Website Hosting and Maintenance
Exodesk provides website hosting and maintenance for New Zealand businesses. We agree who looks after your website, software updates, certificate renewal, monitoring and backup, with clear contacts and access arrangements.
Our Christchurch and Dunedin teams review your current platform and supplier setup, then confirm the ongoing support and any takeover work required. The scope sets out supported software, service hours, exclusions and responsibilities before work starts.
Tell us about your website, your current provider and what you need looked after
What does website hosting and maintenance cover?
Website hosting and maintenance covers the environment a business website runs on and the agreed work that keeps it current and recoverable: software updates, certificate renewal, monitoring, backup and access control.
Hosting provides the server or platform account the site runs in. Maintenance is the agreed work on top of it. The split between Exodesk, your hosting or platform provider and any web developer is written down, so you know who to contact and who controls each part of the site.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. Domain registration, renewal and DNS sit with our domain name management service, which links up with this one wherever your domain points at the site.
Hosting and maintenance in one agreed scope
Website hosting and maintenance starts with a list of what is supported: the site, its software and versions, the hosting or platform account, and the functions that matter, such as enquiry forms.
Hosting environment
The hosting provider, location, capacity, supported runtime and who controls the service account, confirmed in the scope.
Software updates
Routine updates to the site software, themes and extensions. PHP security updates are included where we manage the hosting and confirmed with your host where we do not. Urgent security fixes are assessed promptly.
Certificate renewal
Automated renewal with validation, deployment and failure alerts checked, wherever the certificate is managed.
Agreed checks
Checks on the agreed pages and functions, with alerts going to a named owner during agreed hours.
Backup and restore
A copy kept away from the live site, with retention set and restores tested on an isolated copy.
Access and records
Named accounts, MFA where supported and a documented record of who controls each part of the site.
Content changes, design, development, SEO, accessibility work, online store integrations and incident clean-up are not assumed. We state what is included and what is quoted separately, along with support hours, response and restoration expectations, and exclusions. Our IT services page covers the rest of what we support.
Know who controls each part of your site
Website hosting and maintenance depends on access. Treat domain and DNS, the hosting or platform account, site administration, and the certificate and CDN as a checklist of responsibility areas, not a count of separate logins.
Depending on the setup, the list also covers backups, source code, licences, form delivery and any integrations. A managed reseller service may not give each customer the master hosting account, so the aim is documented ownership or entitlement, customer-level access where available and a recoverable exit route.
- Business access. Customer-level accounts where the service offers them, with ownership or entitlement documented
- Supplier access. Named accounts for each supplier, scoped to the work, with MFA where supported
- Credentials. Stored in an approved password manager rather than in email or shared documents
- Recovery. Billing emails and proof of payment alone do not establish ownership; recovery follows the identity and authority checks of each supplier
Where a developer built the site, section 21(3) of the Copyright Act 1994 makes the commissioner of certain works, including computer programs, the first copyright owner where they pay or agree to pay and the work is made under that commission. This is subject to any contrary agreement under section 21(4), and it does not establish ownership of every website asset or third-party component, so confirm rights to custom code, themes, plugins, images, copy and licences, along with access and export rights.
Updates and certificate renewal
A routine update schedule keeps the site current, but security fixes are assessed on urgency, exposure and vendor advice, then patched or mitigated promptly under the agreed process rather than held for the next monthly slot.
- Before changes. A backup or rollback point, with compatibility checked for custom code and extensions
- After changes. Functional checks on the agreed pages, forms and integrations
- Automatic updates. Used where the software supports them and they suit the site, with success checked rather than assumed
- Abandoned components. Extensions their author no longer maintains are identified, then replaced or removed as scoped work
How long does a TLS certificate last now?
The CA/Browser Forum Baseline Requirements set the maximum validity of public TLS certificates by issue date. Certificates already issued under earlier rules are not shortened retrospectively.
| Certificate issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 to 14 March 2027 | 200 days |
| 15 March 2027 to 14 March 2029 | 100 days |
| From 15 March 2029 | 47 days |
Providers can issue shorter certificates. Let’s Encrypt has issued 90-day certificates by default and plans to move its default to 64 days from 10 February 2027.
ACME is a common way to automate issuance and renewal, but a working renewal also needs successful validation, deployment and an alert when it fails. The certificate may be managed through the host, a CDN or the website platform rather than a separate account.
