Web application maintenance is the work that keeps a custom web app running safely after launch: updating the framework and its packages, patching security issues, watching uptime and errors, testing backups, fixing bugs and making the small changes your users keep asking for. Our web application maintenance services cover apps built in Laravel, PHP, Node.js, React, Vue and Next.js, whether we built them or inherited them from another team. You get a predictable monthly plan, a named team that knows your codebase, and a written report on the health of your app every month.
This service is part of our web application development practice. It exists because most business apps are built once and then left alone until something breaks. A payment provider changes its API, a server runtime reaches end of life, or a package with a known vulnerability sits in production for a year. Regular maintenance turns those surprises into scheduled, tested work.
What Our Web Application Maintenance Services Cover
Every plan includes the preventive work below. The hours in your plan go to fixes, improvements and anything your team adds to the queue.
| Area | What we do | What it means for you |
|---|---|---|
| Framework and package updates | Minor and patch releases for Laravel, Symfony, Node.js packages, React, Vue and Next.js, applied on a branch and tested on staging first. | Updates stay small and routine instead of piling up into a risky rewrite. |
| Security patching | Dependency alerts from Dependabot or Renovate, composer audit and npm audit checks, and fast patches when a security advisory affects your stack. | Known vulnerabilities do not sit in production waiting to be found. |
| Runtime and server updates | PHP and Node.js version upgrades before end of life, operating system patches, database engine updates and TLS certificate renewals. | Your app never runs on software that has stopped receiving security fixes. |
| Uptime, SSL and error monitoring | External uptime checks, certificate expiry alerts, and error tracking in Sentry with alerts routed to the right person. | We usually hear about a problem before your customers report it. |
| Bug fixing | Reproduce, fix, add a test so it stays fixed, and deploy through the normal pipeline. | Fixes do not quietly break something else. |
| Backups and restore tests | Automated database and file backups stored off the server, plus a scheduled test restore to prove they work. | A backup you have never restored is a guess. Ours are checked. |
| Performance and database health | Slow query reviews, missing indexes, queue and cron job checks, cache settings and page speed. | The app stays fast as your data grows. |
| Third-party API changes | Tracking deprecation notices from Stripe, Shopify, HubSpot, Google and other vendors, and moving to new API versions on time. Shopify, for example, releases a new Admin API version every quarter. | Integrations keep working when a vendor retires an old version. |
| Small features and UX fixes | New fields, reports, exports, email templates and screen improvements from your backlog. | The app keeps up with how your team actually works. |
| Documentation and runbook | A living document covering servers, credentials storage, deploy steps and what to do if something fails. | Knowledge about your app is written down, not held in one person's head. |
The Four Types of Web Application Maintenance, With Real Examples
Software maintenance is usually grouped into four types: corrective, adaptive, perfective and preventive. The split is useful because each type is planned and budgeted differently. Here is what each one looks like on a typical business web app.
Corrective maintenance
Fixing defects after they are found. A customer cannot reset a password, an invoice total is rounded wrongly, or an export times out for large accounts. Corrective work is unpredictable by nature, which is why a monthly hour bank suits it better than separate quotes.
Adaptive maintenance
Changing the app because the world around it changed. Moving from PHP 8.1 to a supported PHP 8 release, adopting a new Stripe API version, handling a browser change that broke a file upload, or updating a privacy notice and consent banner for a new market. Adaptive work is mostly predictable once you track vendor and runtime timelines.
Perfective maintenance
Improving what already works. Faster search, a new filter on the orders screen, clearer error messages, or a report your finance team builds by hand every month. This is where the app gains value over time.
Preventive maintenance
Reducing the chance of future problems. Adding tests around fragile code, removing unused packages, refactoring a 2,000-line controller, adding database indexes before a table gets slow, or rehearsing a disaster recovery. Preventive work is the first thing teams skip and the most expensive thing to skip.
Application Maintenance and Support: What Is the Difference?
Application maintenance changes the app itself: code, packages, servers and data structures. Application support responds to the people and incidents around it: a user who cannot log in, a failed overnight import, an alert at 9 a.m. that the queue has stalled. Most companies need both, and they work best when the same team handles them, because support tickets are often the first sign that maintenance is needed.
| Support level | Typical work | Who usually handles it |
|---|---|---|
| Level 1 (first line) | How-to questions, password resets, routing a report to the right person | Your own staff or help desk, using the runbook we write |
| Level 2 (technical) | Investigating errors, data corrections, failed jobs, configuration changes | Our team, as part of your plan |
| Level 3 (engineering) | Code fixes, root cause analysis, infrastructure changes | Our team, as part of your plan |
Our application support services focus on levels 2 and 3. If you have no help desk, we help you set up a simple ticket form and a shared inbox so first-line questions reach us with the details we need.
