What belongs in a maintenance contract for a landscaping website as a minimum?

Updates to core and extensions on a fixed cadence, daily backups with a retention period, a restore test at least twice a year, continuous availability checks, a monthly form test to a real mailbox, monitoring of the certificate expiry date and a quarterly link check. Plus a report that gives a date and a result for each task. Without that report the contract cannot be checked, and over the years what cannot be checked tends not to get done.

How do I tell for myself that nothing has been maintained for months?

Three tests are enough. Send a test enquiry through your own form and see whether it arrives in the mailbox. Call up two old addresses that existed before the last rebuild and check that they land correctly. Ask for the date of the last update. If none of the three answers contains a date, no care is taking place, regardless of what the invoice says.

Is it not enough if the backup runs automatically?

An automatic backup is the precondition, not the result. Only the restore test shows whether the snapshot is complete and can be read back in. Article 32(1)(c) GDPR expressly requires the ability to restore availability of and access to the data in a timely manner after an incident, and that ability is only demonstrated once it has actually been demonstrated. Twice a year on a separate address is a reasonable cadence for a landscaping site.

What happens if I skip maintenance altogether?

In the short term usually nothing visible — which is why the decision feels so easy. Over time the gap to the maintained state grows, and at some point the next version step is no longer an installation but a rebuild. The German Federal Office for Information Security records that known vulnerabilities in perimeter systems are far too often patched late or not at all; according to the same report, roughly 80 percent of the attacks reported to the authority in the reporting period were aimed at small and medium-sized companies. The risk does not rise suddenly, it rises slowly.

Who is liable if data is lost through the form?

The business operating the site remains the controller for the processing. The provider normally acts as a processor, and the division of duties belongs in writing. Section 19(4) of the German TDDDG requires measures that take the state of the art into account; Article 32(1)(d) GDPR requires a process for regularly testing their effectiveness. Both point in the same direction: the care has to happen, and it has to be documented.

Can I move the maintenance to another provider later?

That depends on who owns the domain, the hosting and the backups, and who holds the access. Settle it before the contract, not at the point of moving. What matters is that you can request a complete backup at any time and that it can be restored without the involvement of the previous provider. Both points are described in detail in our FAQ on where the website runs and on moving to another provider.

After launch: what website care actually covers

The site goes live, the photographs look right, the enquiry form gets tested once — and then nobody looks at it again for months. In May the owner is out in the yard sorting machines and appointments, and nobody notices that an update has been missing for eight weeks, or that the enquiry form has not delivered a single message since the last server move. Neither failure announces itself: an outdated extension looks exactly like a current one, and a form that delivers nothing still shows the sender a thank-you page. In the 2024/2025 reporting period an average of 119 new vulnerabilities per day (BSI) became known in IT systems, a growth of roughly 24 percent (BSI) over the period before. Website care is therefore not insurance without a claim; it is a set of recurring tasks on a fixed cadence. This article sets out what those tasks are, how often each falls due, what evidence you may ask for — and how to tell whether care is actually happening or merely being invoiced.

Key takeaways

Website care is not a subscription taken on faith. It is six recurring tasks: updates, backups with a restore test, uptime checks, a form test, certificate expiry monitoring and link checks.
A backup that has never been restored is an assumption. Only a restore test on a separate address shows whether the snapshot is complete and can be read back in.
The most expensive outages are the silent ones: a form that stops delivering, a redirect that was lost, a certificate that expires over the weekend. None of them reports itself to the owner.
Ask for a report that gives a date, a task and a result. A report that only says ‘all fine’ is not evidence, it is a claim.
The legal side is not a footnote: Section 19(4) of the German TDDDG requires measures that reflect the state of the art, and Article 32(1) GDPR requires a process for regularly testing their effectiveness.

Why a website does not stand still after launch

A website is not a sign on the yard gate. It is software running around the clock at a public address, and it is made of several moving parts: the content system, the extensions inside it, the programming language on the server, the database, the web server in front of it and the certificate that encrypts the connection. Every one of those parts keeps being developed by its maker, and every release contains fixes for places that were previously exposed. Do nothing and you are not running the site as it was on launch day. You are running it in a state that falls further behind what the makers have already repaired with every month that passes.

