A website launch feels like the end of a project, so the budget and attention often end with it. But a live website is closer to a shop than a brochure: the doors need unlocking every day, someone has to notice when a light goes out, and the locks need changing now and then. When nobody owns those jobs, problems show up at the worst moments, such as an expired domain during a campaign, a hacked plugin, or a contact form that quietly stopped sending emails weeks ago.

This guide walks through seven steps for setting up hosting and maintenance so the site keeps working after the team that built it has moved on. You do not need to be technical to follow it. You need to know what questions to ask and who should answer them.

Step 1: Write down who owns what

Before anything else, make a simple inventory of every account your website depends on. Most post-launch disasters are not technical failures. They are access failures: nobody can log in, or the only person who can is no longer around.

  • Domain registrar: where your domain name is registered and when it expires.
  • DNS: the settings that point your domain to your site and your email.
  • Hosting account: where the site actually runs.
  • Site admin: the login to your CMS or admin panel.
  • Third-party services: payment gateway, WhatsApp integration, email sending, analytics, maps and similar.
  • Licences: any paid themes, plugins or tools, and which email they are tied to.

For each item, record who the account is registered to, which email receives the notices, and who else can get in. The key rule: the accounts should belong to your company, not to a freelancer's personal email or an agency's account that you cannot access. Use a shared password manager and make sure at least two trusted people have access.

Step 2: Choose hosting based on what the site does

Hosting is where your site lives, and the right choice depends on what the site has to do, not on what sounds most powerful.

Match the hosting to the workload

  • A mostly static company website with a few pages and a contact form usually runs well on modest shared or managed hosting.
  • A WordPress site with plugins, a shop or a membership area benefits from hosting tuned for WordPress, or a virtual private server, because it does more work on every visit.
  • A web application with logins, a database and business logic needs hosting you can configure and scale, typically cloud or a virtual private server, with proper separation between test and live environments.

Questions to ask any hosting provider

  • Where are the servers located, and is that sensible for most of your visitors? If your customers are mainly in Indonesia, a nearby server or a content delivery network helps pages load faster.
  • Is the SSL certificate included and renewed automatically?
  • Are backups included, and how often are they taken?
  • What happens if a campaign sends a sudden surge of visitors? Can you upgrade quickly?
  • What support is available, in which language, and during which hours?

Cheapest is rarely the best measure. A better question is how expensive an hour of downtime would be for your business, then choose accordingly.

Step 3: Set up backups, then test restoring one

Many businesses have backups. Far fewer have ever restored one. A backup you have never tested is a hope, not a plan. Check three things:

  1. What is backed up. A full backup includes both the files and the database. Orders, form entries and user accounts live in the database.
  2. Where it is stored. Backups kept only on the same server disappear with that server. Keep at least one copy somewhere separate.
  3. How often. Match the frequency to how often your data changes. A brochure site that changes monthly needs less frequent backups than a shop taking orders every hour.

Then ask for a test restore on a separate environment, and have someone confirm that the site opens, the latest content is there and the forms work. Do this once after launch and again whenever hosting changes.

A website after launch needs named owners for every account and a recovery plan that has actually been tried, because most serious problems come from missing access or untested backups, not from clever attacks.

Step 4: Build a routine for updates and security

Software ages. CMS platforms, plugins, frameworks and server components all release updates, and some of those fix security weaknesses. Skipping them is how many business sites get compromised. Updating carelessly can break the site, so you need a routine rather than a rush.

  1. Update on a schedule. Pick a regular slot, such as every two weeks, and apply urgent security fixes sooner.
  2. Try updates on a staging copy first when the site is important to revenue. A staging copy is a private duplicate of your site used for testing.
  3. Check the key journeys afterward: submit the contact form, add a product to the cart, log in, and pay on a test order if you sell online.
  4. Keep a short change log of what was updated and when, so problems can be traced.

