What Actually Breaks on a Brewery Website, and What Maintenance Covers

What breaks on your site depends almost entirely on what it was built with, and most maintenance advice ignores that. If you run WordPress, your exposure is plugins: 11,334 new vulnerabilities were disclosed across the WordPress ecosystem in 2025, 91% of them in plugins and only six in core, with a median five hours from disclosure to first exploit. If you run Squarespace, Wix or Webflow, the platform patches itself and nothing on that list is your problem. What breaks instead is content, forms, integrations and certificates on custom domains. Plans run roughly $35 to $500 a month depending on which of those you actually have.

Introduction: Nothing Breaks Loudly

A brewery website almost never fails in a way anyone notices. It fails quietly, in the order of: the contact form stops delivering, the events page still lists August, a plugin update gets skipped, the tap list integration starts returning yesterday's beers, and eleven months later somebody searches the brewery and lands on a page that does not match what is actually pouring.

Nobody reports any of that, because nobody in the building looks at the website the way a stranger does. Staff go straight to the admin. Regulars already know the hours. The people who see the broken version are the ones deciding whether to drive over, and they do not send an email about it.

So the honest framing of maintenance is not "keeping the site online". Sites stay online by themselves. It is keeping the site true, and keeping the parts that can be attacked from being attacked.

In BeerSoft onboarding the most common opening finding is not a hack. It is a form that has been silently failing for months and a menu page that is a season out of date.

The rest of this is what actually goes wrong, split by what you built on, because that changes the answer completely.

What Actually Breaks, and Does It Depend on My Platform?

Yes, almost entirely. This is the part most maintenance articles skip, and skipping it is how a brewery on Squarespace ends up paying for plugin updates it does not have.

There are two worlds. On a self-hosted CMS, usually WordPress, you own the software stack and therefore you own its security. On a hosted builder, Squarespace, Wix, Shopify or Webflow, the vendor patches the platform and you cannot install the kind of third-party code that creates most of the risk. W3Techs puts WordPress at 40.2% of all websites, so the first world is the larger one, but small hospitality businesses are heavily represented in the second.

Three of those five rows are identical in both worlds. That is the useful finding: most of what actually goes wrong on a brewery site is not a security problem at all, and buying a security-shaped maintenance plan leaves it untouched.

Key Takeaway: before pricing any plan, write down which of those five rows apply to you. On a hosted builder, two of them are already covered and you should not be paying for them.

If you are still choosing what to build on, our low-code and no-code work for breweries covers which of these costs you inherit with each option.

Why Are Plugins the Biggest Exposure on a WordPress Site?

Because that is where virtually all the vulnerabilities are, and because the window between disclosure and exploitation is now measured in hours.

Patchstack's security review of 2025 found 11,334 new vulnerabilities across the WordPress ecosystem, a 42% increase on the previous year. Of those, 91% were in plugins and 9% in themes. WordPress core itself accounted for six, all low priority. More high-severity vulnerabilities were found in 2025 than in the previous two years combined, and highly exploitable ones rose 113% year over year.

The timing is the part that changes what you should do. The weighted median time from disclosure to first exploit attempt is five hours for heavily targeted vulnerabilities, and roughly half of high-impact vulnerabilities are exploited within 24 hours. A monthly update cycle is not a security control against that. It is a tidiness routine that happens to reduce your surface.

Which reframes the WordPress question usefully. WordPress core is not the risk. The twenty-three plugins somebody installed over six years, four of which are abandoned, are the risk. The most valuable maintenance task on a brewery WordPress site is not patching faster, it is having fewer plugins to patch.

Key Takeaway: count your active plugins this week. Anything not updated by its author in over a year is a liability, not a feature, and removing it is worth more than any patching schedule.

What Breaks on Squarespace or Webflow, Where There Are No Plugins?

Content, forms, integrations and certificates. None of it is dramatic, and all of it costs you visits.

Content rot is the biggest one and nobody bills for it. An events page carrying last season, a beer page for something you retired, hours that were right before you changed them. This is the single most common defect on brewery sites regardless of platform, and it is invisible from the inside because staff never read the public pages.

Forms fail silently and stay failed. A contact form, an event inquiry, a private-hire request. They break through an expired integration, a changed notification address, or a spam filter quietly eating everything. The failure mode is that nothing happens, which looks exactly like nobody getting in touch. Send yourself a test through every form on the site once a month.

Certificates expire on custom domains. Let's Encrypt, which sits behind a large share of the web's HTTPS, issues certificates "valid for 90 days" and recommends renewing every 60. Renewal is automated almost everywhere and almost always works. When it does not, the browser puts a full-page security warning between a customer and your tap list, which is about as bad as a website failure gets.

Speed drifts downward. Google assesses Core Web Vitals at the 75th percentile of page loads, with thresholds of 2.5 seconds for Largest Contentful Paint, 200 milliseconds for Interaction to Next Paint and 0.1 for Cumulative Layout Shift. Sites rarely fail these on launch day. They fail after two years of uncompressed photos from three different phones.

