Published 5 September 2026 · Updated 5 September 2026
How much should website maintenance cost?
For a typical small business website, expect to pay somewhere between a modest monthly fee and a few hundred dollars a month, depending on how much is actually included and whether content changes are part of the deal. The wide range is not a dodge: ‘maintenance’ is used to describe everything from automated plugin updates on shared hosting through to a managed service that handles security, backups, performance, monitoring and a monthly allowance of content changes. Before comparing prices, get every provider to answer the same five questions about what is included, because most quotes are not describing the same service.
Key takeaways
- ‘Maintenance’ has no standard definition. Two quotes that differ by five times are usually describing two different services, not the same service at different margins.
- Hosting is not maintenance. Hosting is where the site lives. Maintenance is somebody looking after it. Many businesses pay for the first and believe they are covered for the second.
- Content changes are the real cost driver. A plan with a monthly allowance of edits costs more than one without, and is usually the better value if you change anything at all.
- Unmaintained sites do not stay still. They break, slow down, or get compromised, and recovery costs far more than the maintenance would have.
- Ask what happens when something breaks at 2am, and get the answer in writing. Response time is the part of the service you only ever notice when you need it.
- Owning your domain, hosting and site accounts is non-negotiable. Check this before you sign anything.
What this guide covers
- What website maintenance actually includes
- The four tiers, and what each costs
- Hosting is not maintenance
- What happens if you do not maintain a site
- Doing it yourself
- What should be included and what is fair to charge extra for
- Red flags in maintenance agreements
- How to audit what you are paying for now
- Five questions to ask every provider
- Squarespace, Wix and Shopify: a different model
- Mistakes that cost money
- Frequently asked questions
What website maintenance actually includes
The first problem with pricing this is that the word covers at least four distinct kinds of work, and providers rarely specify which ones they are doing. Here is what can sit under the heading.
Keeping the software current
Updating the platform, themes and plugins, and checking afterwards that nothing broke. On WordPress this is the bulk of routine maintenance. Automated updating without checking is cheaper and occasionally catastrophic, because an update that conflicts with something can take a site down and nobody notices for days.
Security
A firewall, malware scanning, login protection, file integrity monitoring, and a documented response if something gets in. Also the unglamorous parts: removing abandoned plugins, enforcing decent passwords, and removing old user accounts.
Backups
Automatic, off-site, tested. The last word matters most. Backups that have never been restored are a hypothesis, not a safety net, and the moment you discover a backup is corrupt is always the moment you need it.
Uptime and performance monitoring
Something checking whether the site is up, and someone being told when it is not. Plus periodic attention to speed, image sizes and anything slowing pages down.
Content changes
Updating prices, adding a service, swapping photos, publishing a post, changing hours. This is the item most likely to be excluded and most likely to be what you actually want.
Reporting and review
A short monthly summary of what was done, what was updated, and anything that needs a decision. Cheap to provide and it is what separates a service from a subscription.
The question that clarifies every quote Ask: if I email you asking to change the prices on my services page, is that included, and how quickly will it happen? The answer sorts providers immediately. Plans that exclude content changes are often perfectly reasonable and cheaper, but you need to know that before you sign, not the first time you need a price updated.
“Hosting is where your site lives. Maintenance is somebody looking after it. Paying for the first is not paying for the second.”
The four tiers, and what each costs
Prices vary by country, by provider and by how complex your site is, so treat what follows as a rough guide to the shape of the market rather than a quote. The useful part is not the numbers but understanding which tier a given price implies, because a quote that looks cheap usually is cheap for a reason that is fine or a reason that is not.
- (‘Tier one: nothing, or automated updates only’, ‘Free to very low cost. Your host applies core updates automatically and nobody looks at anything. Appropriate for a simple static site with no forms, no store and no plugins. Genuinely risky for anything running WordPress with a dozen plugins, because updates conflict and nobody is watching.’)
- (‘Tier two: basic care’, ‘A low monthly fee. Updates applied and checked, backups running, a security plugin configured, uptime monitoring. No content changes, or changes billed hourly. This is the right tier for a small brochure site that rarely changes and where a few hours of downtime would not be a disaster.’)
