Context: A Gauteng firm 18 months past handover
For example, a professional services firm in Johannesburg receives its new website from a developer in early 2023. Handover happens on a Friday. The site is fast, the forms work, and the marketing team is delighted. Eighteen months later: the core CMS has not been updated since launch, two plugins are running versions flagged in public vulnerability databases, the SSL certificate expires within weeks, the contact form silently fails for anything longer than 200 characters, and a theme update has quietly broken the GA4 and GTM tags on the thank-you page. Nobody is monitoring any of it.
This is the "dark estate" of post-launch decay - the slow accumulation of risk that sits between go-live and the next redesign. Website maintenance services in Gauteng exist to manage that estate deliberately rather than discover it by accident. The article below covers what actually breaks, the four commercial models sold in the province, a monthly/quarterly/annual playbook, and how to prove a retainer is doing its job.
Maintenance is a revenue-protection line item, not an IT afterthought. Every hour a store is down, every broken tracking tag, and every expired certificate has a Rand figure attached - often hidden inside a media budget that is now optimising against incomplete data.
What actually breaks on a live site - and how fast
Live sites are not static artefacts. Five failure modes dominate the first two years after handover:
- Dependency drift: CMS cores, plugins, themes and PHP runtimes all release updates. Stale versions accumulate known CVEs (Common Vulnerabilities and Exposures) that scanner bots find within hours of publication.
- Certificate and domain expiry: SSL certificates lapse on fixed clocks; a lapsed certificate serves a full-page browser warning and tanks conversion immediately.
- Silent integration failure: contact forms, payment gateways, Klaviyo or HubSpot webhooks and shipping-rate APIs fail quietly. The visitor sees a spinner, leaves, and nobody is alerted.
- Tracking corruption: a theme update, consent-banner change or new script manager can break GA4 events, GTM containers, server-side tags or schema markup. Media spend then optimises against partial data.
- Content and consent drift: privacy policies age, cookie banners fall out of step with actual tag behaviour, and old landing pages keep collecting personal information under stale terms.
For a Gauteng ecommerce store on WooCommerce, add app and theme updates that can break checkout. For a Shopify merchant, add checkout extensibility and app permission changes. For a B2B SaaS company, uptime and patching are the primary concern. For a performance marketer, the critical failure is always tracking integrity.
The four commercial models buyers are sold in Gauteng
Gauteng buyers are quoted four distinct models, and they are frequently confused. The table below separates them.
| Model | Typical scope | SLA / response | Who owns the work |
|---|---|---|---|
| Maintenance retainer | Patching, backups, security monitoring, tracking checks, small content updates, reporting | Defined response tiers in business hours | Agency or specialist - deliverables recorded |
| Managed hosting | Server, uptime, backups at infrastructure layer; often no CMS updates | Server-side uptime SLA only | Hosting provider |
| "Care plan" | Varies wildly - can be a marketing label on hosting, or a full retainer | Often vague or unspecified | Whoever wrote the brochure |
| DIY / in-house | Whoever is available - usually marketing or IT as a side task | None contractual | Your own team |
How to read a 'care plan' brochure before you sign
Ask three questions: does the plan state exactly which updates are applied and at what cadence, is a restore from backup actually tested (and how often), and what is the committed response time when the site is down? If any of those three is missing, the plan is hosting with a marketing form attached.
Where managed hosting ends and maintenance begins
Managed hosting protects the server. It does not patch your WordPress core, test your WooCommerce checkout, review your GA4 events or rewrite your privacy policy when a consent rule changes. Both are necessary; only one is often purchased. Buying hosting and assuming maintenance is included is one of the most common and expensive misreadings in the Gauteng market.
The maintenance playbook: what a retainer should do monthly, quarterly and annually
Monthly tasks (patching, backup verification, form and tracking checks)
- Apply CMS core, plugin and theme updates in a staging environment, then push to production.
- Confirm backups ran and are readable - not just that a job was scheduled.
- Submit a test enquiry and a test checkout; verify notification emails, thank-you pages and webhook delivery.
- Check GA4 and GTM real-time events, server-side tags and schema markup are firing.
- Review uptime and error logs for new 4xx/5xx patterns.
Quarterly tasks (restore test, PHP/stack review, consent banner and policy drift)
- Perform an actual restore into staging and record the recovery time - the metric that matters when the site does go down.
- Review PHP version, database engine and hosting resources against traffic trend.
- Audit the consent banner against current tag behaviour and align the privacy policy wording.
- Review user accounts and permissions; remove departed users.
Annual tasks (domain/SSL renewal audit, credential rotation, documentation refresh)
- Reconcile domain and SSL renewal dates against a central register - the cost of a missed renewal is measured in panic.
- Rotate administrative, API and integration credentials.
- Refresh the run-book: hosting contacts, DNS provider, registrar, database structure, integration list.
Security patching and the evidence that stale sites get attacked
The OWASP Top 10 has consistently placed vulnerable and outdated components in its risk set, and the WPScan database lists active vulnerabilities against specific plugin versions. In practice, scanning traffic against a WordPress site is not targeted - it is automated and volume-driven. The site that is 14 plugin versions behind is not unlucky when it is compromised; it is simply first in line.
No maintenance provider can promise a site is unhackable. What a well-run retainer can do is ensure known vulnerabilities are patched on a defined cadence, backups are restorable and access is controlled - reducing the window of exposure rather than eliminating it.
The WordPress hardening guide is a reasonable reference for the baseline controls a provider should apply: least-privilege users, forced strong authentication, disabled file editing, controlled plugin approvals and a documented update workflow. See how this applies to your store's patching cadence in Prebo Digital's web development practice.
