| Website hosting and maintenance is the paid arrangement that keeps a business site online and current, covering the server space, the security certificate, the software updates and the offsite backup. Who holds the login for each of those four decides how fast a business can act on the day the site breaks. |
A Rangiora manufacturer lost its website on a Thursday in April.
Every enquiry form on it was dead for eleven days, and the sales team told customers over the phone that the company was still trading.
The site had been built in 2020 by a one-person web studio in Christchurch. The studio registered the hosting, installed the content management system, arranged the certificate and invoiced $180 a month for the lot.
That held for six years. The replies stopped coming in February and the hosting lapsed in April.
The firm had never asked for the hosting login. The person who held it had moved to Australia and closed the studio.
The outage was the visible cost. The arrangement behind it had been costing money for years and nobody had priced it.
The figures below are illustrative. That firm employs 24 people, and its $180 a month came to $2,160 a year on hosting it could have bought directly for about $65.
Its office manager spent around three hours a month emailing the developer for text changes the business could have made itself. At $55 an hour that was another $1,980 a year.
Running cost was $4,140 a year before anything broke.
The outage cost more and it cost once. Rebuilding the site from nothing, because the hosting account could not be recovered, came to $8,500.
Neither number is an argument against hiring a designer. Both trace back to one missing item, the login to the hosting account.
You can test your own position in twenty minutes. Open the hosting account, read the certificate expiry date, and find the most recent backup that is held somewhere other than the site itself.
Who Has Access to Your Business Website?
In most small businesses the web developer who built the site holds all four logins.
There are four of them and they are rarely in one place, so few owners can list them without checking. The registrar holds the domain name, and a hosting account holds the server space along with the files and the database that make up the site. The content management system carries its own administrator accounts.
The fourth key is the certificate that puts the padlock in the browser, issued against one of those accounts and renewed from it.
Each of the four fails differently. Losing the hosting account is the expensive one, because the files and the database are both inside it.
Is a domain name the same as website hosting?
No. The domain name is the address people type and the hosting account is the machine that address points at. Our post on who controls a domain name covers the registrar record, the nameservers, the DNS zone and the registrant details, and this one covers everything those nameservers point at.
The two are bought from different suppliers and renewed on different dates. A business can hold the domain name and have lost the hosting account, or the reverse.
Who owns the code a web designer wrote for you?
Usually the business that paid for it. Section 21(3) of the Copyright Act 1994 makes the person who commissions and pays for the making of a computer program the first owner of the copyright in it, and section 21(4) makes that subject to any agreement to the contrary.
The predecessor Copyright Act 1962 worked on the same commissioning idea, so the rule is old and settled. A signed contract can hand ownership the other way, so read the contract before an argument starts.
Copyright ownership will not get you into the hosting account. Check the contract for an ownership clause, then chase the login separately.
What Does a Website Hosting and Maintenance Plan Cover?
Website hosting and maintenance covers five running jobs, and a quote that names fewer than five is quoting for something narrower.
- Server space and bandwidth, with the database the site runs on
- Renewal of the certificate that secures traffic between the visitor and the site
- Updates to the content management system and to every theme and plugin on top of it
- A backup held away from the server, with a tested way to put it back
- Uptime monitoring that reports downtime before a customer does
Cheap shared hosting buys the first line. The other four are the maintenance half, and the part an invoice tends to be vague about.
Ask a supplier to price each line separately. A single monthly number on a website maintenance plan will not tell you which of the five you are buying.
What is a content management system?
A content management system, usually shortened to CMS, is the software that lets a non-technical person edit a page without touching code. WordPress, Shopify, Squarespace, Wix and Drupal are the names that come up most often in New Zealand.
The system runs on a database and a set of files, and plugins extend it, meaning small pieces of add-on software written by other companies. A small business site runs between fifteen and thirty of them.
