A few years ago, building a website took weeks of design and development. Today, AI tools and site builders can produce a working first version in hours. This is useful, and it changes where most of the effort goes.
A website is not finished on launch day. It runs for years, and during those years it needs updates, security, access control, working email and someone who is responsible for it. This article describes what happens to a typical business website after launch, and what needs to be in place.
The first build is now the easy part
AI can write code, generate layouts and draft the text for a new site. A developer who uses these tools well can deliver a first version quickly.
AI does not look after the site once it is live. It does not apply the next security update, renew the domain, notice that the contact form has stopped sending email, or remove the login of a staff member who left last month. These tasks decide whether a website keeps working for the business.
What happens in the first two years
A business website changes a lot in its first two years, even if nobody edits a page.
- Software updates. WordPress, its plugins and the PHP version on the server all receive regular updates. Some fix security problems. Others change how features work. An update applied without checking can break a layout or a form.
- Security patches. New vulnerabilities are published every week. Sites that are not updated are the ones that get hacked, often through a plugin that nobody remembers installing.
- Certificate renewals. The SSL certificate that shows the padlock in the browser expires and must renew automatically. When renewal fails, visitors see a security warning instead of your site.
- Integrations that change. Payment gateways, CRMs, mailing list tools and map services change their systems. When they do, the connection on your site can stop working without any visible error.
- People who leave. The staff member who set up the site, or the freelancer who built it, moves to another job. Often nobody else has the logins or knows how the site was set up.
None of this is unusual. It happens to every website that stays online.
Different people need different access
As a business grows, more people work on its website. Each person needs access to some parts of it and not to others:
- Marketing staff edit pages and publish articles.
- Sales staff manage form submissions and the CRM connection.
- Finance staff need reports from the online shop.
- An outside SEO consultant or designer needs temporary access for a project.
Each person should have their own account, with only the permissions their role needs. With shared logins, nobody can tell who changed what, and access cannot be removed from one person without changing it for everyone. Every account should use two-factor login. When someone leaves the business or a project ends, their access should be removed the same day.
This sounds simple. Old administrator accounts for former staff and contractors are still one of the most common security risks on business websites.
Who owns your domain and DNS
Your domain name is the most important part of your online presence, because your website and your email both depend on it. Check these points:
- The domain is registered to the business. It should not be registered in the name of a former employee, a web designer or an agency you no longer use.
- You can log in to the registrar. Someone in the business should know where the domain is registered and have access to that account.
- Renewal is automatic, and the contact details are current. An expired domain takes your website and your email offline. Renewal notices sent to an old email address are a common cause.
- DNS changes are recorded. DNS records connect your domain to your website, your email and other services. Each change should be written down with the date and the reason. Without a record, nobody knows which entries are still needed.
Email that arrives
Your domain’s DNS also controls your email. The MX records decide where your mail is delivered. The SPF, DKIM and DMARC records tell other mail servers which services may send mail as your domain.
When these records are wrong or incomplete, messages from your website, your office email or your newsletter tool arrive in spam folders or are rejected. Our article Why do emails from my website go to spam? explains how to check and fix this.
Backups, monitoring and hosting
A backup is only useful if it can be restored. Backups should run automatically, be stored away from the web server, and be tested by restoring them from time to time.
Monitoring tells you about a problem before your customers report it. Uptime checks, certificate expiry alerts and checks that your forms still deliver email catch the most common failures.
Hosting also needs an owner. Someone must keep the server’s software current, watch its disk space and memory, and act when something goes wrong. Our hosting page explains how we do this for the sites we host.
Staying visible in search and AI answers
Search engines and AI assistants favour sites that are fast, clear and up to date. Over two years, a site often becomes slower as images, plugins and scripts are added. Content goes out of date, and structured data can stop matching the page.
A yearly review keeps these in order. Check the site’s speed, remove old content, update service and contact details, and make sure the structured data still describes the business correctly. You can test your site’s speed now with our free speed check.
One team that knows the site
Most problems after launch are quick to fix when someone knows the site’s history. They take much longer when nobody does.
A dedicated agency provides that continuity. The same team keeps the documentation, knows how the site was built, stores the logins securely and responds when something needs attention. When a new person joins your business, the agency sets up their access. When a supplier changes a system, the agency updates the connection.
This work keeps a website useful for years after launch day. AI tools and site builders do not do it for you.
A checklist for business owners
- The domain is registered to the business, and renewal is automatic.
- At least one person in the business can log in to the registrar, the hosting and the website.
- Every person with access has their own account and uses two-factor login.
- Former staff and contractors no longer have access.
- DNS changes are recorded.
- SPF, DKIM and DMARC are set up, and your website’s email passes all three.
- Backups run automatically and have been restored at least once as a test.
- A named person or company is responsible for updates and monitoring.
- The site has been checked for speed and outdated content in the last year.
If some of these items are not in place, contact us. We will review your website, domain and email setup and tell you what needs attention. For a new site, see our web development page.
Filed under Hosting & Managed Servers, Web Development.