Security
CMS, module, plugin, and dependency updates
We track core releases, add-ons, themes, PHP/runtime compatibility, package dependencies, and security advisories. Updates are backed up, applied in a test environment, checked, then deployed.
Existing website support
Website maintenance
without live-site risk.
Atomic Design keeps existing websites secure, backed up, monitored, and moving. Requests go through a ticket system, changes are tested on a staging copy first, and live updates are published only after review or direct client approval.
Maintenance core
The work that keeps a site healthy.
Maintenance is not one task. It is a repeatable operating system for security, uptime, recoverability, compatibility, and support.
Monitoring
Uptime, SSL, forms, and errors
We monitor whether the site is reachable, whether SSL is valid, whether forms still submit, and whether critical errors appear after updates or hosting changes.
Recovery
Backups with restore readiness
We confirm database and file backups, keep restoration steps documented, and preserve a recovery path before changing code, modules, templates, or configuration.
Content
Page edits and content updates
Covered maintenance can include text edits, image swaps, staff updates, landing-page edits, phone-number changes, form field adjustments, and small page additions.
Development
Small functionality and fixes
Bug fixes, display issues, form logic, redirects, tracking-code repairs, accessibility corrections, and minor feature requests can be handled through tickets when scope is clear.
Reporting
Plain-language monthly notes
Reports summarize work completed, updates applied, risks found, uptime events, open requests, recommendations, and any work that should be scoped separately.
Platform support
Every platform needs a controlled process.
Stable maintenance depends on the same principles across platforms: back up first, test away from production, document changes, verify forms and core pages, then publish only after approval.
| Area | What we handle | How it is controlled |
|---|---|---|
| Security updates | CMS core, plugins, modules, themes, libraries, frameworks, and urgent security advisories. | Back up first, update staging, run required database or cache steps, test public and admin paths, then publish. |
| Add-on compatibility | Conflicts, deprecated plugins or modules, PHP compatibility, package constraints, and update blockers. | Document blocker, recommend patch/update/replace path, and quote larger remediation before work expands. |
| Site configuration | Menus, blocks, views, content types, fields, permissions, redirects, forms, and tracking scripts. | Move configuration through the test server when possible; capture screenshots or notes for approval. |
| Hosting coordination | PHP version, database health, disk space, cron, cache, CDN, SSL, and server warnings. | We can coordinate with hosting support when access is provided; hosting invoices, domains, and billing remain client-owned unless separately assigned. |
| Legacy risk | Old CMS versions, unsupported plugins or modules, unmanaged patches, or admin workflows that create security risk. | We separate normal maintenance from upgrade projects and give a written path before touching fragile production systems. |
Scope boundaries
What counts as maintenance.
Clear boundaries keep support fair, fast, and predictable. Small defined changes move through tickets. Larger work gets scoped before it burns hours.
Usually covered
- Security patches and routine CMS updates
- Uptime, SSL, and form monitoring
- Backups and restore planning
- Small edits to existing pages
- Minor page additions from supplied content
- Bug fixes from updates or browser changes
- Broken links, redirects, and tracking-code repairs
Quoted separately
- Full redesigns or new site builds
- Large custom features or integrations
- Major platform upgrades or migrations
- New copywriting, photography, video, or branding
- Complex accessibility remediation
- Third-party software license costs
- Hosting, domain, or email billing unless contracted
Client responsibilities
- Submit requests through the ticket system
- Provide the affected URL and exact requested change
- Include screenshots, error messages, and login context
- Review staging links promptly
- Keep domain, hosting, and software accounts current
- Avoid live-site edits by other vendors during active support
SEO does not disappear into maintenance
SEO monitoring and strategy stay under SEO.
When you have an SEO engagement with Atomic Design, we do not charge website maintenance time for routine SEO review. We separate marketing analysis from website labor so the maintenance plan is not consumed by reports, rankings, or strategy conversations.
- Rank tracking, local visibility review, and AI/search visibility review stay in SEO.
- Google Analytics, Search Console, crawl, and indexability review stay in SEO.
- SEO recommendations, content priorities, and monthly strategy notes stay in SEO.
- Website implementation can use maintenance or project time: page edits, new pages, redirects, schema, internal links, template changes, speed fixes, tracking repairs, or developer work.
Support priority
Response times are defined by impact.