What a fair maintenance SLA contains in South Africa
The Service Level Agreement is the part buyers skim and later regret. A workable SLA for a Gauteng-based site should name: uptime monitoring method and reporting cadence, response-time tiers by severity, backup frequency and retention window, restore-test cadence, patching cadence and approval process, security incident escalation path, and named contacts on both sides.
Response-time tiers and SA business hours
| Severity | Example | Response (business hours) |
|---|---|---|
| Critical | Site down, checkout failing, SSL expired | Within 1-2 hours |
| High | Forms failing, tracking broken, admin inaccessible | Same day |
| Standard | Content updates, cosmetic issues, minor requests | 2-3 business days |
Ensure the SLA names South African business hours explicitly (typically 08:00-17:00 SAST Monday to Friday) and states whether after-hours cover is included, or priced separately. Load-shedding resilience should be addressed factually rather than alarmingly: confirm the hosting provider's redundancy, whether the origin site is in a data centre with backup power, and whether the provider has an out-of-hours escalation contact for a critical failure.
The scope boundary: maintenance versus new work (change requests)
The number one retainer dispute driver is scope creep dressed as maintenance. A fair SLA defines what sits inside the retainer - typically 1-3 hours of content updates per month, planned patch cycles, monitoring and reporting - and what sits outside - new pages, new features, redesigns, integrations, plugin migrations. Change requests should be logged, quoted and prioritised separately. Buyers should insist the boundary is written down, not implied.
If the retainer description does not have a change-request clause, assume every request will be a negotiation. Ask for the boundary in writing before signing.
POPIA consent and tracking integrity: the parts of maintenance that touch revenue
Maintenance is not only an IT concern. Two of its most commercially consequential roles touch the marketing stack directly.
The first is POPIA. The Information Regulator South Africa publishes guidance on lawful processing, and a maintenance retainer should ensure the consent banner actually matches the tags the site fires, the privacy policy wording is current, and any new scripts introduced by marketing or an agency are reflected in the consent configuration. This is a working alignment task, not a one-time certification - nobody can credibly claim POPIA compliance as a label on a retainer invoice.
The second is tracking integrity. After any update - theme, plugin, consent tool or tag manager - GA4 events, server-side tags, conversion pixels and schema markup can break silently. When that happens, media spend continues, but the optimisation signals it depends on are corrupted. At Prebo Digital's reporting approach, we treat maintenance as the foundation of advertising accuracy, not a separate line item. That is why the monthly maintenance playbook includes tracking verification as a standing task, and why an audit of PostHog, GA4, Ads and server-side events sits in the retainer alongside patching.
How to prove maintenance is working: the outcome metrics
Demand evidence, not reassurance. A credible provider should be willing to report on:
- Uptime and error rate: monitored externally, trended monthly - target range should be discussed, not promised.
- Backup restore-test date and recovery time: when the last restore was actually performed and how long it took.
- Time-to-patch: average days between a security release and production deployment.
- Tracking integrity score: percentage of key conversion events validated in each reporting period.
- Upcoming renewal register: domain, SSL and hosting expiries inside the next 90 days.
A simple uptime check of exactly the kind a maintenance provider runs, using a publicly documented monitoring principle, would look something like:
# Example: verify the live site responds and returns the expected status
curl -s -o /dev/null -w "%{http_code}\n" https://your-domain.co.za/
# Expected output: 200
# Example: confirm SSL expiry (run monthly from a maintenance workstation)
echo | openssl s_client -servername your-domain.co.za \
-connect your-domain.co.za:443 2>/dev/null \
| openssl x509 -noout -enddateWhat website maintenance services cost in Gauteng (ZAR ranges, estimates only)
The figures below are broad estimates based on the Gauteng market and typical scope. They are not quotes, and real pricing will depend on stack, number of plugins, hosting arrangement and hours of content support.
| Tier | Typical fit | Estimated monthly range (ZAR ex. VAT) |
|---|---|---|
| Essential | Brochure or small WooCommerce store, 1-2 hours content support | R2,500 - R5,000 |
| Standard | Active ecommerce or lead-gen site with tracking and integrations | R5,000 - R12,000 |
| Managed | SaaS or high-traffic site with SLA tiers, quarterly restore tests, tracking validation | R12,000 - R30,000+ |
Which maintenance engagement suits your business?
Three buyer profiles, mapped directly.
- Owner-run business, one to five pages, low traffic: a managed hosting plan with a nominal care add-on plus a quarterly restore test is usually sufficient. Pay for hosting with backup power and an out-of-hours number, not a full retainer.
- Mid-market ecommerce (Shopify or WooCommerce), active media spend: a Standard retainer is the right fit. Tracking integrity and checkout uptime protect real revenue; monthly content support matters more than a heavy SLA tier.
- B2B SaaS or professional services with uptime dependencies: a Managed retainer with named response tiers, quarterly restore testing and credential rotation. Anything less puts the site's uptime directly on the CTO's risk register.
To benchmark what good looks like, see a real-world example of how Prebo Digital has worked alongside client teams, and explore the framework behind the tracking and conversion work that a maintenance retainer supports.
Exit and handover: what to demand if you leave a provider
Contracts end, and the site must remain yours. Before walking away from any provider, request in writing: administrative and hosting credentials, DNS records and registrar access, a current copy of the backup archive including a tested restoration, a stack and plugin inventory, integration credentials or API keys, documentation of any custom code, and confirmation of which third-party accounts sit under whose name. Getting this right at handover is worth months of maintenance invoices.