- (‘Tier three: managed care with content changes’, ‘A moderate monthly fee, and where most small businesses should be. Everything in tier two plus a monthly allowance of content edits, faster response times, performance attention, and a person who knows your site. The allowance is what makes it worth it, because most businesses do want small changes and hate being billed for fifteen minutes of work.’)
- (‘Tier four: business critical’, ‘Several hundred a month and up. Staging environments so updates are tested before going live, faster guaranteed response, security hardening, regular performance work, larger content allowances, and often ecommerce or booking-system support. Appropriate when the site takes orders, takes bookings, or losing it for a day would cost real revenue.’)
Why the cheapest tier is expensive The most common way a small business site fails is not a dramatic hack. It is a plugin update that conflicts with the theme, breaks the contact form, and nobody notices for six weeks because enquiries simply stop arriving. Nobody gets an alert, because nobody is monitoring. The cost of that is every enquiry you did not receive, which is invisible and much larger than the maintenance fee.
Hosting is not maintenance
This confusion costs small businesses real money, because a lot of people believe they are covered when they are not.
Hosting
The server your website files sit on and the connection that serves them to visitors. Your host is responsible for the server being up, for server-level security, and usually for server backups. They are not responsible for your website’s software, your plugins, your content or whether your contact form works.
Managed hosting
A middle ground. The host handles server updates, often platform core updates, daily backups and a security layer. Better than basic hosting and still not maintenance, because nobody is checking whether your specific site works after an update, and nobody will make a change for you.
Maintenance
Somebody responsible for your website itself. Updating and testing, watching for problems, fixing them, and usually making changes you ask for.
The practical consequence: if your host tells you they take daily backups, that is useful and it is not the same as somebody restoring your site when it breaks, or noticing that it broke. Ask your host directly what they will and will not do if your site goes down because of a plugin conflict. The answer is almost always that this is not their responsibility, and that is entirely reasonable, but you should know it before it happens rather than during.
Find out what you are actually paying for Look at what leaves your bank account for your website each month or year. There are usually three separate things: the domain registration, the hosting, and any maintenance or plugin subscriptions. A surprising number of businesses discover they are paying two providers for overlapping services, or paying for a maintenance plan on a site that was replaced two years ago.
What happens if you do not maintain a site
Websites are not appliances. They sit in an environment that keeps changing around them: browsers update, the platform updates, plugins update or get abandoned, security vulnerabilities are discovered and published, and search engines change what they expect. A site left alone does not stay as it was. It degrades.
The realistic failure modes, roughly in order of likelihood
- Something breaks quietly. A form stops sending, a booking widget stops loading, a payment step fails on mobile only. Enquiries drop and there is no error message, because the only signal is an absence.
- The site gets compromised through a known vulnerability. The overwhelming majority of small site hacks exploit an old version of something with a publicly documented flaw. Attacks are automated and indiscriminate; nobody targeted you specifically.
- It gets slower. Uncompressed images, accumulated plugins, an aging platform. Slow sites lose visitors before the page finishes loading, and speed is a factor in search rankings.
- An update conflict takes it down entirely. Usually recoverable in an hour if there is a tested backup, and a genuine crisis if there is not.
- Content goes stale. Old prices, a former staff member, last year’s hours, a service you stopped offering. Customers reasonably conclude the business is not paying attention.
- Recovery costs more than prevention. Cleaning a compromised site, getting it delisted from browser warnings, and rebuilding from an outdated backup is a considerably larger bill than the maintenance would have been, and it arrives at the worst possible time.
The single highest-value item If you can only afford one thing, buy tested off-site backups. Not the ones your host says they take, but backups stored somewhere other than the server, with a restore tested at least once so you know they work. Everything else in maintenance reduces the chance of a disaster. Backups determine whether a disaster is an afternoon or a rebuild.
