Website Maintenance and Support for Your Site or Online Store
We update, patch, back up and monitor your website so it keeps working, and you see all of it in your own portal: every patch with the vulnerability it fixes, every incident and every hour. For WordPress, WooCommerce, PrestaShop, Magento, Shopify, Drupal and custom applications. From €150/month, billed monthly, cancel any time.
- €150 A month for a corporate website plan
- ISO 27001 And ENS: certified since 2026
- Monthly No lock-in: cancel whenever you want
- 01 · Monitoring Probes on the site and its services
- 02 · Alert Published vulnerabilities
- 03 · Backup Before every change
- 04 · Patch Tested on a copy of the site
- 05 · Deployment With rollback ready
- 06 · Portal You see patches, incidents and hours
- Every alert starts the next cycle
Definition
What Is Website Maintenance?
Website maintenance is the ongoing work that keeps a website or online store secure, fast and running after launch: updating the CMS, plugins and framework, applying security patches, taking and testing backups, monitoring that the site is online and fixing whatever breaks.
Summary
Executive Summary
What you are buying when you hire maintenance, and why with us you can see it.
An unmaintained website does not break on day one. It breaks the day a vulnerability is found in a plugin nobody updated, when a certificate expires, or when an automatic update takes down the checkout on a Friday afternoon. The cost is not the fee you save; it is the store being down, the Google malware warning, or the contact form that has not delivered a lead for weeks without anyone noticing.
Our maintenance does what any serious maintenance should: security patches as soon as they are released and pass testing, scheduled updates, a backup before every change, continuous monitoring that the site responds and support hours for whatever you need. The difference is that we do not report it in a PDF at the end of the month: you see it in your client portal, with every patch and the vulnerability it closes, every incident with its start and resolution time, and the hours used.
We maintain websites we built and websites someone else built. For the latter we start with an onboarding review: which versions are running, what has been abandoned, and what needs fixing before we can maintain it properly. And we do it with the same controls behind our ISO 27001 and Spain’s National Security Framework (ENS) certifications: every engineer accesses with a personal key, and credentials live in an encrypted password manager, never in an email.
- €150-600 A month for a corporate website
- €300-900 A month for an online store
- 1 portal With patches, incidents and hours
What's included
What Website Maintenance Includes
What we do every month on every plan. What changes between plans is the size of the website and the support hours.
- Security patches for the CMS, plugins, modules and framework, as soon as they are released and pass testing
- Scheduled updates: tested first in a staging environment, never applied blindly in production
- Backups before every change and on a schedule, stored off the website’s server
- Continuous monitoring: probes that check the website and its services are responding and alert us if they are not
- Incident alerts to the people you choose, when an incident opens and when it closes, plus a status page if you want one
- Dependency monitoring: we check your website’s libraries against published vulnerability advisories
- Certificates, domain and form email: so they do not expire or stop sending without anyone noticing
- Support hours for small changes, questions and fixes, requested and tracked from your portal
- Client portal with everything done: patches with their CVE, incidents, tasks and hours used
Why
You See It All in Your Portal, Not in an End-of-Month PDF
The client portal of Nexo, the platform we run every project on.
Every maintenance client has their own portal. It shows the probes monitoring your website and their status, every incident with when it started and when it was resolved, every security patch with the vulnerability (CVE) it closes and the date it was applied, and the hours used that month. From there you request changes, attach screenshots and follow each request until it is closed. If you want, the portal publishes a status page for your team or your customers and emails whoever you choose when something goes down and when it comes back. We built it ourselves: it is Nexo, our own platform.
- With their CVE Patches
- With alerts Incidents
- In plain sight Hours
Key points
What We Maintain
The platforms we work with every day, because we also build on them.
- 01
WordPress and WooCommerce
Core, theme and plugins kept up to date without breaking anything: every update is tested first on a copy. We remove abandoned plugins, the most common way in for attackers, and make sure orders and form submissions keep coming through. What we build on WordPress is on our WordPress development page.
- 02
PrestaShop
Security patches, up-to-date modules, backups and checkout monitoring. We plan major version upgrades as a separate, quoted project, so they are never done with the store open. More about the platform on our PrestaShop development page.
- 03
Magento and Adobe Commerce
Adobe security patches, version upgrades, extensions, indexes and cache, and performance during campaigns. It is the most demanding plan because Magento is the most demanding platform, as we explain on our Magento development page.
- 04
Shopify
Shopify updates the platform, but not your theme, your apps or your speed. We review overlapping apps, look after performance and deliver measured improvements, as we do for TwoPoles. More on our Shopify development page.
- 05
Drupal
Security updates for core and contributed modules, version-controlled configuration and migrations between versions. We did it for four years across fifteen barcelona.cat websites. More on our Drupal development page.
- 06
Custom Applications: Laravel and Symfony
PHP and framework versions, audited dependencies, queues, scheduled tasks and database backups. For applications with a business behind them, evolutionary maintenance in sprints. More on our Laravel development page.
How we work
How We Get Started
From the first call to your website being monitored. Between one and three weeks, depending on its condition.