Every plugin is a supplier nobody chose deliberately. Each can be abandoned by its author, and an abandoned plugin stops getting security fixes while the site carries on using it.
How often should the CMS and its plugins be updated?
Monthly at the outside, and inside a week for anything the vendor flags as a security fix.
WordPress does part of this by itself. Minor core releases, including security releases, install automatically on most sites, and the WordPress documentation states that plugins and themes are updated automatically only in special cases set by its security team.
Plugins carry most of the risk and they do not update themselves unless somebody turns that on, plugin by plugin. Content management system updates are the first thing dropped when a maintenance arrangement lapses, because the site looks the same either way.
Who Renews the SSL Certificate on Your Website?
Whoever holds the hosting account, in nearly every case, and when nobody does the site stops loading for visitors.
An SSL certificate makes a browser show https and a padlock. The correct modern name is a TLS certificate, for Transport Layer Security, and the industry still sells them as SSL after Secure Sockets Layer, the older protocol TLS replaced.
Certificates expire, and the maximum life is getting shorter. In April 2025 the CA/Browser Forum, the body behind the rules certificate authorities and browsers follow, adopted ballot SC-081v3, cutting the maximum life of a public TLS certificate from 398 days to 47 days between March 2026 and March 2029.
A yearly note in a diary stops working under that schedule. TLS certificate renewal has to run automatically, or belong to somebody whose job it is.
What happens when an SSL certificate expires?
Every visitor gets a full-page browser warning saying the connection is not private, and they leave.
The site itself is untouched. Nothing has been hacked and no data has moved. Enquiry forms stop being submitted for as long as the warning is up.
An expired certificate is fixed in under an hour by whoever holds the account. Working out who that is takes longer than the fix.
What is automatic certificate renewal?
It is a protocol called ACME, short for Automatic Certificate Management Environment, that lets a server prove it controls a domain and collect a fresh certificate with no person involved.
Let’s Encrypt issues 90-day certificates this way at no cost, and the common hosting control panels, cPanel and Plesk among them, have it built in. Switching it on takes ten minutes for whoever holds the hosting account.
Ask a hosting provider to show you the renewal running. A certificate that is valid today proves only that somebody renewed it once.
Where Should Your Website Backup Be Stored?
A website backup should be stored somewhere other than the server the website runs on.
A copy kept on the same machine as the site protects against one thing, a mistake in the content. It does nothing when the server fails, when the hosting account is closed for non-payment, or when a compromise reaches the whole filesystem.
A usable website backup has three parts: the files, the database, and a written note of the CMS and PHP versions the site ran on. Without the third the restore becomes a rebuild, because the replacement server has to be set up to match.
Check the date on the most recent copy before anything else. A backup that stopped running eighteen months ago looks identical to one that ran last night until somebody opens the folder.
How is a website backup different from a business data backup?
The website is a separate object with its own restore path. Backup as a service protects email and the line-of-business systems the office works in, and it rarely reaches the website, because the site lives with a hosting company nobody in the office deals with.
Check the two separately. Ask who holds the website copy and who holds the file server copy, because one arrangement does not cover both.
How often should a website restore be tested?
A website restore should be tested once a year on a small site, and the test has to end with a working page on a staging address.
Restoring to a staging site takes about an hour and answers the only question a backup exists to answer. Book it for the same week each year and write down the result.
What Should You Do When a Web Developer Stops Answering?
Work out what you can still get into, then go after the rest through the companies that hold it.
The Rangiora manufacturer spent its first morning here, and what it needed was recoverable. The registrar, the hosting company and the certificate authority all have support desks and account recovery processes, and none of them treats a missing developer as the end of the matter.