How Our Web App Maintenance Onboarding and Monthly Cycle Work
- Access and handover (week 1). You give us access to the repository, hosting, error tracker and any third-party dashboards through your own accounts, with credentials kept in a shared password vault. We never move your app into our accounts.
- Health audit (weeks 1 to 2). We review the code, list every outdated or vulnerable package, check runtime versions against their end-of-life dates, test-restore a backup and set up monitoring if it is missing. You get a written report that ranks the risks.
- Stabilization (weeks 2 to 6). We fix the urgent items first: missing backups, a runtime past end of life, failing scheduled jobs or unpatched security issues. For a neglected app this phase can take most of the first month's hours.
- Monthly maintenance window. Updates are applied on a branch, run through automated tests and checked on staging, then deployed at a time agreed with you. Hotfixes for security issues go out as soon as they are tested.
- Ticket queue. Your team adds bugs and requests to a shared board in GitHub Issues, Linear or Jira. We estimate each one, you set the order, and we work through it within your plan's hours.
- Monthly report and quarterly review. Each month you get a short report on what changed and the app's health. Every quarter we review bigger items, such as a major framework upgrade, and quote them separately if they will not fit the plan.
Tools We Use for Web Application Maintenance and Monitoring
| Category | Tools |
|---|---|
| Uptime and certificates | UptimeRobot or Better Stack, Cloudflare |
| Errors and performance | Sentry, Laravel Pulse, Laravel Horizon for queues, database slow query logs |
| Dependencies and security | Dependabot, Renovate, composer audit, npm audit, GitHub security advisories |
| Code quality and upgrades | PHPStan and Larastan, Rector for automated PHP upgrades, ESLint, TypeScript |
| Testing | PHPUnit, Pest, Vitest, Jest, Playwright for end-to-end checks |
| Deployment | GitHub Actions, Laravel Forge, Ploi, Docker |
| Hosting | AWS, DigitalOcean, Cloudflare, Vercel, or your current provider |
| Backups | Scheduled database dumps to Amazon S3 or Backblaze B2, provider snapshots |
If your app runs on a stack outside this list, tell us before we start. We will say plainly whether we can maintain it well or whether another team would serve you better.
Web Application Maintenance Deliverables and Health Measures
You should be able to see whether maintenance is working without reading code. Each monthly report covers:
- Every update, fix and feature shipped, with links to the pull requests.
- Uptime for the month and a short note on each incident: cause, fix and what we changed to prevent a repeat.
- Time to resolve incidents and bugs, so you can see whether response is getting faster.
- Open error count in Sentry and the trend against last month.
- Dependency freshness: how many packages are behind and whether any have known vulnerabilities.
- The date of the last successful backup restore test.
- Database and speed notes: slow queries found and fixed, page load trends, queue health.
- Hours used, hours remaining and the next items in the queue.
We do not promise a fixed uptime figure, because hosting, vendors and traffic are partly outside our control. We do commit to telling you about every incident and what we did about it.
Web Application Maintenance Pricing
Maintenance runs on monthly plans. Each plan includes the preventive work above plus a set number of development hours for fixes and improvements, so the main cost driver is how much change your app needs each month. The size and age of the codebase, the number of integrations and how far behind its packages are also affect which plan fits. Large jobs such as a major framework upgrade or a rebuild of one module are quoted as fixed-price projects.
App Care
$350 /month
Billed monthly
- Up to 5 hours of fixes and small changes
- Framework, package and security updates
- Uptime, SSL and error monitoring
- Daily backups checked
- Response within 1 business day
- Minimum term
- Month to month
- Setup
- $250 onboarding and code review
App Care Plus
$700 /month
Billed monthly
- Up to 12 hours of development
- Everything in App Care
- Monthly speed and database health report
- Staging environment for safe releases
- Response within 8 business hours
- Minimum term
- Month to month
- Setup
- $250 onboarding and code review
App Care Pro
$1,350 /month
Billed monthly
- Up to 25 hours of development
- Everything in App Care Plus
- Small features and UX improvements each month
- Hosting and cloud cost review each quarter
- Same-day response on business days
- Monthly call
- Minimum term
- Month to month
- Add-on
- Extra hours: $50/hour
All prices in USD. Need something different? Ask for a custom quote.