- 01
Onboarding Review
We look inside your website: CMS versions, plugins or modules, dependencies with known vulnerabilities, backups, hosting and access. We tell you which plan fits and what needs fixing first before we can maintain it properly.
- 02
Getting It in Shape
If there is technical debt (abandoned versions, unsupported plugins, no backups), we clear it first. If it is substantial, we quote it separately; we do not hide it inside the monthly fee.
- 03
Access, Backups and Staging
Access with a personal key for each engineer, credentials in our encrypted password manager, a first full backup that we verify, and a copy of the website where every update is tested before production is touched.
- 04
Monitoring and Portal
We set up the probes that monitor your website and its services, agree with you who receives the alerts and open your portal. From that day on, everything we do is recorded there.
- 05
Month-by-Month Maintenance
Patches as they are released, scheduled updates, backups, monitoring and the support hours you request. Larger changes are handled as improvement projects with their own quote.
Who it is for
Is It for You?
This service fits when your website or store is part of the business and you cannot afford for it to fail without anyone noticing.
Who it's for
- Companies with a corporate website that brings in customers and that nobody has checked since it launched.
- Online stores on WooCommerce, PrestaShop, Magento or Shopify, where an hour of downtime means lost orders.
- Companies with a custom application or website whose original developer is gone, or that need someone on call.
- Marketing teams that need changes every month without opening a new project each time.
- Organisations that have to prove their website is patched: public procurement, ENS or ISO 27001.
Who it's not for
- Very small websites with no forms or sales: good managed hosting with automatic updates may be enough.
- Anyone looking only for the cheapest hosting: what we offer is work on the website, not the server.
- Websites that need rebuilding: if the CMS or framework is no longer supported, maintaining it costs more than migrating, and we will tell you so.
Investment
Website Maintenance Pricing
Published, so you know the order of magnitude before you call us. Billed monthly, cancel any time. Excluding VAT.
The monthly fee depends on the size of the website, its integrations and the support hours you need. After the onboarding review we give you a fixed figure.
- Corporate Website
€150-600/month
WordPress, Drupal or a custom website without online sales.
- Security patches and tested updates
- Backups stored off the server
- Continuous monitoring and incident alerts
- Certificate, domain and forms monitored
- Support hours according to the plan
- Online Store Most requested
€300-900/month
WooCommerce, PrestaShop or Shopify.
- Everything in the corporate website plan
- Checkout and payment monitoring
- Modules, apps and theme kept up to date
- Performance reviewed before campaigns
- More hours for catalogue and campaign changes
- Magento and Adobe Commerce
€800-2,500/month
Maintenance and ongoing development of Magento stores.
- Adobe security patches and version upgrades
- Extensions, indexes, cache and queues
- Performance during traffic peaks
- ERP and marketplace integrations
- Bank of hours for improvements
- Custom Application
From €1,200/month
Laravel, Symfony or another application with a business behind it.
- PHP, framework and dependency versions
- Dependency audits for vulnerabilities
- Queues, scheduled tasks and database backups
- Evolutionary maintenance in sprints
- Up-to-date documentation for your team
Hosting is separate: we can take care of it or maintain the website where it is. Major version migrations and redesigns are quoted as projects. For invoicing software, regulatory maintenance for <a href="/en/verifactu-spain">Verifactu</a> starts at €190/month.
Deliverables
What Is Included and What Is Not
So there are no surprises on the first invoice.
Included
- Security patches and updates for the CMS, plugins, modules and framework
- Testing of every update in a staging environment before production
- Off-server backups and restoration if something goes wrong
- Continuous monitoring, incident alerts and an optional status page
- Portal with patches, incidents, requests and hours used
- The plan’s support hours for small changes and fixes
Not included
- Redesigns, large new features and major version migrations (quoted separately)
- Licences for paid plugins, themes or extensions, and hosting
The proof
Websites We Maintain
Since 2025 we have maintained the Magento store of EquiMercado, the fair-trade store of the Fundación Adsis: Magento updates, security patches, hosting and Google Shopping, with the store brought up to Magento 2.4.7 in the latest maintenance cycle. For four years we developed and maintained fifteen barcelona.cat websites for the Institut de Cultura de Barcelona, and migrated them from Drupal 7 to Drupal 10 without losing content or URLs. At TwoPoles we handle the ongoing development of their Shopify store with a CRO method that cut mobile load time by 22%. And we have been certified to ISO 27001 and Spain’s National Security Framework (ENS) since September 2026, which is what you want from whoever gets into your production environment.
- 2009 Building and maintaining websites since
- 15 barcelona.cat websites maintained
- 2 Certified security standards
- 5.0 Clutch rating
For the CTO
Summary for the CTO
How we work under the hood.
Updates are driven by security advisories, not by novelty: we apply patches that close vulnerabilities as soon as they are released and pass testing, and we do not roll freshly released major versions into your production. Every change goes through a copy of the website first, with a backup taken beforehand and a rollback ready. Dependencies (Composer, npm) are audited against published vulnerability advisories, and the log of every patch, with its CVE, is kept in the portal.