Add a few security basics at the same time:

  • Turn on two-factor authentication for admin, hosting and domain accounts.
  • Give each person their own login with only the access they need.
  • Remove admin accounts for people who have left.
  • Delete plugins, themes and tools you no longer use, since unused software is still attack surface.

If your site runs on WordPress, this routine matters even more because of the number of plugins involved. That is a large part of what WordPress development work covers beyond the initial build.

Step 5: Set up monitoring so you hear about problems first

Without monitoring, you usually learn the site is down from a customer. A few simple checks change that:

  • Uptime monitoring that alerts you by email or messaging when the site stops responding.
  • Expiry reminders for the domain and SSL certificate, sent to more than one person.
  • Form and checkout tests done by a human monthly. Silent failures, like emails landing in spam or a payment step erroring out, do not trigger uptime alerts.
  • Search and analytics reviews to catch sudden drops in visits or pages that stopped being indexed.

If your site connects to payments, WhatsApp or other outside services, those connections can break when the provider changes something. Our planning guide to payments, WhatsApp and APIs covers what to document so these are easier to diagnose later.

Step 6: Decide who does what, in writing

Maintenance is a set of tasks, and every task needs an owner. For each of the jobs in this article, decide whether your team, your agency, your hosting provider or a freelancer handles it. A short written agreement should cover:

  • Which tasks are included: updates, backups, monitoring, security checks, small content changes.
  • What counts as an emergency, and how quickly someone will respond.
  • How to report a problem, and to whom.
  • What is not included, such as new features, redesigns or recovering from problems caused by third parties.
  • Who holds the credentials, and how they are handed over if the arrangement ends.

This is also worth asking about before you sign a development contract. If you are comparing agencies, post-launch support belongs on your checklist, and our guide on how to compare web development proposals shows where to look.

Step 7: Review everything every quarter

Set a recurring calendar reminder, roughly every three months, for a 30-minute review. Go through this short list:

  • Are all accounts still correctly owned, and has anyone left or joined?
  • Did the last backup restore test succeed, or is it time to repeat it?
  • Are domain, SSL and hosting renewals coming up?
  • Has the site slowed down, or has traffic outgrown the hosting plan?
  • Are any pages, plugins or integrations obsolete?
  • Do the contact form, checkout and WhatsApp links still work end to end?

A hypothetical example: a clinic's booking form stops delivering emails after a mail setting changes. Nothing looks broken on the site, and bookings simply stop arriving. A monthly form test would catch this within weeks instead of months.

Takeaways

  • Put every account in your company's name and keep two trusted people with access.
  • Choose hosting by what the site does and what downtime would cost you.
  • Keep backups in a separate location and test a restore before you need one.
  • Update on a schedule, test on a staging copy for important sites, and check key journeys afterward.
  • Use two-factor authentication and remove unused accounts and plugins.
  • Monitor uptime, expiry dates and form delivery so you hear about problems first.
  • Write down who does what, and review the whole setup every quarter.

None of this is glamorous, but it is what keeps a site you invested in earning its keep for years. If you would like help setting up hosting and a maintenance routine for your site, you are welcome to get in touch with the Digital Revo team.

Frequently asked questions

Do I really need a maintenance arrangement if my site rarely changes?

Usually yes, though it can be light. Even a site you never edit depends on software that needs updates, certificates that renew and domains that expire. A small routine of updates, backups and monitoring costs far less effort than recovering from a hacked or offline site.

Should I host the site with the agency that built it or on my own account?

Either can work, as long as you have clear access and ownership. The safest setup is a hosting account in your company's name, with the agency given the access it needs to manage it. If the agency hosts it for you, get in writing how you could move the site elsewhere.

How do I know whether my site needs better hosting?

Warning signs include pages that load slowly even after the content has been optimized, errors during busy periods, and a hosting provider that cannot explain its backup or support arrangements. If a campaign or growth is coming, ask your developer or host to check capacity beforehand rather than after something fails.