What happens after launch: maintenance and security

A website degrades with nobody touching it

This is the least intuitive point and the most expensive to ignore. A site nobody edits does not stay the same: everything around it moves. Browsers change, PHP versions leave support, plugins ship security fixes, certificates expire, APIs move on.

A site left alone for two years does not decline gently. It works, keeps working, then fails all at once — the day the host drops the PHP version it was running on, or the day someone exploits a vulnerability published eighteen months earlier.

The failures that come up most often

• The contact form stops sending. Nobody notices, because a broken form does not produce an error: it produces silence. Enquiries stop arriving and everyone concludes the market is quiet.
• The certificate has expired. The browser shows a full-screen red warning. To a visitor who does not know you, that is a dangerous site, and they leave.
• The domain was not renewed. The site disappears entirely, and the email addresses with it. The most brutal failure, and the most avoidable.
• The site was compromised. Usually not to harm you: to host spam pages on your domain. You find out when Google flags the site as unsafe.
• An update broke a page. A plugin updated without testing, a layout that collapses. An hour to fix — if anyone is looking.

The question that matters: who holds what?

In Morocco as anywhere, the most common scenario is not technical. A site is built by a supplier or a freelancer. The domain is registered in their name, the hosting paid on their card, the credentials in their inbox. Two years later they have changed careers or stopped replying.

At that point the business can do nothing: not fix, not migrate, not even recover its own domain name without a formal process. The problem was never maintenance; it was ownership.

So check four things today: is the domain registered to the company? Is the hosting on a company account? Does someone internal hold administrator access? Does a backup exist somewhere other than the host? If any answer is no, that is the first job — before any maintenance contract.

What a contract should cover

A useful maintenance contract is explicit on five points. A contract that says "site maintenance" without detailing them protects you from nothing.

• Updates: which ones, how often, and tested before they are applied.
• Backups: frequency, retention, and — the forgotten part — a restore that has actually been tested. A backup never restored is a hypothesis.
• Monitoring: who gets told when the site goes down, and how quickly.
• Response time: a store down on a Saturday does not cost what a brochure page costs. The contract should say so.
• What is excluded: new work. Adding a page is not maintenance, and conflating the two causes half of all disputes.

The technical choice changes the workload

Not every architecture needs the same upkeep. A site built on a content management system with a dozen plugins has a dozen update sources and as many dependencies that can break. A static site — pages generated once and served as they are — has no database to protect and no plugins to update.

That is not an argument for or against a technology: it is a cost of ownership to weigh when choosing, rather than discover two years later.

The ten-minute monthly check

Whether maintenance is outsourced or not, these five checks can be done from a phone and catch nearly every silent failure before it costs anything.

• Send yourself a message through the site’s form. The only test that matters: does it arrive. The most common failure, and the most invisible.
• Look at the padlock in the address bar. A warning means an expired or badly renewed certificate.
• Check the domain expiry date. It is publicly readable, and the registrar’s automatic reminder often goes to an email address nobody reads any more.
• Open three pages on a phone, on mobile data. Not on wifi, not on a computer. That is your visitors’ real condition.
• Search site:yourdomain.ma on Google. A sharp drop in indexed pages signals a problem nothing else surfaces.

Frequently asked

And at Noor Studio Agency?

We hand over sites with the domain and hosting in the client's name, credentials transferred, and a written note of what needs watching. A site whose keys you do not hold is not really yours.