Most businesses build a website, hand over the login, and never think about it again. The site looks fine. The contact form works, mostly. Then one morning it doesn’t load, or every email the sales team sends lands in spam, and nobody knows who to call. A website maintenance plan exists to prevent that morning. According to the developer who builds M2 Technology’s own site, “set it and forget it” is one of the riskiest things a business can do online.
On this episode of IT Unplugged, Brandon sits down with Wyatt, co-founder and full stack developer at WiscWebs. WiscWebs is the web development and marketing partner behind both M2 Technology and M2 Logistics. Wyatt brings 15 years of development experience and a direct take on where most websites fall short. They cover why security matters even when nobody visits your site and what a backup actually protects you from. They also get into the DNS records your developer may have never set up, and a monthly-to-yearly website maintenance plan any business can follow. Watch the full conversation below, or keep reading for the takeaways.
Why a Website Maintenance Plan Matters Even If Nobody Visits
The most common objection Wyatt hears is the one that sounds most reasonable. Nobody goes to my website, so why pay for maintenance or security scans? His answer doesn’t leave much room. “It doesn’t matter how big or small your website is,” he says. “If there’s a vulnerability that can be taken advantage of, it’s going to be found eventually.” Small websites get hacked because automated scanners find vulnerabilities regardless of traffic or company size. Some attackers aren’t after money at all. Sometimes they’re doing it for fun. Other times they compromise a small site so they can use it in a future attack on a bigger target.
That reality is what a maintenance plan answers. A website maintenance plan is a schedule of updates, security scans, backups, and audits that keeps a site secure after launch. Without one, the site you paid for in January is an unpatched server by June.
Wyatt also names where the plan usually goes missing. Two kinds of developers dominate the market: the single freelancer and the large agency that subcontracts everything. Both will build you a site that looks good and works on launch day. Then, in Wyatt’s words, “that’s the last time you’ll hear from them.” You’re left managing something you’ve never managed, with no idea what to do. Brandon describes M2’s own search for a partner before WiscWebs: one-person shops that couldn’t hold a business conversation, and a large team whose actual builders and email specialists turned out to be subcontractors in other states. Neither model leaves anyone accountable once the site is live.
For a Sheboygan retailer that assumed the developer was still watching, that gap only becomes visible after something breaks. M2’s managed cybersecurity services exist for the same reason on the network side: the tools matter less than whether anyone is still paying attention.
Custom Code vs. the Theme Everyone Else Bought
One more reason the plan matters is what’s underneath the site. Most WordPress sites run on a visual editor and a purchased theme. That’s why so many competitors’ sites look identical once you swap the photos. WiscWebs writes its themes custom, so the code serves one client and nobody else on the internet shares the design. Beyond standing out, custom code means the developer knows every line, which makes the yearly audit described below a real review rather than a guess.
What Website Backups Actually Protect You From
Wyatt puts backups at the top of the list. “Backups are probably the most important aspect of security,” he says, because when something goes wrong, you want to restore the site. His definition is refreshingly plain. A website backup is a saved copy of your site, stored somewhere safe even if attackers take over the server. The location matters as much as the copy. If the backup lives on the same server the attacker just took over, it isn’t a backup.
Brandon asks for the worst case, and Wyatt gives it. Attackers compromise your site and there’s no backup. You lose everything on the server. There’s no way to restore, so you start from scratch. For an e-commerce store, that means more than a rebuild. An e-commerce site without a backup loses its order history, customer data, and ability to fulfill purchases after a hack. Those customers will not be forgiving, even if the site comes back the next day. Because the store holds payment processor access and personal information, the exposure can extend to lawsuits and regulatory penalties on top of lost sales.
If that sounds familiar, it should. The WordPress Advanced Administration Handbook makes the same point: security is about reducing risk and planning for recovery. It’s exactly how M2 treats every other system a business depends on. The guide to cloud backup for Wisconsin businesses covers the same rules for servers and files. Meanwhile, the Microsoft 365 backup guide explains why “the platform handles it” is the same false comfort for email that it is for websites.
One more thing separates a real backup from a hopeful one: someone has restored from it. Wyatt’s team teaches clients to run their own backups and updates, which is unusual in an industry that prefers to keep owners dependent. The point isn’t that you should do it all yourself. It’s that you should understand it well enough to know whether it’s happening. Ask your developer when they last tested a restore, where the copies live, and how many they keep. If the answer is a shrug, your website maintenance plan has a hole in the most important place.
DNS, SPF, and DMARC in Plain English
Brandon raises a problem M2 Technology runs into constantly. Clients ask for help with DNS, SPF, or DMARC. Their web developer has already told them “we don’t really touch that.” Wyatt hears the same question, and he answers it without jargon.