Doing it yourself
Maintaining a small WordPress site yourself is entirely feasible if you are comfortable with the admin area and willing to be consistent. It is not free, because it costs your time and attention, and the risk is not the difficulty but the consistency: maintenance skipped for four months is much worse than maintenance never started, because everything updates at once.
- (‘Monthly: apply updates deliberately’, ‘Take a backup first, update the platform, then themes, then plugins, then open the site and check the homepage, a service page, the contact form and anything with a booking or payment step. On a phone as well as a desktop.’)
- (‘Monthly: check the backup exists off-site’, ‘And once or twice a year, actually restore it somewhere to confirm it works.’)
- (‘Monthly: submit or check Search Console’, ‘Look for crawl errors, security issues and manual actions. It takes two minutes and it is the earliest warning you will get of several serious problems.’)
- (‘Quarterly: remove what you are not using’, ‘Deactivated plugins, unused themes, old user accounts, and any plugin whose developer has stopped updating it. Abandoned plugins are one of the most common entry points.’)
- (‘Quarterly: check the content is still true’, ‘Prices, hours, staff, services, phone number. This is the maintenance task with the most direct effect on enquiries and the one most often skipped.’)
- (‘Annually: check speed and mobile’, ‘Run your homepage and one service page through a speed test, and use the site on a phone as a customer would. Compress any large images you find.’)
- (‘Always: know where your logins are’, “Domain registrar, host, website admin. Written down somewhere secure that is not only in one person’s head.”)
A reasonable middle path for cost-conscious businesses is to buy tier-two maintenance for the technical side, which is where the risk sits, and do your own content updates. That is often the cheapest sensible configuration, and it works as long as you are genuinely comfortable in the admin area.
What should be included and what is fair to charge extra for
Some friction between clients and providers comes from unclear expectations rather than bad faith. Broadly, this is where the line usually sits.
Should be included
Platform, theme and plugin updates with a post-update check. Backups, stored off-site. Security monitoring. Uptime monitoring. Fixing anything that breaks as a result of an update they applied. A basic monthly report.
Reasonably included in a mid-tier plan
A defined allowance of small content changes, usually expressed in requests or in time. Swapping images, editing text, updating prices, publishing a post you wrote, adding a team member.
Fairly charged extra
New pages, design changes, new functionality, a new plugin or integration, migrating hosts, ecommerce configuration, anything requiring design work, and content you want written rather than published.
Should never be extra
Access to your own site, your own domain, your own hosting account, or a copy of your own website. If any of these are gated behind a fee or a notice period, that is not a maintenance term, it is a hostage arrangement.
On overage If a plan includes an allowance of changes, ask what happens when you exceed it: is it billed hourly, does it roll over, or does it simply stop. And ask what counts as one request. ‘Change three prices and swap a photo’ being counted as four requests rather than one is a legitimate policy, but it should be one you knew about.
Red flags in maintenance agreements
Most providers are straightforward. A few arrangements are structured so that leaving is difficult, and the terms that do this are easy to spot once you know to look.
Worth questioning before you sign
- The provider owns your domain. Your domain should be registered in your name or your business’s name, with you having access to the registrar account. If someone else holds it, they hold your address and your email.
- You cannot get an administrator login to your own website. There is no good reason for this. Providers can reasonably ask you not to install plugins yourself, and that is a policy, not a reason to withhold access.
- The site is built on a proprietary platform you cannot export. Perfectly legitimate as a product, and you should know before you commit that leaving means rebuilding rather than moving.
- No specifics on backup frequency, location or retention. ‘We take backups’ is not an answer. Where, how often, how far back, and have they been tested.
- No response time commitment. Ask what happens if the site goes down on a Saturday. If the answer is vague, assume Monday.
- Long lock-in with automatic renewal. Monthly or annual with reasonable notice is normal. Multi-year terms with automatic renewal and a short cancellation window are worth pushing back on.
- Maintenance bundled into an unbreakable package with the build. Sometimes a genuinely good deal. Just check whether you can keep the site and change providers later.
- No monthly report. If you never hear what was done, you have no way of knowing whether anything was.