An expired certificate can trigger browser warnings or blocked connections and interrupt enquiries. Expiry alone does not prove a breach, and it does not rule one out. Restoring a valid certificate depends on access, validation, configuration and the cause of the failure. A certificate protects the connection; it does not show that the site itself is free of malicious code.
PHP security updates: what should your website provider confirm?
PHP is the software that runs many websites behind the scenes. Updating WordPress, a theme or a plugin does not update PHP, so its status needs to be confirmed separately.
Advisory checked 4 November 2026. In October, New Zealand’s National Cyber Security Centre warned of two critical PHP vulnerabilities that could let an attacker take control of an affected server, and reported active exploitation. It advised businesses to ask their website developer, hosting company or IT provider whether their services are affected, whether the fix has been applied and whether checks for compromise are needed. See the current NCSC alert for the latest technical guidance.
Fixes were released for PHP versions that are still supported. If your site runs an older version that no longer receives security updates, there may be no standard patch to apply. Moving to a supported version is upgrade work that needs compatibility testing and a rollback plan.
If your business does not manage the server, ask the provider responsible for it to confirm the following. Record the answer, the person responsible and the date of the next action.
- Affected services. Which websites, portals or other services use PHP, and whether they are affected
- PHP version. Which version each service runs, whether it still receives security updates, and the upgrade plan if it does not
- Responsible provider. Who manages the PHP environment and who can approve urgent work
- Remediation. What fix was applied, when it was completed and how the provider confirmed it took effect
- Compromise checks. Whether checks were made, including before the fix, for unexpected site changes, new administrator accounts, outages and unusual logins, and whether any investigation remains open
- Outstanding action. Any remaining work, temporary protection until it is complete, the person responsible and the next update
An update closes a known weakness; it does not prove that an earlier compromise has been removed. If there are signs of unusual activity, follow your incident response plan and ask the response provider what investigation is needed.
Where we host your website, PHP security updates are part of the maintenance we provide. Where we maintain a website that another company hosts, we confirm the update status with that host and record the answer. Routine updates, a move to a newer PHP version and incident clean-up are separate pieces of work, so the scope is confirmed before work starts.
Backups that can be restored
Website hosting and maintenance includes a copy kept away from the live site, with separate credentials, set retention, deletion protection and access on exit checked.
A different server or company alone does not make a backup safe, and a copy held by the same provider is not automatically lost. What matters is whether the site could be recovered if the live site, hosting account or supplier became unavailable.
For a self-hosted site, protect the files and the database, and keep the configuration, dependency and licence information needed to restore them. A static site may have no database, and a hosted website platform has its own export and recovery limits, so the method is confirmed for the actual platform.
Backup frequency follows how the site is used, and a site taking orders or bookings may need recent transactions protected beyond a nightly copy. Restores are tested periodically and after material changes in an isolated, access-controlled copy, with real payments, customer messages and search indexing switched off. The test checks the agreed pages, media, access, form delivery and key integrations, not only that a page loads.
The website is backed up separately from the email and business systems covered by backup as a service.
Monitoring that covers the important functions
A homepage can load while its enquiry form fails, so monitoring covers the agreed functions, with a controlled form-delivery check and a named alert destination.
- Availability. Checks on the agreed pages, with alerts to a named owner
- Form delivery. A controlled test submission that confirms enquiries arrive, without messaging real customers
- Checkout or bookings. Scoped separately where relevant, without uncontrolled test orders
- Response and restoration. Support hours and response agreed in writing; restoration depends on the cause, so the two are kept distinct
Automated traffic belongs in the same review. Our guide to AI crawlers explains how to decide which bots can read your site and how to check their effect on load.
Privacy and your website
Information privacy principle 5 requires reasonable safeguards for personal information, such as enquiries collected through a form. When a provider holds that information only on your behalf, your business remains responsible for it, and a provider using it for its own purposes can create responsibilities for both. The Privacy Commissioner guidance on working with third-party providers covers supplier terms for security, access, breach notification, retention and exit.
Map where form submissions, mail copies, logs and backups go, collect only what is needed, and set access and retention to match. Our guide to Privacy Act compliance covers the wider duties.
Takeovers, upgrades and clean-up
Website takeover, platform upgrades and incident clean-up are project work, scoped and quoted separately from ongoing website hosting and maintenance.
