Website Builder Uptime and Security: Checks Before an Annual Plan

Website builder uptime and security are the parts of a platform you cannot see in a demo: how often sites stay online, how they are protected and how quickly they recover. Before paying for a year, check the uptime record, HTTPS, login protection, backups and restores, support response and whether you can leave with your content and domain.

• An uptime promise of 99.9% still allows about 8.8 hours of downtime a year, while 99.99% allows about 53 minutes.
• When a site keeps returning 5xx server errors, Google slows its crawling and eventually drops those URLs from the index (Google Search Central).
• The OWASP Top 10:2025 lists 10 web application risk categories, with broken access control at number 1 (OWASP).
• The UK National Cyber Security Centre suggests keeping 2 backups, one online and one on a separate device (NCSC).

Why check infrastructure before paying for a year?

An annual plan locks you in for twelve months, and infrastructure problems only show up after launch. A few questions now are cheaper than a move later.

Every builder looks reliable in a demo, because a demo runs for a few minutes on a quiet server. The real test comes on an ordinary weekday when a customer tries to book, a form needs to reach your inbox or a page needs to load on a slow phone connection. Outages, slow pages, lost form submissions and compromised logins are the problems that cost a business enquiries. None of them is visible while you admire a freshly drafted home page.

These checks sit beside the ai web design quality checklist, which covers layout, accessibility and speed in a draft. Design tells you whether the site is good enough to publish. Infrastructure tells you whether it will stay online, stay safe and stay yours. Both matter before you hand over a year's payment.

What uptime should I expect, and how do I check it?

Expect a published uptime target, a public status page and a clear record of past incidents. Treat a vague promise of reliability as no promise at all.

Uptime targets are usually stated as percentages, and small differences matter more than they look. A 99.5% target allows almost 44 hours of downtime a year, 99.9% allows about 8.8 hours and 99.99% allows about 53 minutes. Ask which target applies to your plan, how it is measured and what happens if the provider misses it. A target with no remedy attached tells you what the provider hopes for, not what it commits to.

A public status page is the best evidence you can get before buying. Look at the last few months of incidents, how long each lasted and how clearly the provider explained what happened. Frequent short outages can hurt as much as one long one, especially if they fall during your busiest hours. If a provider has no status page at all, ask how customers are told about outages and how quickly.

You can also run your own check during a trial. Publish a test page and point an uptime monitoring service at it for a couple of weeks. Many monitors send an alert when the page stops responding, which gives you a real record rather than a sales claim.

What happens to my search visibility when the site goes down?

Short outages rarely cause lasting harm, but repeated or long server errors slow Google's crawling and can remove pages from search. Reliability protects rankings as well as sales.

Google's documentation explains that 5xx server errors prompt its crawlers to slow down temporarily. Pages that are already indexed are kept for a while, but URLs that persistently return a server error are eventually dropped from the index. Content served with an error status is ignored, so nothing on those pages counts while the error lasts. Once the server returns normal responses again, Google gradually increases its crawl rate.

The lesson for buyers is that uptime is part of search performance. A builder with frequent outages can undo the work you put into titles, descriptions and content. Ask how the provider handles maintenance, whether it happens at quiet hours and whether it returns the correct temporary status code while work is under way. Those details decide whether a planned update costs you nothing or costs you visibility.

Which security features should be included as standard?

HTTPS on every page, two step verification for your login, managed software updates, spam protection on forms and clear control over who can edit. These should come with the plan, not as extras.

HTTPS encrypts the connection between your site and its visitors, and browsers warn people away from pages that lack it. Google's page experience guidance asks whether pages are served securely as one of its basic questions. Every serious builder now includes a certificate, but check that it is issued and renewed automatically, including on your own domain. A certificate that expires without warning will put a security warning in front of every visitor.

Your login is the next weak point. The OWASP Top 10:2025 places broken access control first and authentication failures seventh among web application risks, which shows how often attackers get in through accounts rather than code. Ask whether the builder supports two step verification, whether you can give staff limited roles and whether you can see a log of who changed what. A stolen password should not be enough to take over your website.