Key Takeaway: put one monthly recurring calendar entry on somebody's name, with four items: submit every form, open the events page, check the hours against the door, and load the site on a phone on mobile data.

What Does a Maintenance Plan Cost, and What Should Be In It?

Somewhere between $35 and $500 a month for a business the size of a brewery, and the spread is almost entirely about whether security and hosting are included.

Independent 2026 pricing analyses put a small business website at roughly $35 to $100 a month and a larger SMB site at $125 to $500, with the higher tiers adding daily security scanning, managed backups and support response commitments. Ecommerce runs substantially higher, and if you sell merch or run online orders you are closer to that world than to a brochure site. For context on the other half of the number, what a brewery website costs prices the build; this is what it costs to keep afterwards.

BeerSoft publishes its own range on the website support and maintenance page: $100 to $500 per month depending on the complexity of the site and the level of support. That sits across the boundary between those two market tiers, which is the honest place for a brewery site with a beer list, an events calendar and probably a shop.

The line that matters most for a taproom is content updates, and it is the one usually treated as an add-on. A plan that patches diligently and leaves your events page three months stale has protected an asset while letting it go out of date, which is the wrong trade.

Key Takeaway: buy on content turnaround and restore testing, not on the length of the feature list. Ask for a redacted monthly report from a real client before signing anything.

What Can You Do Yourself, and What Needs Someone Else?

More than you think, and less than you would like. The split is about consequences, not difficulty.

Anything where the worst case is "it stays as it was" is yours: posting an event, correcting hours, swapping a beer, checking a form, compressing a photo before upload. None of it requires a developer and all of it is the stuff that decays fastest.

Anything where the worst case is "the site is down and I cannot put it back" is not yours, regardless of how confident you feel: plugin and CMS updates on a live self-hosted site, hosting or DNS changes, anything touching the database, and any change to URLs. That last one has its own post, because moving pages without redirects is the fastest way to lose rankings you already earned.

If you want a picture of where your site currently sits before deciding any of this, the twelve-point self-audit is the diagnostic that pairs with this post. That one tells you what is wrong today. This one is about what stops it happening again.

Key Takeaway: draw the line at reversibility. If you cannot undo it yourself in five minutes, it is not a job for whoever happens to have the login.

Frequently Asked Questions

How much does brewery website maintenance cost per month?

Independent 2026 pricing analyses put a small business site at roughly $35 to $100 a month and a larger SMB site at $125 to $500, with the difference mostly being security scanning, managed backups and support commitments. BeerSoft publishes $100 to $500 depending on complexity and support level. Ecommerce sites run higher, so if you sell merch online expect to be above a brochure-site price.

Do I need website maintenance if I use Squarespace or Wix?

You need less of it, and a different kind. The vendor patches the platform and you cannot install the third-party plugins that cause most security problems, so those line items do not apply to you. What still applies is content going stale, forms failing silently, integrations drifting and photos slowing the site down. Do not pay for plugin updates on a platform that has no plugins.

How often should WordPress plugins be updated?

Faster than monthly if you are treating it as security. Patchstack found a weighted median of five hours from vulnerability disclosure to first exploit attempt on heavily targeted issues, and roughly half of high-impact vulnerabilities exploited within a day. A monthly cycle cannot beat that, which is why reducing the number of plugins matters more than the schedule. Remove anything the author has not updated in over a year.

What is the most common problem on brewery websites?

Stale content, by a wide margin, and it is not close. Events pages showing last season, beer pages for beers you retired, hours that changed. It outranks security incidents because it happens to every site continuously rather than occasionally, and it is invisible internally because staff use the admin rather than the public pages.

Is uptime monitoring worth paying for?

On its own, barely. Monitoring tells you the site is down; it does not put it back. The value is in what follows the alert, so the question to ask a provider is who receives it out of hours and what they are contracted to do about it. Monitoring with no response attached is a notification service.

Conclusion: Buy the Boring Half

The half of maintenance that gets sold is security: patching, scanning, firewalls, a dashboard. The half that actually decides whether your website does its job is content staying true and forms still delivering, and it is usually listed as an optional extra.

So price plans on the boring half. Ask what happens when an update breaks something, how far the backups go and whether anyone has ever restored one, and how many content changes a month are included and how fast. Those three answers separate providers more reliably than any feature list.

If you would rather hand it over, BeerSoft does this work: website support and maintenance for breweries covers the security and backup side, the performance monitoring, and the beer menu and event updates that are the part most plans treat as extra. If you would rather start by finding out what is currently broken, contact us and we will run the audit first.

Sources

1. Patchstack. State of WordPress Security in 2026. Covering calendar year 2025: vulnerability counts, plugin and theme split, severity growth and time to first exploit.
2. W3Techs. Usage statistics of content management systems. Survey of 22 September 2026.
3. Let's Encrypt. Frequently Asked Questions. Certificate lifetimes and renewal guidance.
4. Google. Web Vitals, on web.dev. Core Web Vitals metrics, thresholds and the 75th percentile assessment.
5. WebFX. Website Maintenance Pricing. 2026 monthly ranges by site type.