- Takeover and migration. An authorised inventory, a backup, dependency checks, a migration and rollback plan, and tests after cutover. Email DNS records, redirects and form delivery are preserved, and billing and access move in an agreed order
- Outgoing supplier access. Reduced or removed at the agreed point, once replacement access and recovery have been tested, and limited to the authorised resources of your business
- Platform upgrades. Major version and runtime upgrades and the replacement of abandoned components, with compatibility testing and a rollback plan
- Incident clean-up. Restoring from a known-good copy, closing the entry point and resetting credentials after a compromise, coordinated with our cyber security team
What affects the cost?
The cost of website hosting and maintenance depends on the platform and runtime, complexity, traffic, integrations, any online store, the maintenance scope, backup, response cover and takeover work. We separate recurring service from licences, third-party charges and projects such as design, content, custom development and clean-up, and confirm inclusions, exclusions and GST treatment before work starts.
We start by listing your site, accounts and suppliers and confirming who controls each part, then check backup and restore before ongoing support is agreed.
Website hosting and maintenance questions
What is website hosting and maintenance?
Hosting provides the environment a website runs on. Maintenance covers agreed work such as updates, certificate renewal, monitoring and recovery checks. The exact scope depends on the platform and contract, so confirm responsibilities and exclusions.
What is the difference between shared hosting and managed hosting?
Shared hosting describes server resources used by multiple sites. Managed hosting describes work a provider performs, and a plan can be both. Check its supported software, updates, backup, monitoring and support cover rather than relying on the label.
Who should hold the login to a business website?
The business should have documented ownership or entitlement, suitable customer access and a tested recovery route. Use named accounts and MFA where supported, with supplier access scoped to the work. Do not share the master reseller credentials of a provider.
How much does website hosting and maintenance cost in New Zealand?
Cost depends on the platform, traffic, integrations, update work, backup and support required. Ask for a scoped quote separating recurring service, licences, takeover work and other projects, with GST treatment and exclusions stated.
How long does an SSL certificate last?
For public TLS certificates issued from 15 March 2026 to 14 March 2027, the maximum is 200 days. The limit falls to 100 days from 15 March 2027 and 47 days from 15 March 2029. Providers may issue shorter certificates, so automate renewal and monitor for failures.
What happens if nobody renews the website certificate?
Expiry can trigger browser warnings or blocked connections and interrupt enquiries. It does not by itself prove a breach or rule one out. Contact the responsible provider to restore a valid certificate and investigate why renewal failed.
Does a small business need a website hosting and maintenance plan?
It needs clear responsibility for the work its platform requires. A self-hosted content management system needs software maintenance, while hosted website platforms manage more of the underlying environment. Account access, important functions and recovery arrangements still need attention.
When should website plugins and themes be updated?
Review updates regularly and assess security fixes promptly against risk and vendor advice. Do not wait for the next monthly slot when urgent action is needed. Confirm automation works, protect the site before changes and check its important functions afterwards.
Does updating WordPress also update PHP?
No. WordPress and PHP are separate software layers, and a WordPress update does not change the PHP version on the server. Ask whoever manages the hosting to confirm the PHP version and its security update status as well as the site, theme and plugin updates.
Our website runs an older PHP version. Is there a patch?
Possibly not. Security fixes are released for PHP versions that are still supported, so a site on an older version may need to move to a supported one. That upgrade needs compatibility testing for the site, theme and plugins, and a rollback plan. Ask your host which version the site runs and whether it still receives security updates.
Is it safe to keep the only website backup with the website hosting company?
Check whether you could recover if the live site, hosting account or supplier became unavailable. Keep a protected copy with a separately usable recovery route, and verify retention and exit access. A different server or company name alone is not enough.
Can you get a website back if the developer will not respond?
It may be possible, depending on ownership, access, supplier processes and available copies. Start with the registrar, hosting or platform provider and authorised evidence. A recovery or rebuild needs assessment, and payment receipts alone do not prove a right to access.
Does Exodesk manage website hosting for Christchurch and Dunedin businesses?
Yes. Our Christchurch and Dunedin teams support businesses nationwide. Tell us about your platform, current provider and required support so we can confirm hosting, maintenance and any takeover work, with access and exit arrangements agreed in writing.
Discuss your website support
Tell us what your website runs on, who hosts and maintains it today, and what you need looked after. We will suggest a scope for website hosting and maintenance and the next step. Please leave passwords and account details out of the enquiry.
Talk to us about your website
Tell us about your website, your current provider and the support you need, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941