The two questions that reveal everything ‘If I wanted to move to another provider next month, what would that involve?’ and ‘Who is the registrant on my domain?’ Both are entirely reasonable to ask, neither should cause any difficulty, and the manner of the answer tells you as much as the content.
How to audit what you are paying for now
Before shopping around, work out your current position. Most businesses discover at least one surprise, and often the fix is cheaper than switching providers.
- (‘List every website-related payment’, ‘Go through twelve months of statements. Domain registration, hosting, maintenance, plugin and theme subscriptions, email hosting, security services, form or booking tools, stock photo subscriptions. Note the amount and the renewal date.’)
- (‘Identify who holds your domain’, ‘Search a public WHOIS lookup for your domain and see who the registrant is. If it is not you or your business, that is the first thing to fix.’)
- (‘Confirm you have admin access’, ‘Log in to your website, your hosting account and your domain registrar. If you cannot, request access now rather than during a crisis.’)
- (‘Find out when the site was last updated’, ‘In WordPress, the updates screen shows what is pending. A long list of available updates tells you what your current maintenance is actually doing.’)
- (‘Check whether a backup exists and where’, ‘Not whether one is scheduled. Whether a recent file exists somewhere that is not the same server as the site.’)
- (‘Ask your current provider for a summary of the last six months’, ‘What was updated, what was fixed, what was monitored. A good provider will send this readily. A long silence is itself informative.’)
- (‘Then compare like for like’, ‘With the tier framework above, work out which tier you are actually buying and which one you need. Sometimes the answer is that you are underpaying for the risk you carry; sometimes you are paying tier-four prices for tier-two service.’)
Five questions to ask every provider
Ask these five questions, identically, to everyone you are comparing. The answers make quotes comparable in a way the quotes themselves will not.
The five
- What exactly is included each month, itemised, and what is explicitly excluded?
- Are content changes included? If so, how many, what counts as one, and what is the turnaround?
- How are backups handled? Frequency, where they are stored, how long they are kept, and when a restore was last tested.
- What is your response time if the site goes down, including evenings and weekends, and what does ‘response’ mean in practice?
- Do I own the domain, the hosting account and the site, and what happens if I leave?
A provider who answers all five clearly and in writing is worth paying slightly more for than one who is cheaper and vague. The whole value of a maintenance arrangement is that somebody competent is paying attention on your behalf, and vagueness at the quoting stage is a reasonable predictor of vagueness later.
Squarespace, Wix and Shopify: a different model
Everything above assumes a self-hosted site, usually WordPress, where updates are your responsibility. Fully hosted platforms work differently, and the maintenance conversation changes shape rather than disappearing.
On a hosted platform the provider handles the software entirely. There are no plugin updates to apply, no core version to keep current, no server to secure, and the platform will not break because two components disagreed overnight. That removes the largest category of technical maintenance, and it is a real advantage for a business that does not want to think about any of it. The monthly platform fee is, in effect, the technical maintenance.
What does not go away is the rest.
Still your responsibility on a hosted platform
- Content accuracy. Prices, hours, staff, services and photos still go stale at exactly the same rate, and this is the maintenance item with the most direct effect on enquiries.
- Third-party apps and integrations. Booking tools, review widgets, email capture and payment apps are add-ons with their own subscriptions, and they can and do break independently of the platform.
- Your own export. Platform backups protect the platform. If you delete something or an app corrupts a page, having your own copy of your content and product data is still worth arranging.
- Someone to make changes. Hosted platforms are easier to edit, which is precisely why businesses assume they will do it themselves and then do not. The change still needs to happen.
- Search and performance work. The platform gives you the settings; nobody fills them in for you.
How to budget on a hosted platform Expect the platform subscription, plus any app subscriptions, plus either your own time or a smaller support arrangement covering content changes and the occasional problem. The total is often similar to a mid-tier WordPress maintenance plan once apps are counted, so compare the whole figure rather than the platform fee alone.
The trade-off worth understanding before choosing either route is portability. A self-hosted site can be moved between hosts and providers, which is what makes ownership meaningful. A hosted platform is convenient precisely because it is closed, and leaving generally means rebuilding rather than migrating. Neither is wrong; they are different bargains, and it is better to make that choice deliberately than to discover it three years in.