DNS stands for domain name system. DNS is the system that tells the rest of the internet where your website and email actually live. Every time someone types your domain, a DNS record handles the request. The records that cause the most confusion are the ones tied to email. SPF, DKIM, and DMARC are security measures that prove an email claiming to come from your domain actually did. They exist to stop spoofing and to keep your messages out of the spam folder.
This stopped being optional a while ago. Under Google’s email sender guidelines, anyone sending to Gmail addresses must authenticate with SPF or DKIM. Senders above 5,000 messages a day must have all three records in place. Wyatt puts it simply: providers “will just automatically reject your email” if the records aren’t there. Email lands in spam when the sending domain lacks the SPF, DKIM, and DMARC records that prove it is legitimate.
Brandon’s example is the one that lands with salespeople. Imagine finding out that for six months, your emails never reached the inbox, and that’s why the prospect in Neenah stopped calling back. Nobody attributes a quiet pipeline to a DNS record. That’s why M2 includes email authentication in its cybersecurity requirements for Wisconsin businesses. A good web partner treats those records as part of the build rather than someone else’s problem. A good website maintenance plan also checks them every quarter, because a new email tool or a new mail server can quietly break them.
The Monthly, Quarterly, and Yearly Website Maintenance Checklist
Brandon asks the question every owner should ask: what’s the actual game plan after launch? Wyatt starts with the foundation, a securely built site, and then lays out a schedule. Here it is as a website maintenance checklist:
- Monthly: Update WordPress core, every plugin, and the theme. Run a security scan to catch any files someone tampered with after reaching the server.
- Quarterly: Audit the site. Check that forms submit, links resolve, pages load quickly, and nothing has drifted from the original build.
- Yearly: Run a deeper audit. Have a developer review the code files themselves and confirm everything still holds up.
The monthly step carries most of the weight. Monthly website maintenance means updating WordPress, plugins, and themes and running a security scan for tampered files. WordPress’s own security documentation calls keeping core, plugins, and themes current the single most important thing a site owner can do.
Notice how familiar that cadence is. Patch monthly, review quarterly, audit yearly is the rhythm M2 Technology runs for servers, workstations, and firewalls through its managed IT services. A website is one more system on that list, not a finished product. Websites require the same patching and monitoring discipline as any other business system, because attackers exploit unpatched software. A Kaukauna manufacturer wouldn’t leave a server unpatched for a year; the company website deserves the same standard. If you’ve never had a partner who stuck around after launch, this checklist is what to ask for. If your current developer went quiet after the invoice cleared, this is what you’re missing. A Sheboygan clinic with an eight-year-old site should ask when anyone last updated its plugins, and should expect a date, not a guess.
Where AI Helps a Developer, and Where It Falls Flat
Brandon asks the question he’s seen in ads. Does anyone even need a developer anymore, or can you paste a request into a chatbot and get a website? Wyatt uses AI nearly every day, and he’s specific about what it’s good for. It works as a sounding board on a broken block of code. It handles repetitive tasks, the “do this 600 times” jobs nobody wants. AI helps developers most as a sounding board for small code problems and a tool for repetitive tasks.
Asking it to write a whole program “just doesn’t work,” he says. The trend worrying him is junior developers trying to build entire sites with AI. They end up spending all day auditing the output instead of learning to code. Developers who build entire websites with AI spend their days auditing generated code instead of writing it. Brandon, who once taught high school coding, recognizes the upside: finding the one missing semicolon in 40 lines is exactly the job AI does well. The conclusion matches what CJ said on the SEO episode a few weeks earlier. The tools accelerate the middle of the work; a person still owns the beginning and the end. For a business owner, the practical takeaway is simpler. Ask whoever builds or maintains your site who reviews the code a machine wrote, because somebody has to.
For the business that has never had a web partner, the checklist above doubles as an interview script. Ask any developer to walk through their monthly, quarterly, and yearly work before you sign. For the business already paying one, it’s a scorecard. Either way, the answer should sound like Wyatt’s, with specific tasks on a specific calendar.
M2 Technology started IT Unplugged for conversations like this one, and new episodes post on the IT Unplugged channel. You can learn more about Wyatt’s work at WiscWebs.
Final Thoughts
A website is infrastructure. It runs on software, that software has vulnerabilities, and scanners find those vulnerabilities whether or not anyone is looking at your site. Treating it as a finished product is how a business ends up with an unpatched server it happens to call its homepage.
If you haven’t thought about your website’s security since it launched, or your developer stopped answering after the last invoice, the fix isn’t complicated. It’s a schedule and a person who follows it. M2 works that way across everything it manages, and it works with partners like WiscWebs who do the same for the web.
Anyone can build you a site. The question is who’s still there in month six, and whether they have a website maintenance plan written down. Chat with an expert today.