On a hosted builder, the provider is responsible for patching servers and the software that runs your site. Ask how quickly security updates are applied and whether add ons from third parties are reviewed. Contact forms also need protection from spam and abuse, and form submissions that contain customer details should be stored securely. Security misconfiguration and software supply chain failures both appear in the OWASP list, so the provider's habits matter as much as its features.

How are backups and restores handled?

Check that the provider backs up your site automatically, how long backups are kept and how you restore one. Then keep your own copy of anything you cannot replace.

The NCSC advises businesses to back up all the data they need to operate, and it names the website as one example. It suggests keeping two backups, one online and one on a separate device, and stresses knowing how to restore and checking that the backup is complete. A backup you have never restored is only an assumption. Ask the provider whether you can restore a single page or the whole site, and whether you can do it yourself or must wait for support.

Version history is the everyday form of backup. If you change a page and break the layout, you should be able to step back to the previous version in a few clicks. Ask how many versions are kept and for how long. Keep your own copies of the things only you have, such as original photos, logos, price lists and the text of your key pages.

What support should I expect when something breaks?

Expect a named way to reach a person, a stated response time and help pages that cover outages, domains and restores. Test it during your trial.

Support quality is part of infrastructure, because it decides how long a problem lasts. A builder that answers in minutes during an outage is worth more than one with better features and a week long queue. Ask which channels are available on your plan, such as chat, email or phone, and what hours they cover in your time zone. Find out whether urgent problems, such as a site that is down, are handled ahead of general questions.

Then test it. Send a real technical question during your trial, such as how to point your domain or how to restore a page, and note how long a useful answer takes. Read the help pages for the same task. If neither helps, that is a reliable preview of the year ahead.

Can the platform grow with my business?

Check that the plan handles more pages, more visitors and more tools without a forced move or a large jump in cost. Growth should be a setting, not a migration.

Traffic spikes are a good problem until the site slows or fails under them. Ask whether pages are served through a content delivery network, which spreads load across many locations and keeps pages fast for distant visitors. Ask whether there are limits on pages, storage, form submissions or monthly visitors, and what happens when you reach them. Limits that seem generous today can bite after a successful campaign.

Portability completes the picture. Make sure your domain is registered in your name and can be pointed elsewhere without the provider's permission. Ask what you can export if you leave, such as page text, images, blog posts and form data. A platform that is easy to leave usually has less reason to give you cause.

Questions owners ask before paying for a year

Is 99.9% uptime good enough for a business website?

For most businesses it is a reasonable target, allowing about 8.8 hours of downtime a year. What matters more is when the downtime happens and how quickly the provider reports and fixes it. A status page with a short, well explained incident history is a good sign.

Do I need to buy an SSL certificate separately?

On most modern builders you do not, because a certificate is included and renewed automatically. Check that it covers your own domain, not only the builder's address. If a plan charges extra for HTTPS, count that in the yearly cost.

Who is responsible for security on a hosted website builder?

The provider looks after servers, software updates and the platform itself. You are responsible for your login, the people you give access to and what you publish. Use two step verification and give staff only the access they need.

What should I ask AI Web Maker or any other provider before paying?

Ask for the uptime target and status page, how backups and restores work, which login protections are available and how to reach support during an outage. Ask what you can export and how to move your domain. AI Web Maker lets you build and preview a site at no cost, with $119 a year of hosting to go live and the domain paid separately, so you can test these answers before paying.

A short pre purchase checklist

Run through these questions with every provider on your short list before you pay for a year:

• Uptime target, how it is measured and the remedy if it is missed.
• Public status page with a recent incident history.
• HTTPS on your own domain, issued and renewed automatically.
• Two step verification, staff roles and an edit log.
• Automatic backups, version history and a restore you have tested.
• Support channels, hours and a response you have timed.
• Limits on pages, storage and traffic, and the cost of growing past them.
• Export options and full control of your domain.

Write the answers into one table and compare providers line by line. A provider that answers clearly and quickly is usually the one that runs its platform carefully. If you want to see how a live site performs once published, an AI website SEO checker will flag slow pages, missing HTTPS and other technical issues.