The scale can be put into numbers. The German Federal Office for Information Security describes Germany's web attack surface in the second quarter of 2025 as roughly 13.2 million (BSI) .de domains reachable from the internet. A landscaping site with forty subpages is part of that, and targets are not chosen by reputation but by machine: a scanner asks address after address which version is running where, and notes where a known gap is standing open. According to the same report, roughly 80 percent (BSI) of the attacks reported to the authority were aimed at small and medium-sized companies — that is, at exactly the firms that have neither an IT department nor anyone who reads vendor advisories in the evening.

The number of open doors grows faster than the number of firms. The authority also names what fails in practice: known vulnerabilities in perimeter systems are, in its words, far too often patched late or not at all. That sentence does not describe a sophisticated attack. It describes a task left undone — which is precisely where maintenance starts, and precisely where it can be measured.

The worse an attack surface is protected, the more likely a successful attack becomes.

German Federal Office for Information Security, The State of IT Security in Germany 2025 (translated from the German original)

The six tasks of ongoing care

Maintenance sounds like a subscription taken on faith for as long as nobody says what is inside it. So here is the list first, written the way it belongs in a contract: six recurring tasks, each with a cadence and a result you can show. An owner who asks a provider about these six points is not having a technical conversation, he is running an acceptance check. Who is responsible for what during ongoing operation is set out in the FAQ on updates and backups.

Install updates

Bring the core, the extensions and the server packages to the version the maker supports — first on a copy, then live. Cadence: monthly, and immediately for a gap reported as critical. Evidence: a list of installed versions with dates.

Back up and restore

Write files and database to a location that is not on the same server — and actually restore one snapshot to a test address at least twice a year. Cadence: back up daily, test twice a year. Evidence: the date and result of the restore test.

Check availability

Call the home page and two subpages from outside at short intervals and record the response code. An outage on a Saturday evening only becomes an incident once somebody notices it. Cadence: continuous. Evidence: downtime for the month in minutes.

Run a form test

Send a real test enquiry through the form and check that it arrives in the mailbox — not merely that the thank-you page appears. Cadence: monthly, and after every change on the server. Evidence: the timestamp of the delivered test message.

Watch the certificate

The certificate for the encrypted connection has a fixed lifetime and is usually renewed automatically. Automatic does not mean unobserved: renewal needs a deadline and an alarm that fires well in advance. Cadence: continuous. Evidence: expiry date and date of the last renewal.

Keep links working

Internal links break when a page is renamed, and external ones disappear without notice. That includes the entries elsewhere that point at your site. Cadence: quarterly. Evidence: a list of the broken links found and the ones repaired.

None of these six points is an emergency. Every one of them becomes one if it is left alone for long enough. That is the difference between care and repair: care costs a predictable small amount and happens when it fits the calendar. Repair costs an unpredictable large amount and happens when the owner is standing on a building site in May.

Care is not development

New project photographs, another service text, one more region: that is work on the content, not on the operation. The two belong in separate contract items, otherwise care disappears behind wishes — or the other way round. How new reference projects reach the site later is covered in the FAQ on new projects; what ongoing support includes is set out on the maintenance page.

A backup without a restore test is not a backup

Almost every provider takes backups. The question that matters is a different one: when was one of those backups last restored? A backup only becomes a usable snapshot once somebody has unpacked it and looked at it. Until then it is a file of plausible size. The surprises are usually mundane. The database is there but the uploaded images are missing. Or the images are there but the database was copied mid-write and cannot be read back in. Or everything is there but nobody knows the access to the storage location any more.

That is why a backup always belongs with a test. It runs on a separate address that is not publicly reachable, rarely takes more than an hour for a landscaping site, and ends with a sentence you can write down: snapshot from this date, restored on that date, home page, service page, portfolio gallery and enquiry form checked. That one line is the difference between a maintenance contract and a maintenance invoice. For personal data, Article 32(1) GDPR expressly requires a process for exactly this — more on that below.

