Website Maintenance & Support
Your website doesn't stop needing attention the day it launches.
Security patches, content updates, broken forms, a campaign page due tomorrow. A live site generates work every week. WebCare gives you one team and one block of hours to cover all of it, used however you need it that quarter.
The Problem
Three Ways Maintenance Fails
Most maintenance arrangements fail in one of three ways. Each one ends with the same result: a live site quietly drifting out of date until something breaks in public.
The Site Decays Between Projects.
Plugins fall behind. A CVE lands and nobody patches it. The CMS version goes end-of-life. Nothing looks wrong until a vulnerability is exploited or an update finally breaks the layout. Maintenance that only happens when you remember it isn't maintenance.
Every Small Change Becomes a Project.
You need a banner changed, a page added, a form fixed. The old vendor wants a scope, a quote, and two weeks. So the change waits, or someone in your team edits the CMS and breaks a template. The cost of a five-minute fix is the friction of getting it done at all.
Support Is a Black Hole.
You raise a ticket and hear nothing. No acknowledgement, no clock, no idea whether it's being worked on. When the site is down, "we'll look into it" is not an answer. You need to know it was seen, who has it, and when it resolves.
Live Sites We Keep Running
The Method
How Maintenance Fits the Lifecycle
Maintenance isn't a bolt-on. It's the last stage of how we build and the first stage of how we keep a site healthy. Every engagement runs through the same operational sequence, whether we built the site or inherited it.
Proven Results
WebCare in Numbers
Operational numbers from live maintenance engagements across government, higher education, and enterprise clients.
Sustained on SGNIC's enterprise Sitefinity platform for 4+ years.
Support tickets raised and closed in FY24, all within SLA.
P1 incidents across all supported sites, three years running.
FY24 average response time. Same working day, every ticket.
Client Results
Platforms We Keep Running
Three engagements that show what WebCare looks like in practice, across government, enterprise, and higher education.
SGNIC: a government platform that simply cannot go down.
Challenge
SGNIC's site sat on an outdated Sitefinity 8 build with known vulnerabilities, poor uptime, and content that kept getting lost in production. For a national internet-registry platform, downtime and security gaps aren't an inconvenience — they're a public-trust problem.
Approach
Re-architected on Azure with an active-active HA setup, upgraded through Sitefinity 14.4 LTS, and replaced the fragile content-sync method with SiteSync, locking down production. Monthly security patching plus annual third-party VAPT with remediation.
Princeton Digital Group: off an unreliable host, onto secure cloud.
Challenge
PDG, a digital infrastructure company serving hyperscalers globally, was stuck on an unreliable hosting platform with slow, unresponsive support. As an infrastructure brand, PDG's clients hold them to ISO 27001-aligned standards. Their website didn't meet it.
Approach
Migrated to Azure behind Cloudflare: encryption at rest and in transit, MFA on all privileged access, Cloudflare WAF, defined recovery targets (4-hour RPO, 6-hour RTO), and 24/7 enterprise monitoring and incident response.
Duke-NUS: from build to ongoing care, through organisational change.
Challenge
Duke-NUS needed a rebuilt main website and a way to keep a large, growing platform stable as the organisation evolved, with new sub-sites and campaigns landing on it over the years rather than as a one-off launch.
Approach
Rebuilt the main website on Sitefinity, delivered 30-plus reusable sub-sites over a multi-year partnership, and stayed on for maintenance through organisational change — absorbing new needs as they came, including a 20th anniversary microsite and sub-site expansions.
Why Construct Digital
Why Our Maintenance Holds Up
Most agencies treat maintenance as the boring contract they take to keep the relationship. We treat it as a service in its own right, with a model built around how clients actually use it.
One Block, Used Any Way.
Your WebCare block is yours to spend across fixes, small updates, creative refreshes, or strategic input. No role-differentiated rate card, no per-task negotiation, no five quotes for five small jobs. One unit of value, used however the quarter demands.
Security Run, Not Promised.
Monthly patching, annual VAPT, OWASP-aligned reviews, tested backups, WAF hygiene. Our technical lead has delivered 200+ penetration tests across government and higher education. Security-by-design isn't a line on the proposal — it's the operating cadence.
A Real SLA Clock.
