What we mean by a managed website.

A managed website should never become a hostage. The business that pays for the property owns its domain, its content, its brand assets and its data, and it should be able to prove that ownership without asking the provider for permission.

Access is documented rather than remembered. Every system the site depends on is listed with who holds the account, who has access and at what level, so ownership questions are answered before they become disputes.

The standard expects

• The domain is registered in the client’s name, or in an account the client controls
• An access register lists every system the site depends on: domain, DNS, hosting, repository, CMS, analytics, Search Console, forms and email delivery
• Accounts use named, individual logins rather than shared passwords
• The client can see who has access and remove it
• Ownership of design and code deliverables is defined in writing before work starts

Most website incidents are caused by changes: an edit made directly on the live site, an update applied without review, a plugin upgrade that breaks a form. A managed property controls how change reaches production.

The appropriate level of control depends on the site. A small content edit does not need the same ceremony as a new template or a platform upgrade. What matters is that every change has a path, a reviewer where it matters, and a way back.

The standard expects

• Changes move through a defined release path rather than ad hoc edits on the live site
• Visible or structural changes are previewed or staged before release where the platform allows
• Every release can be rolled back, through source control, backups or both
• A change record notes what changed, when, why and who approved it
• Automated checks run before release where practical: build, links, metadata and key pages

A managed site is watched. Outages, expired certificates, broken pages and failing dependencies should be noticed by the operator, ideally before a visitor or the client does.

Technical health also means keeping the platform current. Frameworks, content systems, plugins and server software age, and unmaintained dependencies become security and stability risks.

The standard expects

• Uptime monitoring on the site and its most important pages, with alerts to a person
• Certificate, domain and DNS expiry tracked in advance
• Regular checks for broken pages, broken internal links and server errors
• Platform and dependency updates applied on a routine cadence, with security updates prioritized
• An incident process: acknowledge, diagnose, fix or roll back, then record what happened and why
• Response expectations for incidents agreed in the engagement, not assumed

Fast sites are easier to use, convert better and are easier for search engines to crawl. Performance is not a one-time launch achievement; new images, scripts, embeds and features erode it gradually unless someone is watching.

The standard is awareness and protection, not a promised score. Lab scores vary by tool, device and network, and field data depends on real visitors. What a managed site should show is that performance is measured, regressions are caught and fixed, and new additions are weighed against their cost.

The standard expects

• Core Web Vitals and page weight tracked for key templates, using field data where available
• Images and video sized, compressed and served in modern formats
• Caching and static-first delivery used where the site allows
• Third-party scripts checked before they are added and periodically afterwards
• Performance checked after significant releases, with regressions treated as defects

Accessibility is part of building and operating a website properly. It improves usability for everyone and is expected by a growing number of buyers, partners and regulators.

The standard is sensible, continuing practice guided by the Web Content Accessibility Guidelines (WCAG) as a reference. It is not a claim of formal conformance or legal compliance, which requires a specific audit against a defined scope. Where a client needs a formal audit or conformance statement, that is scoped as separate work.

The standard expects

• Semantic HTML: real headings, lists, landmarks, buttons and links
• Everything usable with a keyboard, with visible focus states
• Text and interface contrast checked against recognized guidelines
• Form fields with proper labels, clear errors and instructions
• Meaningful alternative text for informative images
• Reduced-motion preferences respected for animation
• Automated checks plus periodic manual testing of key journeys, including keyboard use

Technical search health is part of operating a website responsibly. It does not grow visibility on its own, but without it, every other search investment is undermined.

Most search-health failures are silent: a staging setting that blocks indexing, canonical tags pointing to the wrong page, redirects lost in a migration, structured data that no longer matches the page. A managed site checks for them routinely.

The standard expects

• Correct canonical URLs on every indexable page
• An XML sitemap listing only indexable, canonical URLs, kept current automatically
• A robots configuration that allows what should be crawled and nothing that should not
• Monitoring of indexing and crawl errors through Search Console or equivalent tools
• Redirects maintained for every retired URL, and protected during redesigns and migrations
• Unique titles and descriptions on indexable pages, and one clear main heading
• Structured data that describes content actually visible on the page
• Important content delivered as crawlable text, not only inside images or scripts
• Non-production environments excluded from indexing

Decisions about budget, content and design are only as good as the data behind them. Measurement breaks more often than most businesses realize, usually after a site change nobody connected to tracking.

