
Define the website’s critical business functions
Maintenance priorities should follow business risk. A five-page corporate website and a busy online store do not need the same schedule, but both need clarity about what cannot be allowed to fail.
List the website functions that affect revenue, service delivery, compliance or reputation. These may include:
- contact, quotation, admissions and booking forms;
- ecommerce checkout, payment and order notifications;
- customer login, account recovery and protected documents;
- campaign landing pages receiving paid traffic;
- product availability, pricing and delivery information;
- branch locations, opening hours and phone numbers;
- application forms, fee schedules and downloadable documents;
- analytics, advertising and customer relationship integrations.
Rank each function by impact and acceptable downtime. A broken blog filter may be inconvenient. A checkout failure or missing patient enquiry requires a faster response. This risk map determines monitoring, test frequency and escalation.
Assign ownership before something breaks
Many websites are “owned” by the business but operationally controlled by a mixture of employees, agencies, developers, hosts and former suppliers. Maintenance becomes slow when nobody knows who can access the domain, hosting account, DNS records, website admin, analytics or business email.
Create an ownership register with:
- the business owner for each critical function;
- the technical maintainer and emergency contact;
- account owner, billing contact and renewal date;
- where credentials and recovery codes are stored securely;
- who approves updates, content and costs;
- the response target for critical and non-critical issues;
- the exit and handover process when a supplier changes.
Use named organisational accounts where possible rather than a developer’s personal email address. Enable appropriate multi-factor authentication and remove access promptly when a staff member or vendor leaves.
Do not place passwords in an ordinary spreadsheet or share them through long email threads. Use a controlled password-management process and keep recovery access available to the business.
Back up files, databases and configuration
A backup is useful only if it is complete, recent, protected and restorable. Saving website files without the database may omit pages, orders, users and form records. A database without uploaded media, theme files or configuration may not rebuild the site.
Define the recovery point based on how quickly the website changes. An ecommerce store receiving orders every hour needs a different backup frequency from a brochure site updated once a month.
Use more than one storage location. A backup kept only on the same hosting account may be lost or compromised with the live site. Retain several versions so the team can recover from a problem that went unnoticed for days.
For WordPress sites, the official documentation recommends making regular site backups and ensuring a rollback is available before automatic plugin and theme updates. Review the guidance on plugin and theme auto-updates and adapt it to your site’s risk.
Schedule restore tests. At least periodically, restore the backup into a safe staging environment and verify that pages, media, forms, accounts and important integrations work. A successful “backup completed” email does not prove the archive can be used.
Update WordPress core, themes and plugins safely
Outdated software can create security, compatibility and performance problems. Updates should not be ignored, but pressing “update all” on a critical live site without a backup or test plan also creates risk.
Use a controlled sequence:
- review the update, release notes and known compatibility concerns;
- confirm a current backup and recovery route;
- apply the change in staging when the site’s complexity justifies it;
- test critical journeys, mobile layouts and integrations;
- schedule the live update during a sensible maintenance window;
- test again immediately after release;
- record the version, date, owner and result.
Remove unused plugins and themes rather than leaving them inactive indefinitely. Each component adds code, update work and potential exposure. Keep the active theme’s customisations in an appropriate child theme or controlled codebase so updates do not overwrite business-specific work.
The WordPress documentation on updating WordPress advises taking a backup and notes that upgrades affect core files and folders. Your maintainer should understand which changes are standard and which have been customised.
Monitor security signals without assuming a plugin solves everything
Security maintenance includes people, access, hosting, software and response procedures. A security plugin may help detect or block some threats, but it cannot compensate for shared administrator passwords, abandoned accounts, weak recovery processes or unsupported custom code.
Review administrator users, failed-login patterns, unexpected file changes, new scheduled tasks, unfamiliar redirects, spam pages and sudden traffic from suspicious sources. Check that security alerts go to a monitored address and that someone is authorised to act.
Use least-privilege access. A content editor normally does not need hosting or DNS control. A temporary developer account should not remain active forever. Restrict file and database access according to the hosting environment and keep server software supported.