If your app needs more hours or a different mix, tell us about it and we will suggest a custom plan after a short look at the code.
Signs Your Web App Needs a Maintenance Plan
- Nobody has updated the framework or packages in more than six months.
- The developer who built the app has left, and nobody else can deploy a change safely.
- You are not sure when the last backup ran, or whether it can be restored.
- Customers report errors before your team knows about them.
- Small changes take weeks because each one breaks something else.
- A vendor has emailed you about an API version being retired and nobody has acted on it.
- Your hosting provider warns that your PHP or Node.js version is no longer supported.
If several of these apply, start with the health audit in our onboarding. It gives you a ranked list of risks even if you decide to handle the work in-house. You can also request a free audit to talk through your situation first.
In-House, Freelancer or Application Maintenance Company?
| Option | Works well when | Watch out for |
|---|---|---|
| In-house developer | The app changes every week and is central to your business. | Maintenance gets pushed aside by feature work, and one person is a single point of failure. |
| Freelancer on call | The app is small, stable and rarely changes. | Availability during an incident, and knowledge leaving when they take a full-time role. |
| Application maintenance company | You want scheduled updates, monitoring and a team that can cover each other. | Providers who only react to tickets. Ask what preventive work is included every month. |
A mix also works well. Your in-house developer builds features while we handle updates, monitoring, backups and security, so their time goes to the product.
Web Application Maintenance Mistakes That Cause Outages
- Updating directly in production. Every update should pass tests and a staging check first. A two-minute shortcut can mean a two-hour outage.
- Skipping major versions for years. Jumping several framework versions at once is far riskier than moving one version at a time.
- Backups that were never restored. We often find backup jobs that silently stopped months ago, or dumps that are missing tables.
- Alerts that go to nobody. Monitoring is only useful if alerts reach someone who will act on them.
- One person holding every credential. Hosting, domain and vendor logins belong in your company's accounts and a shared vault.
- Ignoring deprecation emails. Payment, shipping and marketing APIs retire old versions on published dates. Missing one can stop orders or syncs overnight.
Enterprise Web Application Maintenance and Security Reviews
Larger clients often need maintenance work that holds up to a security questionnaire from their own customers. For enterprise web application maintenance we keep a change log of every deploy, review user access every quarter, document how secrets are stored, and keep audit logging in place for sensitive actions such as exports and permission changes. We can also answer the technical sections of vendor security questionnaires about the app. We do not run a round-the-clock operations center. Monitoring runs continuously, and our working hours cover the full US business day and overlap UK business hours. If you need guaranteed overnight response, we will tell you that up front.
Why Choose 95 Solutions for Web App Maintenance
- We maintain our own production software. Our custom PHP and SQLite CMS runs Boiler Decoder and this website, and we co-build AM Jarvis, a SaaS suite for Shopify and WooCommerce stores. The update routine we sell is the one we use on our own products.
- Senior-led. Mustafa, our founder, holds a BS in Computer Science and leads every account, so maintenance priorities are set with the business impact in mind.
- Everything stays yours. Code, servers, backups and vendor accounts remain in your name. If you move the work in-house, nothing needs to be transferred.
- Plain reporting. Monthly reports in plain English, with links to every change, invoiced in USD from our US LLC.
Who Our Web Application Support and Maintenance Plans Suit
A good fit
- Companies running a custom web app, portal or internal tool with no full-time developer.
- Teams that inherited an app from an agency or freelancer who is no longer available.
- SaaS founders who want their own developers on features while someone else handles updates and monitoring.
- Businesses facing a security questionnaire or a runtime end-of-life deadline.
Probably not a fit
- Marketing websites on WordPress, Shopify or Squarespace. Those are covered by our platform-specific care plans.
- Apps that need a guaranteed overnight on-call engineer every night of the year.
- Codebases so far gone that a rebuild is cheaper than maintenance. Our audit will say so if that is the case.
Related Services for Web App Maintenance Clients
When the audit shows that a module needs rebuilding, our custom web application development team handles it as a separate project. For desktop, mobile or wider systems, see our software maintenance services, and for content-managed sites our CMS maintenance plans. Hosting, pipelines and infrastructure work can be paired with our DevOps consulting.