How to maintain a website after launch?

There are four recurring jobs: keeping dependencies patched, verifying backups by actually restoring one somewhere else, watching uptime and error rates so you hear about a problem before a customer reports it, and renewing certificates and domains before they lapse. None is difficult. All of them are only useful if someone owns them on a schedule rather than when there is spare time.

The two things that turn maintenance into an emergency are both about deferral. A backup nobody has restored from is a hope, not a backup — the failure is usually discovered on the day it is needed. And skipping major version upgrades for a couple of years turns a routine afternoon into a project, because each one now has to be crossed at once with breaking changes stacked on top of each other.