Launch day can feel like the finish line. The application works, users are trained and the invoices are paid. But software is not like a building that stands unchanged for decades. The environment around it changes constantly: browsers update, security vulnerabilities are discovered, third-party services change their APIs, and your business itself moves on. Web application maintenance is the ongoing work that keeps your system secure, working and useful. This article explains what it involves, what happens when it is skipped and how to plan for it.
Why software "wears out" without changing
Your code does not change by itself, yet an unmaintained application slowly degrades. The reasons are all external:
- Dependencies age. A modern web application relies on a programming language, a framework, dozens or hundreds of open-source packages, a database and a server operating system. Each has its own release and support cycle, and old versions eventually stop receiving security fixes.
- New vulnerabilities are found. Security researchers and attackers continually discover weaknesses in widely used software. Code that was considered safe at launch may have a published vulnerability a year later.
- Integrations change. Payment gateways, SMS providers, mapping services and accounting platforms retire old API versions, sometimes with only months of notice.
- Browsers evolve. Browser updates occasionally change behaviour that older front-end code relied on.
- Data grows. Queries that were instant with a thousand records can crawl with a million.
- Certificates and domains expire. SSL certificates, domain registrations and API credentials all have renewal dates.
The four kinds of web application maintenance
Software engineers commonly group maintenance into four types. It is a useful way to see where effort goes:
| Type | What it covers | Example |
|---|---|---|
| Corrective | Fixing bugs found in use | A report shows the wrong total for a particular date range |
| Adaptive | Keeping up with a changing environment | Upgrading to a supported framework version, or moving to a payment gateway's new API |
| Perfective | Improving and extending based on user needs | Adding a filter users keep asking for, speeding up a slow screen |
| Preventive | Reducing future problems | Adding automated tests, cleaning up fragile code, improving monitoring |
Businesses often budget only for corrective work ("fix it when it breaks"). In practice, adaptive and preventive work are what stop things breaking in the first place.
What a sensible maintenance routine includes
Continuously
- Uptime and error monitoring with alerts, so problems are found before customers report them.
- Automated, off-site backups, and regular test restores. A backup that has never been restored is a hope, not a plan.
Monthly or so
- Apply security patches to the server operating system, web server, language runtime and database.
- Update application dependencies with known vulnerabilities, using automated dependency scanning to flag them.
- Review error logs and slow-query logs for emerging problems.
- Check certificate, domain and credential expiry dates. Our free SSL checker shows when a certificate expires.
Quarterly or twice a year
- Review user access: remove accounts for people who have left and check admin permissions.
- Check security headers and configuration; the HTTP header checker is a quick way to spot missing protections.
- Review database size and performance, and archive old data where appropriate.
- Check announcements from integrated services for upcoming API changes.
Yearly
- Plan framework and language upgrades before current versions reach end of support.
- Review hosting capacity and costs against actual usage.
- Rehearse disaster recovery: could you rebuild the system on a new server from backups and documentation?
What happens when maintenance is skipped
The costs of neglect are rarely immediate, which is why maintenance is easy to defer. They tend to arrive together:
- Security incidents. Outdated software with known vulnerabilities is one of the most common ways systems are compromised.
- Sudden outages when an integration's old API is switched off or a certificate expires.
- Expensive catch-up upgrades. Skipping several major framework versions turns a series of manageable upgrades into a large, risky project, sometimes close to a rewrite.
- Hosting dead ends. Old runtime versions may not be available on modern servers, trapping the application on ageing infrastructure.
- Lost knowledge. If nobody has touched the code for years, the next change starts with relearning the whole system.
Budgeting for maintenance
There is no universal figure, because the effort depends on the size of the application, the number of dependencies and integrations, how critical it is and how much new development you want. Many organisations plan an annual maintenance budget as a proportion of the original build cost, with higher proportions for complex or business-critical systems. Ask your development partner for a recommendation based on your actual system, and separate three things in the agreement:
- Essential upkeep: patching, monitoring, backups and upgrades.
- Support: response to bugs and incidents, with agreed response times by severity.
- Enhancements: new features, prioritised and estimated separately.
Questions to ask about a maintenance agreement
- What is monitored, and who is alerted out of hours?
- How are backups taken, where are they stored and how often are restores tested?
- How quickly are critical security patches applied?
- How are framework upgrades planned and communicated?
- Do we hold the source code, server access and documentation in case we change provider?
Server-level upkeep is covered by our server management service, while application-level fixes and upgrades sit with the development team; make sure your arrangements cover both layers.
Key takeaways
- Applications degrade because their environment changes, even if their code does not.
- Maintenance covers corrective, adaptive, perfective and preventive work.
- Monitoring, tested backups, regular patching and planned upgrades prevent most emergencies.
- Budget for maintenance from the start and agree clearly what it includes.