Recovery depends on whose name is on the account. Where a developer opened everything under their own company, you are asking a stranger to hand over an account that is not in your name, and that takes evidence and time.
| What you need back | Where it normally lives | What it costs to replace |
|---|---|---|
| The hosting account | With whoever opened it, often inside the developer’s own reseller account | A full rebuild, if the files cannot be downloaded first |
| The CMS administrator login | Inside the site, under its own user list | One to two hours of database work by a new provider |
| The certificate | Issued against the hosting account, or bought separately by the developer | A new certificate, from nothing to about $200 a year |
| The files and the database | On the server, and in whatever backup exists | Nothing if an offsite copy exists, everything if it does not |
| The domain name | With the registrar, under the registrant record | A registrar recovery process, which can run to several weeks |
Prevention costs almost nothing. Keep the website in the same asset register as the laptops and the phone system, and treat the developer as a supplier with third-party risk attached, the way you would treat a payroll bureau.
What should a website handover include?
A working developer will produce all of this inside a day:
- The hosting account login, transferred into the business name
- The CMS administrator account, with the developer’s own account downgraded
- The registrar login, or written confirmation of who holds it
- A current export of the files and the database
- The certificate issuer and the renewal method in use
- An invoice that separates hosting from labour
Ask for the list while the relationship is a good one. A web developer handover requested in the middle of a dispute costs money and takes weeks. Custody is a compliance question as well, because of what a contact form collects.
Does the Privacy Act 2020 Apply to a Business Website?
Yes, from the moment the site collects a name and an email address through a contact form.
Information privacy principle 5 requires an agency, the Act’s word for a business, to protect personal information with security safeguards that are reasonable in the circumstances. A form writing enquiries into a database on a server the business has never logged into is holding personal information under that principle.
The second limb of the principle is the one that bites here. Where information has to be given to somebody in connection with a service provided to the business, the business must do everything reasonably within its power to prevent unauthorised use or disclosure.
Who is responsible if a website host is breached?
The business whose customers the information belongs to, in the first instance.
Naming the hosting company in the incident report does not move the obligation. The expectation under principle 5 is that the business chose the supplier and can show it took reasonable care.
In practice that means three questions before signing anything: where the data is held, who else can reach it, and what happens on the day the arrangement ends.
How Much Does Website Hosting and Maintenance Cost?
Website hosting and maintenance costs about $1,740 a year for the illustrative 24-person manufacturer above, set against the $4,140 a year it was spending. The net recurring saving is $2,400 a year.
That $145 a month buys hosting at cost, certificate renewal running automatically, monthly updates to the CMS and its plugins, an offsite copy of the site and an annual restore test. It also hands the business its own logins to all four accounts, and the office manager’s three hours a month go with them.
The one-off side stays separate. A takeover project, meaning collecting the accounts, migrating the hosting and writing down what is where, runs about $1,200 for a site this size. Set that against the $8,500 rebuild the firm paid because the accounts could not be recovered.
Both numbers move with the number of plugins and the number of people who edit the site, and barely at all with headcount.
What does this cost a five-person business?
A five-person business should expect $45 to $90 a month, depending on whether the site takes payments.
A five-page brochure site on shared hosting, with automatic certificate renewal and a nightly offsite copy, costs the bottom of that range. An online store taking card payments costs the top of it, because the update cycle is faster and a broken checkout is measured in lost orders.
Managed WordPress hosting falls between the two on price and takes the core updates off your hands, because the host applies them itself. Read what it excludes before buying, because plugins are often outside the deal.
How Do You Take Over a Website From a Web Developer?
Collect the four logins first, because every other step waits on being able to get in.
- List the four accounts behind the site: registrar, hosting, CMS and certificate. Write down who holds each password today.
- Ask in writing for anything the business does not hold, before there is any reason to argue about it.
- Move hosting billing onto a company credit card, so a failed payment reaches an inbox somebody reads.
- Turn on automatic certificate renewal, then confirm it has run once.
- Set a monthly slot for CMS, theme and plugin updates, and record the date each time.
- Take one backup offsite, then restore it to a staging address to prove it works.
None of that needs new software and most of it is a series of emails. For a business with one site it is an afternoon of work.
