Nobody decides to stop maintaining a startup's website. It happens the week after launch, when the person who built it moves back to the product. From then on the site only gets attention when something visibly breaks, and the expensive failures are the ones that aren't visible.
Here is the checklist, written the only way a founder will act on it: by what each skipped job costs.
The failures you can't see cost the most.
A contact form that stops delivering is the worst one. The page still loads, the button still works, the visitor still sees a thank-you message. The lead just never arrives. Nothing alerts you, because from the server's side nothing went wrong. The only symptom is a quiet month you blame on the market.
Analytics fails the same way. A tag gets removed in a redesign, a consent setting changes, and your traffic drops to zero in the dashboard while real visitors keep arriving. Every decision you make on those numbers is now wrong.
The fix for both is the same: test the form end to end and check that analytics is recording, on a schedule, not when you remember.
Updates skipped become projects.
WordPress, its plugins and the version of PHP it runs on all release on their own schedule. PHP publishes the dates each version stops getting security fixes, and hosts eventually stop running the old ones.
Each update, taken when it ships, is small and dull. Skipped for a year, they stack into a project: a plugin that no longer works with the new core, a theme that breaks on the new PHP version, a weekend of someone's time to untangle it. The work was always coming. Skipping it only made it bigger.
Plugins have a second failure mode: abandonment. A plugin whose developer stopped maintaining it never gets another security fix, and nothing on your dashboard says so. Someone has to notice when a plugin's last release was two years ago and replace it before it becomes the way in.
A test copy of the site, where updates run first, is what keeps this dull. If your host gives you a staging environment, use it before anything reaches the live site.
Renewals lapse at the worst time.
The domain, the security certificate and any paid plugin licences all expire. Most renew automatically, until the card on file expires or the renewal email goes to someone who left.
A lapsed domain takes the site and often the company's email with it. A lapsed certificate puts a browser warning in front of every visitor. Both are trivially preventable and both happen to real companies, because the renewals are tied to one person's inbox instead of the company's.
Put every renewal on an account the company controls, with a card that someone checks.
Backups nobody has restored.
Almost every host takes backups. Far fewer founders have ever restored one. A backup that has never been tested is a hope, not a plan. The moment you need it is the wrong moment to find out how it works.
Know where the backups are, how far back they go and how long a restore takes. Try it once on the test copy. It takes an hour and it is the most valuable hour on this list.
The copy drifts from the company.
Your prices change. Your team page lists someone who left. The home page still leads with the positioning you dropped two quarters ago. None of it breaks anything, and all of it tells a careful buyer that nobody is minding the store.
Copy is maintenance too. Put a review of every page on the calendar each quarter, and keep a running list of small changes so they ship in a batch instead of never.
Every item here is small. The problem is never difficulty. It is that each one belongs to nobody, so each one waits.
That is the argument for handing the whole list to one owner. For the WordPress sites we run, that owner is us: hosting with the certificate, backups and caching included, continuous monitoring, updates on a schedule and an hour of on-demand support each month, with monthly revision hours on our website management plan. The fuller case is in who runs a startup's website after launch, and the service sits under Website.
Tell us what you're building.