Website Updates: Whose Responsibility Are They, Really?

A website has three parents: the designer who built it, the host who stores it, and the owner who paid for it. When it comes to website updates, all three tend to assume one of the others is handling it. Then eighteen months pass, forty plugin updates pile up, and the site gets hacked or breaks. The question of whose responsibility website updates are isn't legal trivia. It decides whether your site survives year two.

First, what "updates" actually means

People say "updates" and mean four different things:

• Core software: WordPress itself, or whatever CMS runs the site. Several releases a year, some critical security fixes.
• Plugins and themes: the add-ons. These update constantly, and they're the number one way sites get hacked when ignored.
• Server software: PHP versions, database engines, server security patches.
• Content: your prices, your Dashain offers, your team photos. Different job entirely.

What your hosting company handles

The host is responsible for the machine: server security patches, PHP availability, uptime, and usually backups. A good host will nudge you when your PHP version goes ancient. What the host will not do is log into your WordPress admin and update your plugins. That's inside your house; they only maintain the building.

What your designer handled (and when it ended)

Your designer chose the software versions, configured everything, and handed over a working site. Most design contracts include a support window after launch. At WebsNP that runs from 15 days on the Starter package up to 6 months on Enterprise, and during that window we handle updates. After the window closes, the honest answer is: nobody is updating your site unless somebody is being paid to, or you're doing it yourself.

This is not designers being lazy. Updating a site properly means taking a backup first, applying updates, then checking the site still works. Doing that monthly across dozens of client sites is real ongoing work, which is exactly what maintenance plans exist to cover.

What only the owner can own

You hold the credentials, the domain, the hosting account. Even if you never touch a plugin yourself, three duties can't be delegated away: deciding who maintains the site, paying the renewals on time, and keeping the login details somewhere safer than one employee's phone. We've seen a Pokhara hotel lose weeks because the only person with the passwords went abroad for a job.

The three workable arrangements

In practice, updates get done under one of three setups:

• You do it yourself. Fine for simple brochure sites. Budget 30 minutes a month: backup, update, click through the main pages. The habit matters more than the skill.
• A maintenance plan does it. Typically NPR 8,000 to 30,000 per year in Nepal depending on site complexity. Updates, backups checked, security scans, small fixes included. For a site that takes bookings or payments, this is not a luxury.
• Nobody does it. This is a real choice people make, silently, by default. It works right up until it very much doesn't, and the eventual hack cleanup or rebuild costs more than a decade of maintenance would have.

A simple test for your own site

Log into your website admin today. If you see a number badge showing 20+ pending updates, you've discovered which of the three arrangements you're on. If you can't log in because nobody remembers how, you've discovered something more urgent.

When WebsNP builds a website, we hand over a recorded training video, set updates up cleanly, and offer a maintenance plan for when the free support window ends. Whichever arrangement you choose, choose it on purpose. Updates are like servicing a motorbike in Kathmandu traffic: skipping them saves money every single month, until the one month it really, really doesn't.