Website Maintenance Agency London

Dependency patching and security

WordPress sites had over 4,300 known vulnerabilities disclosed in 2024 per Patchstack's annual State of WordPress Security report, with the majority concentrated in third-party plugins. NPM dependency vulnerabilities affect React and Node projects at similar scale per the GitHub Security 2026 report. We patch dependencies monthly, audit security advisories weekly and apply emergency patches inside 24 hours when a CVE is rated high or critical. Automated PRs via Dependabot or Renovate flow into staging before production.

Uptime monitoring and alerts

Production sites monitored continuously via Better Stack, Pingdom or a custom Uptime Robot configuration. Alerts route to the engineer on call inside 60 seconds of detection. Major incident response runs from a published runbook. We target 99.99 percent monthly uptime on the Vercel and Cloudflare stack we deploy on, which equates to under 4 minutes 23 seconds of downtime per month per the official Vercel SLA documentation.

Feature backlog management

Most agency builds plateau because no one owns the post-launch roadmap. We manage a quarterly feature backlog in Linear or ClickUp with sized estimates, prioritisation against business goals and a visible cadence. Feature work ships in two-week sprints inside ongoing care plan retainers. Larger features (over 5 days) scope as separate projects to keep retainer budgets predictable.

Accessibility audits (annual minimum)

WCAG 2.2 AA is the current accessibility standard as of 2026 per W3C published recommendations. UK accessibility regulations under the Public Sector Bodies Accessibility Regulations 2018 still apply to public-facing sites. We run automated audits monthly via axe DevTools or Pa11y and manual audits annually via screen reader testing and keyboard navigation review. Issues triaged and fixed within agreed SLAs.

Performance reviews (quarterly)

Field data via the Chrome User Experience Report (CrUX) reviewed quarterly. Core Web Vitals scores tracked over time. Regression alerts triggered if LCP, INP or CLS drift above threshold. Performance fixes shipped as part of the care plan, not as separate projects. Most retained sites maintain green Core Web Vitals scores indefinitely because regression is caught early.

Emergency response and rollback

When something breaks, we respond. The on-call engineer acknowledges critical incidents inside 30 minutes during UK business hours and inside 60 minutes outside. Every deployment ships with a rollback plan. Disaster recovery runbook tested quarterly. Backups retained for 30 days minimum with point-in-time restore on database-backed sites.