What you are committing to.
WHAT EVERY INSTALLED APPLICATION REQUIRES
Regular updates, indefinitely Backups Monitoring that it still works Occasional migration when the PHP version or platform moves on Eventual replacement, when the project is abandoned or outgrown
THE REALISTIC COMMITMENT
An hour a month per site, more when something goes wrong, and a larger effort every few years for major upgrades.
Multiply by the number of applications you run.
WHAT HAPPENS WITHOUT IT
An unmaintained application is compromised eventually. Not possibly: eventually. Automated scanners find vulnerable versions continuously.
The compromise costs far more than the maintenance would have.
PLANNING FOR IT
Keep a list: what is installed where, versions, last updated
Schedule the routine rather than relying on remembering Budget for major upgrades rather than deferring them indefinitely Decide who is responsible, explicitly
FOR CLIENT SITES
Say in writing who maintains what. A client assuming you update their site, while you assume they do, ends with a compromise and an argument.
