At Your Tech Club we arrange website maintenance with an SLA: fixed agreements on updates, monitoring, backups and what happens when something goes wrong. A website agent keeps watch, a developer decides.
ISO 9001 & 27001Built for clients including Tata Steel, M&G Investments, Digistore24, Toppers in Concert, Bar-le-Duc and Loogman
Website maintenance means keeping everything your website runs on up to date, so it stays secure, fast and online. It covers updates to the server, the programming language, the CMS and the plugins. It also covers monitoring for outages and attacks, backups stored away from the server, and someone who steps in when something breaks.
The difference with updating it now and then is the agreement. With good maintenance, it is clear who does what, within which timeframe, and how you hear about it. You put that in an SLA, a service level agreement.
Because researchers and attackers now find vulnerabilities faster than ever. The PHP vulnerability of October 2026 had sat in the code for more than ten years, and researchers found it with the help of AI. Even so, the first attack attempts started before the patch was out. Without knowing who manages your site at that moment, you lose hours.
On 21 October, DigiD (the Dutch government login), MijnOverheid (the Dutch government's citizen portal) and the websites of, among others, the Dutch House of Representatives and the tech site Tweakers went offline. Several of our client projects run on PHP. That day we went through them one by one. A number of larger projects went offline until the patch was available; that was a deliberate choice, made together with the client. Others stayed online, with the risks in view.
Usually the gamble pays off. On 21 October, however, it nearly went wrong for a lot of companies. What happened that day and what you could do about it is in the PHP vulnerability and your website.
An SLA with fixed parts: updates, monitoring, backups, security and a deadline to patch a critical vulnerability. Underneath, several monitoring tools and a website agent check versions, alerts and vulnerability news. You see it in your own dashboard, and if something is critical, the right person gets an alert straight away on their phone or by text.
We keep the server, the PHP version, the CMS, the plugins and the dependencies up to date. Most breaches happen through software nobody updated.
Several monitoring tools watch uptime, speed and anything unusual. You want to hear it before a customer sees it.
Backups stored away from the server, with a frequency and a restore procedure that we agree in the SLA. After a break-in, a backup on the same server is worth little.
We follow vulnerability news, watch for unusual activity on your site and limit access rights. With a critical vulnerability, every hour counts.
A fixed deadline to patch a critical vulnerability, not just to call back. We agree that deadline per site in the SLA.
A regular report on what we updated, what monitoring picked up and what still needs attention.
The website agent is software that checks your website. It looks at which versions are running, whether updates are waiting, whether there is news about a vulnerability in something your site uses, and whether monitoring sees anything odd. If it finds something, it prepares an alert with context for a developer. A person then decides and acts.
We chose that split on purpose. An agent never gets tired, but it should not change a live website on its own. For what an AI agent is and why limits matter, read what is an AI agent.
So the website agent is one part of the maintenance, not a replacement for it. Without a developer behind the alert, it is just a faster alarm.
Websites and online stores that we built ourselves, and sites we take over from someone else. That includes WordPress and WooCommerce sites, custom builds in Laravel or PHP, Next.js sites with a headless CMS such as Strapi, and Shopify stores. What we monitor and update differs per platform.
With a Shopify store, Shopify manages the server, but you still need to keep apps, themes and integrations up to date. A Next.js site mostly needs attention for dependencies and hosting. With WordPress, it is all about the PHP version, the theme and the plugins. What applies to your site becomes clear after the takeover check.
Are we still building your site? Then maintenance is part of the plan from launch day. See custom website development, ecommerce development and Next.js development.
Not sure who looks after your website right now? That is exactly the conversation we want to have. We go through your current arrangements, and you hear honestly what is missing.
In four steps, and the first is a check. If it shows overdue maintenance, such as a PHP version that no longer gets security updates, you hear that first. We fix it before the SLA starts.
We look at where your site runs, which PHP and CMS versions it uses, which plugins are installed, where the backups are and who has access. Then you hear what is overdue.
We agree what is included, who you call, within which timeframe a critical vulnerability must be patched and how you hear about it.
We set up monitoring, store backups away from the server, connect the website agent and decide who gets which alert.
Updates, alerts and a regular report on what we did, what monitoring picked up and what still needs attention.
Four questions we hear in almost every first conversation about maintenance.
That depends on the platform, the number of integrations, how often updates are needed and the deadlines you want in the SLA. A simple site on a standard CMS needs less work than an online store with links to stock and accounting systems.
After the takeover check, you get a proposal that fits what your site needs. Then compare that with what a day without your website costs, or a leaked customer list.
For any company whose website brings in customers, orders or enquiries, so also for a company with ten employees. An online store that is down for a day loses sales. A hacked site with a contact form leaks customer data. It makes most sense if:
At least four things: who keeps the server and the programming language up to date, within which timeframe someone patches a critical vulnerability, how you hear about it, and where a backup is stored away from your server.
A response time alone says little. You want a promise about patching, not only about calling back.
Not in a panic. A Next.js site or a Shopify store does not run on its own PHP server, but there too, dependencies, apps and integrations need keeping up to date. Every platform has its own weak spots. Choose on maintenance, not on last week's news.
No account manager. Your first conversation is with someone who does the work, often with one of the founders. After that you work with a dedicated team from our office in Amsterdam.
Updates to the server, PHP, CMS and plugins, monitoring of uptime and security, backups stored away from the server and a fixed timeframe for picking up outages or vulnerabilities. With us, a website agent also keeps watch and calls in a developer when something needs doing.
The principle is the same, the work differs. With WordPress, most of the work is in the PHP version, the theme and the plugins. With Shopify, Shopify manages the server, but apps and integrations still need updating.
Yes. We start with a takeover check of hosting, versions, plugins, backups and access. After that, you hear what is overdue and what goes into the SLA.
Software that checks versions, updates, alerts and vulnerability news, and calls in a developer when something needs doing. The agent does not change anything on your live website itself; a person decides.
Hosting is the place where your website runs. Maintenance is keeping everything that runs on it up to date. With shared hosting, the host updates the server, but not your CMS, plugins or code.
Your message goes straight to our team in Amsterdam.