Prepare an incident checklist that covers containment, evidence preservation, credential changes, restoration, customer or regulatory communication where required, monitoring and a post-incident review. Decide in advance who makes the call to take the site offline.
Test forms as a complete communication journey
A green success message does not prove an enquiry reached the right person. Test each form from the visitor’s perspective and then verify the operational result.
Check that:
- required fields and error messages are clear;
- the form works on mobile and desktop;
- spam controls do not block ordinary users;
- the submission is stored or emailed as intended;
- the notification reaches a monitored inbox rather than spam;
- the customer receives the correct confirmation;
- analytics records one successful action rather than a button click;
- the team follows up within the agreed time;
- personal data is collected and retained appropriately.
Test phone links, email links, map directions, live chat and WhatsApp buttons too. If a campaign uses a dedicated landing page, repeat the test after any design, form or tag update.
Keep a test record with date, device, result and evidence. Rotating responsibility without a record often leads everyone to assume somebody else checked.
Watch performance before pages become frustrating
Website speed changes over time. New image uploads, marketing scripts, fonts, sliders, videos, chat tools and plugins add weight and processing. Hosting resources may also become inadequate as traffic and functionality grow.
Track representative pages rather than relying on the homepage alone. Include a service page, article, product category, product detail, checkout or key form. Test both mobile and desktop because the experience can differ significantly.
Review image dimensions and compression, caching, database growth, unused code, third-party scripts and server response. A visual redesign is not always required; disciplined technical clean-up can make an existing site feel more reliable.
Our article on website performance optimisation explains the relationship between technical speed and user experience. The hosting environment also matters, which is why extremely cheap plans can create wider operational costs, as discussed in the true cost of cheap web hosting in Kenya.
Protect search visibility during routine changes
A maintenance release can accidentally block search engines, remove page titles, change URLs or leave staging settings on the live site. Include SEO checks after theme changes, migrations and major content updates.
Verify that important pages return the correct HTTP status, canonical tags point to the intended URL, redirects preserve moved content, XML sitemaps are current and noindex rules are deliberate. Check that navigation and internal links still lead to priority pages.
Google’s Page indexing report shows which known URLs have been crawled and indexed and provides reasons some pages are not indexed. Not every excluded URL is a problem, so investigate the reason and the page’s intended role before taking action.
Monitor important search queries and landing pages for unusual drops after a release. Search performance can change for many reasons; use change logs to determine whether a technical or content edit coincided with the shift.
Review content for accuracy and commercial relevance
Old content can mislead customers even when the website is technically healthy. Check prices, product names, staff profiles, service areas, legal statements, offers, opening hours, delivery information and contact details.
Prioritise high-traffic and high-intent pages. An outdated service page can affect more decisions than an old announcement with no visitors. Review seasonal landing pages before the next campaign instead of duplicating them with slightly different URLs.
For each important page, ask:
- Does it answer the buyer’s current question?
- Is the offer still available and described accurately?
- Are claims supported and links working?
- Does the page compete with a newer page for the same intent?
- Is the next action clear and functional?
- Does the content meet the brand’s current editorial standard?
Update a strong existing page when that serves the reader better than publishing another version. Redirect pages only when there is a genuinely relevant destination.
Include accessibility in routine maintenance
Accessibility can decline as new content, plugins and components are added. A page that passed review last year may acquire low-contrast campaign graphics, unlabeled form fields or an inaccessible video.
Include keyboard navigation, visible focus, heading structure, form labels, colour contrast, alt text, captions and zoom behaviour in recurring checks. Test any new menu, modal, slider, booking tool or payment component before release.
The scheduled article on website accessibility in Kenya provides a practical checklist based on WCAG 2.2 and priority customer journeys. Accessibility belongs in publishing and development acceptance criteria, not only in a special annual audit.
Check third-party integrations and external dependencies
Your website may depend on payment gateways, maps, email platforms, CRM forms, social feeds, analytics tags, courier services, booking software and external APIs. Their settings, authentication methods and endpoints can change.
Maintain an integration register containing the provider, purpose, account owner, data exchanged, credentials or keys, renewal date, failure alert and support route. Review whether every integration is still needed.
