How Do Maintenance and Security Responsibilities Differ Across Website Platforms?

Website platforms differ mainly in who is responsible for updates, backups, hosting, and security controls. In general, the more managed the platform, the more the provider handles; the more self-hosted the platform, the more the site owner must manage.

Typical responsibility split

• Hosted website builders / managed platforms: The platform provider usually handles server maintenance, software updates, infrastructure security, and availability monitoring, while the site owner focuses on content, account access, and any third-party integrations.
• CMS platforms like WordPress, Drupal, or similar: The site owner or administrator is usually responsible for applying core, plugin, and theme updates, checking backups, reviewing user permissions, and monitoring for vulnerabilities, even if the hosting provider secures the server layer.
• Self-hosted websites or custom applications: The site owner bears the widest scope of responsibility, including server patching, SSL management, backup testing, monitoring, access control, and incident response, unless these tasks are contracted to a managed hosting or IT provider.

Maintenance vs security

• Maintenance covers routine operational work such as updates, backups, uptime checks, broken link fixes, and restore testing.
• Security focuses on preventing and detecting threats, including patching vulnerabilities, malware scanning, access reviews, logging, and response procedures.

Practical way to think about it

• Managed platform: provider handles most technical upkeep; owner handles content and account governance.
• CMS: shared responsibility; provider secures infrastructure, owner maintains the application layer.
• Self-hosted: owner or their contractor handles nearly everything technical.

If helpful, a simple responsibility matrix can be provided for website builders, CMS platforms, and self-hosted sites.