Same-day acknowledgement, a single clock, a three-tier escalation ladder (PM to technical lead to CTO). In FY24 that meant 312 tickets closed, 100% within SLA, and zero P1 incidents. You're never wondering whether your ticket was seen.
Platform Depth, Not a Single Stack.
WordPress and Sitefinity in genuine depth, plus enterprise CMS and managed hosting. We've migrated legacy builds, upgraded versions through end-of-life, and standardised messy multi-builder sites so non-technical teams can edit without breaking templates.
You Pay for the Thinking. The Production Runs AI-Native.
Routine fixes, security scans, and CMS work are where AI compresses time most — by an estimated 20–40% on our maintenance work. We bank that as capacity, not markup. Your block goes further: more fixes cleared, more of the site watched, more recommendations made.
Maintenance That Improves the Site, Not Just Preserves It.
We watch what the analytics surface and bring you recommendations: a slow page, a high-exit journey, a form that's leaking. The block covers strategic input as readily as it covers patches, so the site gets better between projects.
Engagement Model
Three Ways to Buy Ongoing Care
There's no single right shape for maintenance. A small brochure site and a high-availability government platform need different things. WebCare comes in three forms, and most clients combine them.
Hosting + Basic Maintenance
Managed hosting with quarterly maintenance bundled in: core and plugin updates, security checks, uptime monitoring. The entry tier that keeps a live site healthy without a standing block of hours. Right for smaller sites that need to stay current and secure, not constantly changed.
The WebCare Block
Pre-bought hours, used flexibly across fixes, updates, creative refreshes, and strategic input. Project and account management are included in the rate, no separate lines. Bought in quarterly, half-year, or annual blocks. This is the everyday workhorse — the right shape for any site that generates regular work.
Annual Maintenance Contract
A scope-locked annual contract for enterprise and government sites that need committed, predictable cover. Usually bought alongside a block: the contract covers the agreed scope, the block absorbs everything outside it. This is how our largest platforms run.
Built your new site with us through COMPASS?
Every site we build ships with a warranty period. WebCare is the next step after warranty — same team, no handoff, no gap between launch and looking after it. Pricing is scoped to your site and platform. We'll size the right shape, or combination, in a short conversation.
Testimonials
What Our Clients Say
While we've worked with Construct on several projects over the years, we most recently engaged them for the redevelopment of the Duke-NUS main website as well as our 20th anniversary microsite. They delivered with professionalism, creativity and responsiveness all the way from build to ongoing maintenance. It's been a constructive and dependable partnership, and the revamped website has seen clear growth in traffic.
We appreciate that your team is working carefully through the intricate behaviour in our website.
Construct Digital has been responsive and committed to fulfilling our requests. It is fortunate that the team values our feedback and proactively welcomes it to drive continuous improvement.
Got Questions
Frequently Asked
Anything your live site needs: security patching and updates (Fix), content changes and new pages (Make), hosting and monitoring (Run), and strategic input like analytics-led recommendations (Think). It all draws from the same block, so you're not negotiating each task separately.
No. We onboard sites we didn't build, starting with a full inventory of the platform, plugins, hosting, backups, and any open vulnerabilities. We maintain WordPress, Sitefinity, and enterprise CMS platforms, including legacy builds that need upgrading or stabilising.
Every ticket runs on a single SLA clock with same-day acknowledgement and a clear owner. Behind it sits a three-tier escalation ladder from project manager to technical lead to CTO. In FY24 we closed 312 tickets, all within SLA, with zero P1 incidents.
Monthly security patching at server and application level, annual third-party VAPT with remediation, OWASP-aligned code reviews, WAF hygiene, and tested backups. For high-availability platforms like SGNIC, this discipline is what holds 99.995% uptime over four-plus years.
Three shapes: managed hosting with basic maintenance bundled, a flexible pre-bought block of hours, or a scope-locked annual contract for enterprise sites. Pricing scales to your site and platform. We'll size the right shape, or combination, in a short conversation.
The opposite. AI compresses the time on routine fixes and scans, and we bank that as capacity rather than markup. You pay for judgement and care; the production runs AI-native. The effect is that your block covers more, not that the work is thinner.
Ready to Begin
Stop maintaining your site by remembering to.
Tell us what you're running — the platform, the size, what keeps breaking — and we'll size the right WebCare shape for it. One team, one block, one clock.