Test both the visible experience and the data behind it. A form can display success while the CRM connection fails. An online payment can complete while the order-notification email does not arrive. An analytics tag can load while recording the wrong action.
When a provider announces a change, assign the work rather than forwarding the email and assuming someone will handle it.
Manage domains, SSL, DNS and business email
Domain and certificate problems can make an otherwise healthy website unavailable or untrustworthy. Record the registrar, registrant, billing contact, renewal method and expiry date. Confirm that the business can access the account and that payment details remain current.
Review SSL certificate renewal, DNS records and email authentication when hosting or email providers change. A careless DNS edit can interrupt both the website and business email.
Keep a verified copy of current DNS records and understand which entries support the website, email, verification services and marketing platforms. Restrict who can edit them. Use change records so a problem can be traced and reversed.
Do not wait for the registrar’s last reminder. Set internal renewal alerts well ahead of expiry and send them to more than one accountable person.
Verify analytics and advertising after releases
A website can keep accepting enquiries while measurement silently breaks. Check that analytics loads under the intended consent conditions, campaign parameters are preserved, important actions are recorded once and internal or test traffic is handled consistently.
After a redesign, form replacement, checkout change or tag-container release, complete test conversions from advert click through to the operational record. Compare website actions with form, CRM, booking or order totals.
A sharp traffic drop may be a measurement failure rather than a real audience change. A sudden conversion increase may be a duplicated tag. Use release dates and annotations to give analysts context.
Use a monthly, quarterly and annual rhythm
The exact schedule depends on risk and change volume, but a layered rhythm gives most teams a starting point.
Weekly or continuous
- uptime and security alerts;
- critical form, payment and checkout monitoring;
- backup success and storage checks;
- urgent software or vulnerability review.
Monthly
- controlled updates and post-update testing;
- form, phone, email and WhatsApp journey tests;
- performance and error review;
- administrator and integration checks;
- analytics and conversion reconciliation.
Quarterly
- backup restore test;
- priority content, SEO and broken-link review;
- accessibility checks on representative journeys;
- plugin, theme and integration rationalisation;
- domain, DNS, hosting and account-ownership review.
Annually
- full risk and supplier review;
- disaster-recovery exercise;
- design, platform and hosting suitability assessment;
- privacy, retention and policy review with qualified advisers;
- maintenance plan and service-level reset.
High-volume stores, financial services, healthcare, schools and campaign-heavy sites may need more frequent checks. Use the risk map rather than copying a generic calendar.
Demand a maintenance report that supports decisions
A report should show more than a list of updated plugins. Ask for work completed, tests performed, incidents, failed checks, unresolved risks, performance trends, upcoming renewals and decisions required from the business.
Each issue should have an owner, severity, due date and verification status. Distinguish urgent customer-facing problems from worthwhile improvements so management can allocate resources sensibly.
Keep a change log with date, reason, files or components affected, person responsible, test evidence and rollback route. This reduces guesswork when a problem appears after several unrelated updates.
Know when maintenance is no longer enough
Maintenance can keep a sound website healthy, but it cannot indefinitely rescue a platform that is unsupported, heavily customised without documentation or fundamentally unsuited to the business.
Consider a rebuild or major redesign when critical software cannot be updated, ordinary changes repeatedly break the site, the mobile experience prevents key tasks, integrations cannot be supported, the information architecture no longer fits the business, or maintenance costs are dominated by fragile legacy work.
Use evidence before commissioning a redesign. Our analysis of why business websites fail to generate leads can help separate maintenance defects from wider proposition, content and conversion problems.
Keep the website dependable enough to sell
A maintained website is not one that never changes. It is one where changes are controlled, critical journeys are tested, backups can be restored, ownership is clear and problems are turned into accountable work.
For Kenyan businesses, that discipline protects campaigns, customer trust and daily operations. It also gives management a better basis for deciding when to optimise, replace or invest, instead of responding only after a visible failure.
If your website is important to lead generation, sales or customer service but maintenance is still ad hoc, talk to Dot Digital Agency. We can audit the current setup, identify priority risks and build a practical maintenance plan covering updates, backups, performance, forms, SEO, accessibility and measurement.