Mistakes that cost money
The expensive ones
- Assuming hosting covers maintenance. It does not, and the gap is only discovered when something breaks.
- Comparing quotes without comparing scope. The cheaper quote is frequently cheaper because it excludes the thing you most need.
- Buying maintenance with no content changes when you update prices, staff or services regularly. You will end up paying hourly for small edits and resenting it.
- Trusting untested backups. A backup that has never been restored is an assumption.
- Letting a provider register your domain in their own name. The single most common way businesses lose control of their own web address.
- Cancelling maintenance to save money on a site that generates enquiries. The saving is visible and the cost is invisible, which is exactly why this decision keeps getting made.
- Paying for maintenance on a site nobody looks after. Ask for a report. If none exists, you are buying a subscription rather than a service.
- Doing it yourself and then stopping. Six months of skipped updates is worse than a plan you never started, because the backlog is what causes conflicts.
The reasonable way to think about the number is in proportion to what the site does for you. If your website generates enquiries that turn into real revenue, maintenance is a small percentage of that and the question is which tier, not whether. If your website is a brochure that nobody visits and nothing depends on, tier two is sufficient and there is no reason to buy more. What is rarely defensible is paying nothing at all while quietly relying on the site to work, because that is not a saving, it is an unpriced risk sitting on the one asset online that you actually own.
Want to know what you should be paying?
We build and manage websites for small businesses on straightforward monthly plans, with content changes included and no lock-in. Have a look at what is included, or send us your current setup and we will tell you honestly whether it needs changing.
Frequently asked questions
How much does website maintenance cost per month?
It ranges from very little for automated updates on a simple site, through a modest monthly fee for basic care with updates, backups and monitoring, to a few hundred a month for a managed service including content changes and faster response. The variation is about scope, not margin. Get every provider to itemise what is included before comparing numbers.
Is website maintenance really necessary?
Yes for anything running WordPress or a similar platform with plugins, because those need regular updating and the majority of small site compromises exploit known vulnerabilities in outdated software. A genuinely static site with no forms, no store and no plugins needs very little. The most common real-world failure is not a hack but a form that silently stops working.
What is the difference between hosting and maintenance?
Hosting is the server your site lives on; the host is responsible for the server being up. Maintenance is somebody looking after your actual website: updating it, checking it still works, fixing it when it does not, and often making changes for you. Many businesses pay for hosting and believe they are covered for maintenance.
Can I maintain my own website?
Yes, if you are comfortable in the admin area and consistent about it. Monthly: back up, update the platform and plugins, then check the homepage, a service page and the contact form on both desktop and mobile. Quarterly: remove unused plugins and old accounts, and check your content is still accurate. The risk is not difficulty, it is skipping it for months and then facing every update at once.
What should be included in a website maintenance plan?
At minimum: platform and plugin updates with a check afterwards, off-site backups, security and uptime monitoring, fixing anything broken by an update the provider applied, and a monthly report. Mid-tier plans should also include an allowance of small content changes. New pages, design work and new functionality are fairly charged separately.
How often should a website be updated?
Software updates should be applied at least monthly, and security releases as soon as they appear. Content should be reviewed quarterly for accuracy, particularly prices, hours, staff and services. A full design or structural review every few years is usually enough unless your business changes significantly.
What happens if I stop paying for maintenance?
Nothing immediately, which is what makes the decision tempting. Over months, plugins fall behind, vulnerabilities accumulate, and something breaks without anyone noticing. The typical outcome is not a dramatic incident but a form that stops sending enquiries, or a compromise months later that costs considerably more to clean up than the maintenance would have.
How do I know if I am overpaying?
Ask your provider for a summary of the last six months: what was updated, fixed and monitored. Then check whether updates are actually pending on your site, whether a recent off-site backup exists, and whether you have admin access to everything. If the report is thin and the updates are outstanding, you are paying for a subscription rather than a service, whatever the price.