What is backed up	Sensible cadence	How you recognise the test
Database with texts, page structure and form submissions	daily, kept for thirty days	The restored copy does not yet contain an article that was published after the snapshot date.
Uploaded files: project photographs, quotations as PDF, logos	daily, kept for thirty days	An image from the portfolio gallery opens at full resolution on the test address.
Program state of core and extensions	before every update	The version list on the test address matches the state before the update was installed.
Server configuration and redirects	monthly	An old address from the last rebuild still lands correctly on the test address.
Access credentials and certificate keys	whenever they change	The storage location sits apart from the server and at least two people can reach it.

One point many firms only clarify in an emergency: where do the backups sit, and who owns them? If the storage location belongs to the provider and only the provider knows the access, the backup is worth something for exactly as long as the business relationship lasts. Both questions are answered in advance: where the website runs and who owns it and what happens if you move to another provider.

The silent failures: form, redirect, certificate

A total outage is unpleasant but honest: the site is gone, somebody rings, it gets fixed. The expensive failures are the ones that look like normal operation. They do not cost you an alarm, they cost you enquiries — and those are only missed in winter, when somebody goes through the summer's job list and wonders.

The form stops delivering. After a server move, a changed sender address or a new rule at the mailbox provider, enquiries vanish between send and inbox. The sender sees the thank-you page and waits for an answer that never comes. The only thing that makes this visible is a real test enquiry, not the fact that the page loads.
A redirect has been lost. During the last rebuild an old address was redirected to the new one. If that rule is not carried over during a server migration, links from directories, old quotations and search results run into nothing. Why this hits visibility is covered in the article on relaunching without losing rankings.
The certificate expires. Renewal is usually automated, but the automation depends on a service that can fail itself. If the certificate runs out, every browser shows a warning page instead of your home page — on a Saturday in June, when nobody is looking.
An embedded component stops loading. Map extracts, fonts and review widgets disappear without notice. After that the site looks different on a phone than on the office screen, and nobody notices because nobody opens it on a phone. Why the phone view is the normal case is covered in the article on being mobile first from the site.
A switch from the build phase is still set. Before launch the site was set to ‘do not add to the index’. If that switch is forgotten when the site goes live, the page is technically sound and still cannot be found. It is the only point on this list that is created on launch day itself — and the one that stays undetected longest.

All five points share the same pattern: the business notices nothing because there is no feedback. That is why the form test is not a luxury but the single most important task for a firm that receives enquiries through its website. What a form has to do beyond delivering — so that an enquiry turns into a usable appointment — is covered in the article on an enquiry form that qualifies.

The test goes to a real mailbox

A test enquiry sent to the same address as customer enquiries checks the whole chain: form, dispatch, delivery, filter, mailbox. A test that only lands in the server log checks half of it. And an owner standing on a building site in May needs the enquiry on the phone, not in a log file.

What the law actually requires

Maintenance is not only commercially sensible, it also has a legal side — and that side is more concrete than many firms assume. Section 19(4) of the German TDDDG obliges providers of digital services to take technical and organisational measures, and the legislator did not have launch day in mind: measures under sentence 1 must take the state of the art into account. The state of the art changes; a measure that takes it into account therefore has to be kept up to date.

Article 32(1) GDPR is clearer still as soon as personal data is processed through the site — and every enquiry form does exactly that. The regulation names three points that describe directly what maintenance delivers:

Ongoing assurance. What is required is the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services (Article 32(1)(b) GDPR). The decisive word is ‘ongoing’: it does not mean the day of handover.
Restoration after an incident. What is required is the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident (Article 32(1)(c) GDPR). That is the backup — specifically the one somebody knows can be restored.
Regular testing. What is required is a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing (Article 32(1)(d) GDPR). A process is a cadence with a record, not a good intention.

That makes the maintenance report not only evidence for the owner but also the evidence the regulation has in mind. Which further obligations apply when handling form data — records, retention, processing on behalf — is covered in the article on data protection for trade websites.

The yearly rhythm of website care

A maintenance contract becomes tangible when it is written as a calendar rather than as a list of services. For a landscaping website with service pages, a portfolio gallery and an enquiry form, the rhythm looks like this:

Step 1

Every month

Install updates after they have run on a copy. Send a test enquiry through the form and confirm delivery in the mailbox. Compile the downtime for the month. The result is a short report with date, task and finding — no more than a single page.

