Essential Website Maintenance Services for Malaysian Businesses

"Website maintenance" is sold as a monthly line item far more often than it is defined. Before comparing suppliers, agree what work is inside the scope.

A defensible maintenance scope for a Malaysian small business covers five distinct jobs, each with published guidance behind it: keeping the TLS certificate valid, keeping the platform and its extensions updated, monitoring what Google can crawl and index, watching for performance and accessibility regressions, and holding backups you have actually restored from.

The rest of this guide takes each one in turn and states what the official documentation says, so you can write the scope rather than accept somebody else's. Costs and yearly budgeting are a separate question — our guide to website maintenance costs in Malaysia covers the budgeting side.

Sources: ^[1,2,3]

The padlock in the address bar comes from a TLS certificate, and certificates expire. When one lapses, browsers show a full-page security warning instead of your site — the most abrupt outage a small business can suffer.

Let's Encrypt, which issues certificates for a very large share of the web, states that it does not charge a fee for them. It also states the lifetimes plainly: default certificates are valid for 90 days, and subscribers can opt in to short-lived certificates valid for six days. It recommends renewing 90-day certificates every 60 days and six-day certificates every three days, and notes there is no way to adjust those lifetimes.

That is the entire argument for automation. A 90-day cycle is far too short to manage from a calendar reminder, and a six-day cycle is impossible to. So the maintenance question is not "how much does the certificate cost" but "which system renews it, what happens when a renewal fails, and who is alerted". Get that answer in writing.

Sources: ^[1]

If your site runs on WordPress, the update behaviour is documented rather than a matter of opinion. WordPress states that since version 3.7, most sites apply minor and security updates automatically in the background, while major feature releases still require someone to click Update. It also warns that the upgrade process affects all files and folders in the main installation, so modifications made directly to core files are lost, and it advises backing up the site before starting.

That produces three concrete maintenance duties. First, someone must be responsible for major-version updates, because those do not happen on their own. Second, plugins and themes need the same attention, and they are where most sites accumulate risk. Third, a backup must exist before every update, not after it.

If your site is on a different platform, the same three questions apply: what updates itself, what needs a human, and what is backed up before the change.

Sources: ^[2]

A site can be online and still be invisible. Search Console is the free tool that tells you the difference, and Google documents how to use it.

Getting started requires verifying site ownership. Once verified, the index coverage report shows the pages Google has indexed or tried to index and the errors it hit, and you can submit a sitemap so new pages are discovered faster. Google notes there is no need to sign in daily — it says you will receive an email alert when new issues are found, and suggests checking your account around once a month, or when you change the site's content.

For a maintenance agreement, that translates into a defined deliverable: ownership verified in an account your business controls, the sitemap submitted, alerts routed to a monitored mailbox, and a monthly look at coverage. Two of those are one-off setup; the rest is the recurring work you are paying for.

Sources: ^[3]

Sites do not usually get slower in one dramatic step. They drift — a new tracking script, an unoptimised image uploaded by a staff member, a plugin that adds a font.

Google publishes measurable targets to drift against: Largest Contentful Paint within the first 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and a Cumulative Layout Shift score under 0.1. Recording those three numbers for a fixed set of pages on a fixed cadence turns a vague "the site feels slower" into a comparison against last month.

Accessibility drifts the same way, and W3C's WCAG 2.2 principles — perceivable, operable, understandable, robust — give the recheck a defined scope. The practical recurring test is small: confirm the enquiry form can still be completed with a keyboard alone, that labels and focus states survived the last theme update, and that newly uploaded images still carry alternative text.

Sources: ^[4,5]

Once the work is defined, three commercial terms decide whether the agreement is worth anything.

Cadence. State what happens weekly, monthly and quarterly. Certificate renewal is automated and continuous. Plugin and platform updates are typically monthly, with security releases handled as they appear. Search Console coverage and performance readings fit a monthly rhythm, matching Google's own suggestion of checking around once a month or after a change.

Service level. Define what counts as an outage, how it is reported, the response time you are buying, and what falls outside the retainer. "Support included" without a response path is not a service level.

Handover. Your business should own the domain, hosting, source code, backups, analytics and Search Console. Ask for a written statement of where backups are stored, how long they are retained, and when one was last restored — an untested backup is an assumption, not a safeguard. Ask also what you would receive on the day the agreement ends.

Sources: ^[1,2,3]