Website Support and Maintenance in Kenya

A website is not finished at launch. Software needs updating and testing, backups need taking and verifying, and security needs monitoring. A Haryes care plan covers:

• Updates on staging first: WordPress core, theme, and plugin updates applied and tested on a staging copy before they touch the live site, covered on our WordPress maintenance page
• Daily off-site backups: with periodic restore tests, because an untested backup is not a backup
• Uptime and performance monitoring: alerts if the site goes down or slows below the Core Web Vitals thresholds
• Security hardening and scanning: with malware removal and blacklist recovery if needed, covered on our website security and malware removal page
• A content and design change allowance: a fixed number of hours a month for edits, new pages, and small design changes
• A monthly report: what was updated, what was changed, and any issues found

If your site is down, hacked, or lost, our emergency website recovery service diagnoses the cause, restores from the cleanest available backup or rebuilds critical pages, and gives you a written report of the entry point and a prevention plan. This is available as a one-off even if we did not build the site and you are not on a plan.

Get a Care Plan Quote →Report an Urgent Site Issue

We maintain WordPress and WooCommerce sites (whether built on a custom theme or a page builder) Shopify stores, static sites, and the custom-coded sites and applications we can safely support. We are upfront during onboarding if a site is on a platform or setup we cannot responsibly take on, rather than accepting the fee and hoping.

Almost every site we take over has “backups”, and on a significant share of them, the backup is incomplete, out of date, or cannot actually be restored. A backup you have never restored from is not protection; it is a hope.

On a Haryes plan, backups run daily to off-site storage, are kept for 30 days, and are periodically restored to a staging environment to confirm they work. If your site goes down, we are restoring from something we know is good, not finding out at the worst possible moment that it is corrupt.

A normal change request is handled within the plan’s stated turnaround, typically one to two business days. A site that is down, hacked, or showing a security warning is treated as urgent and takes priority regardless of tier. If you are not on a plan, emergency work is still available as a one-off, see emergency website recovery.

Every plan has a single route for reporting a problem and a named person who picks it up, rather than a general address that may or may not be watched. When you report something, you get an acknowledgement telling you whether it is being treated as urgent and roughly when to expect the fix.

Urgent means the site is down, checkout or forms are failing, or there is a security incident. Everything else is scheduled, and we would rather tell you a text change will be done on Thursday than promise immediately and miss it.

Performance is not a state you reach once. A site launched at under two seconds drifts: someone uploads a four-megabyte photograph straight from a phone, a marketing tag is added and then another, a plugin bundles its own copy of a library, and a year later the site takes six seconds on mobile data and nobody can point to the change that did it.

Maintenance includes watching for that drift rather than waiting for a complaint. Images are compressed and resized on upload, third-party scripts are reviewed before they are added and removed when the campaign that needed them ends, and Core Web Vitals are checked on a schedule so a regression is caught in the month it happens instead of during the next redesign.

Sites rarely fail dramatically. They fail in a handful of predictable ways, and almost all of them are preventable. A plugin updates and conflicts with the theme, so a form silently stops sending. A host upgrades its PHP version and a site running old code goes blank. An SSL certificate expires and every browser starts warning visitors away. A domain lapses because the renewal notice went to an email nobody checks.

• An update conflicts

  A plugin updates, the theme disagrees, and a form silently stops sending. Nobody notices until a customer calls.

• The server moves on

  The host upgrades PHP and a site running old code goes blank, or a certificate expires and browsers warn people away.

• A renewal is missed

  The domain lapses because the notice went to an email address nobody has checked since the site was built.

• Somebody changes something

  A section is deleted, a script doubles the page weight, or a host migration drops the redirects and the rankings with them.

The last group are people problems rather than software ones, which is why a plan is as much about record-keeping and access as it is about updates.

A maintenance plan exists to catch those before a customer does: updates applied in a tested order, uptime and certificate monitoring, domain renewals tracked, backups verified, and a record of who changed what. That is why the work looks quiet when it is going well.

The most common friction in maintenance relationships is scope. A client expects “support” to include a new page; the provider expected it to mean security updates. We define it in writing at the start.

Content changes are the small, regular things: updating text, swapping an image, adding a blog post, changing prices or opening hours, publishing a new team member. Those are covered by the monthly change allowance on your plan. Development changes are new functionality: a new template, a booking system, an integration, a redesign of a section. Those are quoted separately, because they are projects, not upkeep.

Where a client wants to handle content themselves, we set the site up so they can, with the editing interface built around their content types and a short training session recorded so new staff can watch it later. Paying us to change a phone number is a poor use of a retainer.

The single most damaging thing we encounter on takeover is a business that does not control its own domain. The site works, the emails work, and then a relationship ends and it turns out the domain is registered to a former developer who is not answering calls. Everything the business has built sits behind a name it does not own.

Part of onboarding is confirming that the domain is registered to your business, with your contact details, in an account you can log into, and that renewal is on a card or billing arrangement that will not lapse. Where it is not, we help move it, which with a KeNIC-accredited registrar is usually straightforward once the current holder cooperates.

We also document the DNS: where the site points, where email points, and which records exist for verification and sending. That document is what turns a future migration from a nervous evening into a routine task.

• Sites on a platform we do not support. We maintain WordPress, WooCommerce, Shopify, static sites, and custom-coded applications; anything outside that we will tell you about upfront rather than take on unsafely.
• Businesses wanting unlimited development under a maintenance fee. Plans include a set change allowance; larger work is quoted separately.
• Anyone looking only for the cheapest plan. A KES 2,000 plan that skips staging and restore tests is not protecting you.
• Full rebuilds. If the site needs replacing rather than maintaining, that is website redesign.