Website maintenance: corrective, preventive or evolutive?

If you ask for website maintenance quotes, you usually get three proposals you can't compare. One says “support,” another “monthly plan,” the third “development hours.” Behind the names are three different jobs: fixing what broke, keeping it from breaking and improving what already works.

Knowing which is which changes what you pay and what you get. In this guide I explain the types of website maintenance, show why October 2026 made it clear which one you can't skip, and list what the contract needs to spell out.

The names you see on quotes

Software engineering has an old classification for this, set out in the ISO/IEC 14764 standard. The IEEE Technology Navigator summary splits it into four types:

• Corrective: fixes flaws found after the product went live.
• Adaptive: keeps the product working when the environment changes, such as the server, browser or platform version.
• Perfective: improves the product beyond what was first requested.
• Preventive: finds and fixes hidden flaws before they bring something down.

In the Brazilian website market, those four names became three. Adaptive is folded into preventive, because both are routine: update, check, protect. And perfective got the name evolutive. From here on I use this split, since it's the one you'll see in proposals.

Corrective: the fix after the problem

This is the maintenance everyone knows. The contact form stopped sending. The services page loads blank. The WhatsApp button disappeared on mobile. Someone calls, opens a ticket, and a technician fixes it.

The problem with corrective alone is time. Between the error happening and someone noticing, the site can go days without generating leads. If the form breaks on a Friday and nobody tests it until Monday, the weekend's quote requests are lost and nobody knows how many there were.

Corrective is necessary, but it's the most expensive per ticket. You pay for the fix and also absorb the cost of the downtime.

Preventive: what keeps the site from breaking

Preventive doesn't show on screen, which is why it's the first thing cut from the budget. It covers updating the server, the language the site runs on, the platform and the plugins, checking backups, renewing the certificate and monitoring whether the site is up.

October 2026 gave the best example of why. On October 21, the PHP project, the language every WordPress site runs on, published a critical security advisory about two flaws that allow code execution on the server, both rated 9.2 out of 10 for severity. According to the advisory, the risk is highest on servers with mod_php, where a request from someone who isn't logged in can trigger the attack before the site runs a single line of its own code.

The line in the advisory that matters to site owners: “There are no complete mitigations, updating is the only safe choice.” The fixes came out the same day, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Three details from this episode show what preventive does:

• Updating WordPress doesn't fix it. The flaw is in PHP, which runs on the server. If you only click “update plugins” in the dashboard, you're still exposed.
• Older versions are left out. PHP 8.1 and earlier no longer get fixes from the PHP project. Sites on those versions need to migrate, not just update.
• PHP 8.2 has an end date. PHP itself noted that support for this version ends on December 31, 2026. If you're on it, you have two months to plan the switch.

The platform ages too. WordPress.org statistics, checked on October 27, 2026, show that 64.1% of WordPress sites run the latest version, 7.1. In other words, more than a third are on older versions. Some of those still get fixes, some don't, and site owners rarely know which group they're in.

If you want the backup and access side of this routine, I wrote about it in website backup and security.

Evolutive: what makes the site sell more

Corrective and preventive keep the site standing. Neither one increases the number of leads. That's the job of evolutive.

In practice, evolutive is a list of improvements made bit by bit, based on what the site shows:

• shortening a form that gets lots of visits and few submissions;
• creating a page for a service people search for and the site doesn't have;
• putting proof near the contact button, like case studies, reviews and numbers;
• making the home page lighter on mobile;
• preparing pages and structured data so the site shows up in AI answers.

Evolutive is the one that looks most like an investment, and the one that suffers most from a tight budget. If the money only covers part of it, the right order is preventive first, evolutive second. Improving a site that could be hacked tomorrow is building on sand.

Which type of maintenance to hire

The short answer: a business website needs all three, weighted differently depending on the moment.

• Company website that rarely changes: preventive every month, corrective on demand and evolutive in small cycles, when there's a clear goal, like more quote requests.
• Site that gets paid traffic: preventive and evolutive every month. Every extra point of conversion changes the cost of ads, and a page that's down burns budget.
• Online store or site with a customer area: preventive with a short, written deadline, because it stores customer and payment data. Corrective with fast response. Ongoing evolutive.

A red flag: a monthly plan that only covers corrective, or that covers “support” without saying what it is. In that case, nobody is required to update PHP when an advisory like October's comes out. I broke down what goes into the cost in how much website maintenance costs per month.

What to get in writing in the contract

Before signing, ask the provider to answer these questions in the contract itself:

1. What counts as corrective, preventive and evolutive, with examples.
2. How fast a critical failure gets handled, and what counts as critical.
3. How often the server, language, platform and plugins get updated, and who decides when there's a critical advisory.
4. How many hours or evolutive deliverables are included per month, and what anything beyond that costs.
5. What report you get, with updated versions, flaws found and improvements made.
6. Whose name the domain, hosting, code and access are in.

If the answer to question 3 is “whenever we can,” preventive isn't in the contract.

How we do it at the Studio

Sites like studioresponsivo.com.br, amandanutri.com.br and conversaovisual.com.br were built with custom code and run on our own server, without a stack of third-party plugins. That cuts the number of parts to update, but doesn't remove the need for preventive: the server, dependencies and certificate still need a routine.

We set a fixed price after discovery and write the deadline into the contract. Code, files and access stay in the client's name. Every system we deliver ships with an AI agent that runs daily, flags failures, suggests improvements and checks that the data makes sense, which combines preventive and evolutive in a single routine.

If you want a plan that defines corrective, preventive and evolutive before charging for them, check out our ongoing evolution for websites and systems.