The yearly rhythm has an operational side effect that many firms underestimate: it puts the demanding work into the months when there is less on anyway, and keeps May free. Which content is due in autumn regardless is covered in the article on autumn work on your website; firms that expect storm callouts in autumn will find the page structure for it in the article on a callout page for the windy months.

The appointment sits before the season, not after it

Anyone who puts the big maintenance appointment ‘after the season’ tends to push it into the following winter. A fixed month in the contract — every February, for instance — is the only arrangement that works without a reminder. The same applies to topics tied to a time of year, such as when blowers and trimmers may run in residential areas.

How to tell whether care is happening

You do not need to read server logs to check that a site is being looked after. It is enough to ask for results rather than activities. These eight questions take ten minutes to ask, and the answers say more than any list of services:

Which versions were installed last quarter, and on what date?
When did the last restore test run, and which pages were checked?
How many minutes was the site unreachable last month?
When did a test enquiry last arrive in the mailbox through the form?
When does the current certificate expire, and who receives the warning beforehand?
Where are the backups kept, how long are they retained, and who has access?
Which broken links were found most recently, and what became of them?
What happens if there is an incident at the weekend, and which number does the alert reach?

A provider who looks after a site answers these questions from the report. A provider who only invoices answers them with ‘it was all fine’. The difference is not in the tone but in whether a date and a result were written down. A usable monthly report does not run to ten pages; it has this structure:

maintenance-report-2026-09.json

{
  "period": "2026-09-01 to 2026-09-30",
  "updates": [
    { "part": "content system", "from": "6.8.1", "to": "6.8.3", "date": "2026-09-09" },
    { "part": "form extension", "from": "3.2.0", "to": "3.2.1", "date": "2026-09-09" }
  ],
  "backup": { "retention_days": 30, "latest": "2026-09-30", "storage": "separate location" },
  "restore_test": { "date": "2026-08-14", "checked": ["home", "services", "gallery", "form"], "result": "complete" },
  "availability": { "probes": 8640, "downtime_minutes": 11, "longest_outage": "2026-09-17 03:12" },
  "form_test": { "sent": "2026-09-09 08:41", "delivered": "2026-09-09 08:41", "mailbox": "enquiries" },
  "certificate": { "expires": "2026-11-28", "last_renewal": "2026-08-30", "warn_days_before": 30 },
  "links": { "checked": 214, "broken": 2, "repaired": 2 }
}

The values in it come from a template and are not measurements of your site; what matters is the structure. Every line names a task, a date and a result. Whatever is not in there did not happen — and it is exactly that inversion that turns the report into a means of checking rather than a means of reassurance.

What care costs and what is inside it

The most common objection to maintenance almost always arrives in the same form: but the site is up. Behind it sits the assumption that a recurring fee pays for a state. What it actually pays for is a cadence, and that cadence replaces a cost item that would otherwise arrive irregularly and unannounced. Restoring a site after an incident costs not only money but the days on which no enquiries come in — and in May those are the most expensive days of the year.

What is included in ongoing operation and what is billed separately is set out openly on the pricing page; which items continue to run at all after launch — domain, hosting, certificate, care — is answered in the FAQ on costs that continue after launch. Whether and for how long such a contract commits you is set out in the FAQ on the minimum term — a point that belongs before the signature, not in a footnote. The underlying question of whether a website makes more sense as a fixed price or as a recurring fee is covered in the article on what a website really costs.

If you want to check where you stand today, you do not need an appointment for it: put the eight questions from the previous section to your current provider. If an answer comes back with a date, all is well. If none comes back, you know where you stand. What we take on as part of maintenance is exactly this list together with the report; the corresponding pricing is published, and for an assessment of your current position a message through the contact form is enough.

Sources and legal basis

This article draws on: German Federal Office for Information Security, ‘The State of IT Security in Germany 2025’ (summary, as of October 2025, reporting period 1 July 2024 to 30 June 2025); Section 19(4) of the German TDDDG in the version published at gesetze-im-internet.de; Regulation (EU) 2016/679 (GDPR), Article 32(1), via EUR-Lex. Every figure and quotation in this article is recorded with its source and location, and each deep link was checked in September 2026. German-language quotations are cited in the original wording in the German version of this article.