Plugins and services now say AI can do your website maintenance for you: watch the site, catch problems, even apply the fixes. I wanted to know what that means for a small business site. So on 24 October 2026 I ran the standard checks on the code behind my own site and had AI sort the results.
Short answer: partly. AI is a good watcher. It read a long list of outdated parts and security warnings and put them in a sensible order. It's a poor owner. It can't tell whether an update will break your contact form, it doesn't hold your logins, and nobody answers when it's wrong. So let it watch and draft, and keep a person on approve and own.
What does website maintenance actually involve?
It's a handful of small jobs that nobody notices until one gets missed:
- Software updates. The code your site runs on gets new versions all the time.
- Security fixes. Known holes get patched, often inside those updates.
- Backups. A copy of the site you can put back.
- Uptime. Somebody finds out when the site is down.
- Forms and links. The enquiry form still sends and the links still go somewhere.
- Renewals. The domain and the security certificate don't expire.
- Small edits. New hours, a new photo, a changed price.
Sites don't fail loudly. They get a little less safe, or a form stops sending, and the owner is usually the last to hear. Several of these jobs depend on logins that one person holds, which is why I wrote about who owns your website domain.
What did AI get right when I ran the checks on my own site?
Most sites are built from many small parts made by other people, and each part gets updated. On 24 October 2026 I ran two standard checks in the code behind this site. One lists parts with a newer version (called npm outdated). The other asks a public database of known security problems (called npm audit). Here is what came back.
| Check | What it found |
|---|---|
| Outdated parts | 13 had a newer version. Examples: Next.js 15.5.18 (patch 15.5.28, new major version 16.4.3), React 19.2.0 (19.3.1), Framer Motion 12.23.24 (a major jump to 14.6.0). |
| Security audit | 5 findings: 1 critical, 4 high. In Next.js, sharp, postcss, nanoid and source-map-js. |
| Where they sit | Next.js is a part the site uses directly. The other four sit underneath other parts. The audit listed 14 separate advisories under Next.js alone. |
I gave both lists to Claude (Sonnet 5.5) with one question: for a small business site with a contact form, which would you apply without asking me, and which need a person? Here is its answer, trimmed, before I checked anything.
AI output, trimmed
Apply without asking: Next.js 15.5.18 to 15.5.28 (a patch, same version line, clears the critical). nanoid, source-map-js and postcss (build tools, small changes). React, Tailwind, Lenis and the type packages (small updates).
Needs a person: sharp 0.34 to 0.35 (it touches image handling). Next.js 16, Framer Motion 14, lucide-react 1.x, TypeScript 7 (all major jumps).
Reachable? Many of the Next.js items involve Server Actions, custom servers, rewrites and image optimization. This is a mostly static site, so many may not apply, but I'd still patch.
That's a good first pass. It put the one safe fix first, held back every major jump, and said why in plain words. It would have saved me twenty minutes of reading advisories. In my words, that's watching and drafting, and AI does both well.
What goes wrong when AI looks after the site alone?
I checked each call against evidence. It held up on the Next.js patch. The 15.5.28 release notes list two security fixes, one rated critical. It also held up on Server Actions: the advisory only applies to sites that use them, and I searched the code and found none.
It was weaker on two things. First, the “reachable?” guess. One critical advisory concerns the image optimizer when it handles AVIF files, and my site's settings ask for AVIF images. So that one was not a safe guess. Whether it matters on the live site depends on how the site is served, and I didn't check that, so I'm not saying either way. Second, “fix available” was not the whole story. I ran npm audit fix with its dry-run switch (a preview) and then applied the fix in a throwaway copy, never in the real code. The report dropped from five findings to three, with nothing critical left. What remained (two moderate, one high) traces to a copy of postcss bundled inside Next.js 15.5.28. The only fix offered was Next.js 16, which npm itself marks as a breaking change. npm's own docs say some problems can't be fixed automatically. The AI hadn't expected a leftover, and neither had I. The site still built with all 41 pages in the copy, so the sharp jump it was wary of turned out fine on build. A passing build doesn't tell you the images look right or the form still sends.
I'm only naming packages and counts here, not how anything is exploited. I didn't change the live site. I didn't test a rollback, a form, speed or uptime, or any of the major jumps, and I didn't try an AI maintenance plugin.
Now picture the unwatched version (a made-up scenario, not a client). An automatic update changes how the form behaves and nobody sends a test message. The backups run every night and nobody has ever restored one. The only person with the hosting login left last spring. At 7 pm the site goes down. If an automatic change breaks your site, who do you call? A tool doesn't answer the phone. That's the part the sales pages skip. It's the same pattern I found when I tested AI on a homepage: it drafts well, and a person decides. Checking AI's work is also why my blog checker only tests length, not truth.
What should you give to AI, and where do I fit?
I sort the work into four verbs. Each needs a named holder.
| Verb | What it means | Who |
|---|---|---|
| Watch | Spot an old part, a new warning, a broken link | AI is good at this |
| Draft | Sort the list, explain it in plain words | AI is useful here |
| Approve | Decide what is safe on a live site, and when | A person |
| Own | Hold the logins, restore the backup, take the call | A person, by name |
On my sites, hosting is free for as long as your site is with me, and it includes uptime monitoring and security updates. Care is optional at $49 a month: small changes, text and hours updates, up to about 1 hour of changes a month, and priority replies. The details are on hosting and optional Care on my pricing page. For what a site costs to run beyond the build, see how much a website costs.
You may not need me. A five-page site with no forms and no logins to anything else can run on AI watching plus an occasional approve from you. A site that takes enquiries or bookings is where a named person matters. If yours is already hard to keep running, it may be better rebuilt as a custom-coded website or a website redesign. I explain how I use AI and why a person still checks on its own page.
What to do this week:
- Write down who has the login to your hosting and your domain, and where it's kept.
- Ask whoever looks after your site when a backup was last restored, not just taken.
- Decide who gets the call if the contact form stops sending. Then send a test message yourself.
Related posts
- Can AI write your homepage? I tested Claude on a Toronto brief
- Who owns my website domain, me or my web designer?
- How much does a website cost?
- Does Google penalize AI content?
Sources
- npm Docs: npm-audit (read 24 October 2026)
- npm Docs: npm-outdated (read 24 October 2026)
- GitHub: Next.js v15.5.28 release notes (released 14 October, read 24 October 2026)
- GitHub Advisory Database: GHSA-2464-fhr4-w9xw, Next.js Image Optimization API (published 14 October 2026, updated 22 October 2026)
- GitHub Advisory Database: GHSA-2xp9-vwfh-vxw4, Next.js Image Optimization API and AVIF files (updated 8 September 2026)
- GitHub Advisory Database: GHSA-m99w-x7hq-7vfj, Next.js Server Actions (published 21 July 2026)
Not sure who is watching your site?
Send me your site and I'll tell you what I'd watch. You can also ask for my free website review.
Send me your site