The Rangiora manufacturer had paid for all four keys every month for six years. It had never been handed any of them.
Find Out Who Holds Your Website Logins
Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Our IT services team takes on website hosting and maintenance as one job, puts the certificate on automatic renewal and moves the backup off the server, with every login recorded in your name.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is website hosting and maintenance?
Hosting and maintenance for a business website is one arrangement covering two jobs. Hosting rents the machine and the bandwidth the site runs on. Maintenance renews the certificate, applies software updates, keeps a copy of the site elsewhere and watches for outages. Small businesses normally buy both halves from a single supplier.
What is the difference between shared hosting and managed hosting?
Shared web hosting rents space on a server alongside other websites and leaves the software running on it to the customer. Managed hosting costs more and includes the update cycle, the certificate, the backup and monitoring as part of the service. A small business with no in-house IT person usually finds the managed option cheaper once the hours spent chasing updates are counted.
Who should hold the login to a business website?
The business should hold the master login to every account behind its website, with the web developer or IT provider added as a second user. That arrangement lets a supplier do the work without becoming the only route in. Accounts opened in a supplier’s name are the single biggest reason a New Zealand business cannot recover its own site. Check the billing email on each account, because whoever receives the renewal notice is usually the account holder.
How much does website maintenance cost in New Zealand?
A brochure site costs $45 to $90 a month, with the certificate and the update cycle included in that price. An online store or a larger site starts around $145 a month. Moving a site away from an unresponsive supplier is a separate one-off project of about $1,200.
How long does an SSL certificate last?
Public TLS certificates, still sold as SSL, can be issued for a maximum of 398 days, and the CA/Browser Forum has adopted a schedule cutting that maximum to 47 days by March 2029. Free certificates from Let’s Encrypt already run on 90-day terms and renew themselves, so manual renewal has stopped being workable.
What happens if nobody renews the website certificate?
The site keeps running, but every browser blocks it behind a full-page security warning and enquiry forms stop being completed. Nothing has been compromised and no data is lost, and whoever holds the hosting account can fix it within an hour of being asked.
Does a small business website need a maintenance plan?
Yes, if the site runs on a content management system such as WordPress. Those systems need regular updates to the core software and to every theme and plugin running on it, and an unpatched plugin is the usual way a small site gets defaced or used to send spam. A site built as plain static files needs far less, though it still needs hosting and a certificate, plus somewhere to restore from.
How often should WordPress plugins be updated?
Monthly for ordinary releases and within a week for anything marked as a security fix. WordPress installs its own minor core updates automatically on most sites, while plugins and themes are left alone unless automatic updates are switched on for each one.
Is it safe to keep the only website backup with the hosting company?
No. A backup held by the same company that runs the server disappears with the hosting account when a bill goes unpaid or a supplier relationship ends. Keep at least one copy under the business’s own control, on infrastructure the hosting company does not touch.
Can you get a website back if the developer will not respond?
Yes, in most cases, though how long it takes depends on whose name the accounts were opened in. The registrar, the hosting company and the certificate authority each run an account recovery process and will deal with a business that can prove it pays the bills. Accounts held inside a developer’s own reseller account are the hardest to prise loose. Where the files cannot be recovered at all, rebuilding from a saved copy of the pages is occasionally the cheaper route.
Does Exodesk manage website hosting for Christchurch and Dunedin businesses?
Yes. Exodesk provides website hosting and maintenance for businesses across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, taking over the hosting account, the certificate, the update cycle and the backup. Every login is recorded in the client’s name, so the business keeps control of its own site.
NEXT STEP
Could you get into your own website this afternoon?
The hosting account, the content management system, the certificate and the site backup were all set up by somebody, and in most businesses that somebody was never an employee. An IT assessment checks who holds each of them today, and what it would take to get them back into your name, alongside the rest of your setup.
Or read more about our managed IT services.