A response is the first qualified review, not a guaranteed resolution. Turnaround depends on access, approvals, third-party systems, and the size of the change.
| Priority | Examples | Target response | Typical turnaround |
|---|---|---|---|
| Emergency | Site down, checkout/form unusable, security compromise, public error blocking core business. | 0-4 hours when emergency coverage is active. | Triage immediately; restoration or containment first, full fix after cause is known. |
| High | Admin inaccessible, key page broken, lead form degraded, update conflict, visible functionality failure. | Same business day when submitted with complete details. | 1-2 business days for common fixes; more if third-party access or development is required. |
| Standard | Content edits, new supplied copy, image swaps, non-critical bugs, minor layout changes. | 1 business day. | 2-5 business days depending on queue, review cycles, and request size. |
| Planned | New sections, added functionality, larger page builds, integrations, templates, or migrations. | 2 business days. | Scoped separately with schedule, estimate, staging link, and approval step. |
After-hours and holiday support: emergency work outside normal business hours is available only when coverage is active or explicitly accepted. Off-hours work may carry a separate minimum and emergency rate because it interrupts scheduled work and staff availability.
Official support ticket system
Yes, support should run through tickets.
Email threads are useful, but an official ticket system gives every request an owner, status, priority, approval trail, staging link, and deployment record.
Client portal
Clients submit tickets, attach screenshots, select priority, enter affected URLs, see open work, approve staging links, and request revisions from one place.
AI-assisted review
Codex-style AI can read new tickets, classify impact, request missing details, inspect the staging codebase, propose fixes, draft work notes, and prepare safe changes for developer review.
Human-controlled publishing
AI can accelerate diagnosis and implementation, but production updates stay gated by credentials, backups, staging proof, approval, and an Atomic developer or client-directed live action.
Test server first
The approval workflow.
The live site is protected by process. Requests are reproduced, fixed, reviewed, and approved before production changes are made.
Submit ticket
Client provides URL, request, priority, screenshots, error text, deadline, and any content or files.
Triage
Atomic confirms scope, priority, needed access, estimate, and whether the work is maintenance, SEO, or a separate project.
Stage
We clone or use a test server, take a backup, make the change, and test the affected pages, forms, and admin paths.
Approve
Client receives a staging link or proof notes, then approves, rejects, or submits revisions inside the ticket.
Publish
Approved changes move live with notes, backup reference, deployment record, and a final verification check.
Better tickets get faster answers
What every request should include.
Complete intake prevents back-and-forth and helps us reproduce the problem before touching code.
✓Company and website. Include the domain, affected page URL, and whether the issue appears on desktop, mobile, or both.
✓Exact request. State what should change, what is broken, or what outcome you need.
✓Evidence. Add screenshots, screen recordings, error messages, browser details, and the steps needed to reproduce the issue.
✓Content. Provide approved copy, images, PDFs, links, names, phone numbers, or files before requesting publication.
✓Timing. Mark real deadlines, launch windows, blackout periods, and whether after-hours support is being requested.
✓Approval contact. Name who can approve staging, revisions, emergency work, and live deployment.
Supported technology
We support the stacks real websites run on.
Maintenance coverage depends on access, current condition, hosting limits, licensing, and whether the software is still supported. We identify risk during onboarding before routine work begins.
Content management systems
- WordPress
- Webflow
- Shopify CMS
- Open-source CMS platforms
- Custom PHP CMS platforms
- Static HTML sites
- Headless CMS builds
Shopping carts and ecommerce
- Shopify
- WooCommerce
- BigCommerce
- Magento / Adobe Commerce
- Ecwid and embedded carts
- Custom checkout and payment integrations
- Payment, shipping, tax, and inventory integrations
Languages and frameworks
- HTML, CSS, and JavaScript
- PHP and Composer-based projects
- React and Next.js
- Node.js applications and APIs
- Liquid templates
- Twig templates
- Legacy jQuery and custom front-end code
Hosting and infrastructure
- Vercel
- Cloudflare
- cPanel and traditional shared hosting
- Managed WordPress hosting
- VPS and cloud servers
- CDNs, DNS, SSL, redirects, and caching layers
- Staging, backups, and deployment workflows
Databases and integrations
- MySQL and MariaDB
- PostgreSQL
- Supabase-backed applications
- CRM and form integrations
- Email service providers
- Payment gateways
- Third-party APIs and embedded widgets
Marketing and measurement tools
- Google Analytics 4
- Google Tag Manager
- Google Search Console
- Meta and Google Ads pixels
- Call tracking scripts
- Schema and structured data
- Heatmap, chat, and conversion tools
Research basis
Built from current maintenance norms.
We reviewed current agency maintenance plans, support providers, and update guidance before defining this structure.
UpThink: maintenance coverage across security monitoring, updates, backups, uptime, support, reports.
Parameter: staging-first updates, tested backups, monitoring, and plain-English reports.
Clear Digital: tiered response times and emergency support expectations.
Websloop: maintenance process covering audit, hardening, updates, monitoring, content support, and monthly reporting.
AT Web Studios: care plans with uptime targets, backup retention, security monitoring, support, and monthly reports.
Syntexsys: plain-language scope boundaries for maintenance, support requests, and separately quoted work.
Keep the site working.
Then improve it safely.
Send us the site, the risks, and the request list. We will map the maintenance plan, support workflow, staging process, and approval path.