Monitoring consists of HTTP probes on the website and its services, and heartbeats for whatever runs in the background (scheduled tasks, queues, backups): if a heartbeat does not arrive on time, an incident is raised. Access to your servers is through each engineer’s personal SSH key, never shared passwords, and credentials live in an encrypted password manager. Data is restored from a backup into a separate file, never by blindly overwriting production.
Technologies
- WordPress
- WooCommerce
- PrestaShop
- Magento 2
- Shopify
- Drupal 10
- Laravel
- Symfony
- Composer
- npm
- Git
- Nexo
- Patches driven by security advisories, tested before production
- Backup before every change and rollback ready
- HTTP probes and heartbeats for scheduled tasks and queues
- Access with each engineer’s personal key and encrypted credentials
- Patch log with CVEs, visible to the client
Risks and how we cover them
The Risks We Avoid
What we find when we take over a website nobody was maintaining.
- 01
An automatic update that takes down the website or the checkout
MitigationNothing is updated blindly in production: it is tested on a copy first, with a backup taken beforehand and a rollback ready.
- 02
Abandoned plugins or modules with known vulnerabilities
MitigationWe spot them in the onboarding review and check dependencies against published advisories every month. If a plugin cannot be fixed, we replace it.
- 03
The website down or the contact form not sending for days without anyone knowing
MitigationProbes that monitor the website and its services and send alerts when an incident opens and when it closes, to us and to whoever you choose.
- 04
Depending on one person or one supplier who holds all the keys
MitigationCredentials in an encrypted password manager, personal access and up-to-date documentation. If you ever leave, you take your code, your data and your access with you.
Technologies
Platforms and Technologies
The ones we maintain and build on.
- WordPress
- WooCommerce
- PrestaShop
- Magento / Adobe Commerce
- Shopify
- Drupal
- Laravel
- Symfony
- Astro
- Strapi
- PHP
- Node.js
- MySQL
- PostgreSQL
FAQ
Website Maintenance FAQs
What we are asked most often before clients sign up.
What does website maintenance include?
With us: security patches and updates for the CMS, plugins and framework (tested first on a copy), backups stored off the server, continuous monitoring with incident alerts, checks on certificates, domain and forms, and support hours for small changes. Everything is logged in your client portal.
How much does website maintenance cost?
A corporate website costs between €150 and €600/month. An online store on WooCommerce, PrestaShop or Shopify, between €300 and €900/month. A Magento or Adobe Commerce store, between €800 and €2,500/month. A custom application in Laravel or Symfony, from €1,200/month. Excluding VAT and hosting. After the onboarding review we give you a fixed figure.
Is there a minimum contract term?
No. Maintenance is billed monthly and you can cancel any time. If you ever leave, you take your code, your data and your access with you.
Do you maintain websites you did not build?
Yes, and it is the most common case. We start with an onboarding review: versions, plugins or modules, dependencies with vulnerabilities, backups, hosting and access. We tell you what needs fixing before we can maintain it properly and, if the technical debt is substantial, we quote it separately.
What is the difference between preventive, corrective and evolutionary maintenance?
Preventive maintenance avoids problems: updates, patches and backups. Corrective maintenance fixes what breaks. Evolutionary maintenance adds new things: sections, features, integrations. Our monthly fee covers preventive and corrective work plus the plan’s support hours; larger improvements are quoted separately.
What happens if my website goes down?
The probes detect it and an incident is opened that alerts us and, if you want, the people on your team you choose, when it opens and when it closes. You see it in your portal with its start and resolution time. Response times are set in the contract according to how critical your website is.
Does maintenance include hosting?
It is not included in the monthly fee, but we can take care of it. If your website is already on good hosting, we maintain it where it is; if not, we recommend a host suited to your platform and traffic and handle the move.
How often should WordPress, PrestaShop or Magento be updated?
Security patches as soon as they are released and pass testing: they are the first to be exploited. All other updates are grouped and scheduled, always tested first on a copy. Major version upgrades (for example, a new version of PrestaShop or Magento) are planned as a quoted project, because they usually require changes to modules and the theme.
Does a Shopify store need maintenance?
Shopify updates the platform, but not your theme, your apps or your performance. Over the months, overlapping apps, scripts that slow things down and uncontrolled theme changes pile up. Shopify maintenance is mostly about that: performance, apps and measured improvements.
Can I see what you do each month?
Yes, in your client portal: the status of the probes, every incident, every patch with the vulnerability (CVE) it closes, your requests and the hours used. If you prefer, you can also receive a summary by email.
Do you work with companies outside Spain?
Yes. We maintain websites for clients in other countries and work in English, Spanish, Catalan, French, German, Dutch and Portuguese.
Next step
Tell Us What Website You Have and We’ll Tell You What It Needs
A 30-minute video call with the person who will maintain it. If managed hosting is all you need, we will tell you so and sell you nothing.
- No commitment
- Response in 24h
- Custom proposal
Case studies
Projects where we put it to work
EquiMercado (Fundación Adsis)
Institut de Cultura de Barcelona
TwoPoles
Let's talk.
Initial technical consultation
AI, security and performance. Diagnosis with phased proposal.
- NDA available
- Response <24h
- Phased proposal
Your first meeting is with a Solutions Architect, not a salesperson.
Talk to an architect