Integrity means the core measurement is configured deliberately, verified in the live environment, and checked again whenever the site changes. It also means respecting the choices visitors make about tracking and explaining the effect of those choices on the numbers.

The standard expects

• Conversions defined and documented: what counts as an inquiry, booking or sale
• Key events verified in the live environment, firing once and on the right action
• Consistent campaign tagging conventions so traffic sources are not fragmented
• Measurement re-checked after releases that touch forms, templates or scripts
• Tracking implemented in a consent-aware way where consent is required
• Spam, internal and test traffic kept out of reported results where possible

For many businesses the most expensive website failure is a form that looks like it works and does not. The visitor sees a success message, the submission never arrives, and nobody finds out until a customer mentions it weeks later.

A managed site treats forms as critical infrastructure: tested end to end, monitored, and honest with the visitor about whether their submission was received.

The standard expects

• Success messages shown only when a submission has actually been accepted
• Clear, accessible error states, with an alternative contact route when sending fails
• Delivery and routing tested end to end, from the form to the person or system that receives it
• Spam protection that does not block real people, such as honeypots and server-side validation
• Forms tested after every change that could affect them
• Submission data handled in line with the privacy notice, with only necessary fields collected

No website can be made perfectly secure, and a managed service should not claim otherwise. What it should do is apply sound fundamentals consistently, reduce the attack surface, keep software current and be ready to recover.

Privacy follows the same principle: collect only what is needed, be clear about what is collected, respect consent where it is required and keep third-party data sharing to what the site genuinely needs. Specific legal obligations depend on the business and its markets and are the client’s to determine with their own advisers; the standard supports them, it does not replace legal advice.

The standard expects

• HTTPS everywhere, with certificates renewed automatically
• Least-privilege access and multi-factor authentication on administrative accounts where the platform supports it
• Security updates applied promptly
• Credentials and secrets kept out of code repositories
• Regular backups, with restoration tested rather than assumed
• Unused plugins, accounts and integrations removed
• Third-party scripts and data collection kept to what the site needs
• Access removed promptly when people leave a project

Websites decay in plain sight. Former staff remain on the team page, discontinued services are still described, prices and hours are out of date, a campaign page from last year is still linked from the homepage, and a claim that was true at launch no longer is.

A managed site keeps its content current, removes what is no longer accurate and makes sure every call to action still leads somewhere useful.

The standard expects

• Business information such as contact details, hours, locations and team kept current
• Outdated offers, prices, claims and expired campaigns removed or updated
• Broken or misleading calls to action corrected
• Key pages checked on a regular cadence for accuracy
• Claims about results, clients and credentials supported by evidence the business can stand behind

Keeping a site running is the floor. A managed site should also improve: small usability fixes, clearer paths to inquiry, faster templates, better internal links, corrections prompted by what real visitors do.

Improvement should be visible. The client should be able to see what was found, what was prioritized, what shipped and what happened afterwards, without having to ask.

The standard expects

• Issues detected through monitoring, analytics and reviews, not only through complaints
• A prioritized list of improvements, visible to the client
• Small improvements shipped routinely within the agreed scope
• Regular reporting of what changed, what was found and what is recommended next
• Results of changes assessed, including when a change did not help

A good managed relationship is one the client could leave. That is not pessimism; it is what keeps the relationship honest. The path out should be documented at the start, not negotiated at the end.

Transfer means the client, or a new provider, can take over the property with the access, documentation and assets needed to operate or migrate it.

The standard expects

• A documented transfer path agreed at the start of the engagement
• Handover of domain and account access, content, assets and data the client owns
• Documentation of hosting, deployment, integrations and configuration
• Code and infrastructure transfer handled as defined in the agreement
• Reasonable cooperation during transition, as agreed in the engagement