Website Maintenance Cost: What You Should Actually Be Paying For

What maintenance actually covers

The word covers everything from an occasional plugin update to a managed service with guaranteed response times, which is why quotes are so hard to compare. A complete plan has five parts:

• Updates — core platform, plugins, libraries and dependencies, applied and then verified on the live site.
• Security — monitoring, patching, hardening, access control, and a tested route back if something gets through.
• Backups and recovery — offsite copies on a defined schedule, with periodic restore tests to prove they work.
• Availability and performance — uptime monitoring with alerting, plus checks that key pages still load quickly.
• Support and small changes — a defined route to get content edited, forms fixed and problems resolved.

If a quote does not name all five, you are buying a subset. That may be the right decision, but it should be a decision rather than a discovery.

Indicative monthly ranges

For a custom web application rather than a CMS site, expect the Growth tier as a floor — the work needs developer attention and a staging environment, not a plugin updater.

What changes the price

• Business criticality — a site that takes orders needs a faster guaranteed response than a brochure site, and that guarantee is what you are really paying for.
• Technology — a custom application needs developer time; a standard CMS site often needs process and vigilance more than engineering.
• Integrations — payments, ERP or CRM connections each add monitoring surface and each can break independently of the site.
• Change volume — content updates and small features are the largest variable in most plans.
• Traffic and infrastructure — scaling, CDN and database management add work at higher volumes.
• Compliance — regulated sectors add audit trails, access reviews and documentation.

The cost of skipping it

Deferred maintenance does not remove the cost. It converts it into an emergency, at a worse price, on a day you did not choose.

The pattern is consistent. Unpatched components get found by automated scanners and exploited. An outdated stack eventually blocks a routine upgrade, so a small change becomes a migration. Backups nobody tested turn out to be incomplete on the one day they matter. And a rebuild that could have been avoided entirely becomes the only remaining option.

• A compromise recovery — clean-up, restore, re-secure, plus lost business and reputation damage — routinely costs more than several years of a maintenance plan.
• An unmaintained site slowly loses search visibility as performance degrades and errors accumulate.
• Staff lose trust in the site and start working around it, which is a cost nobody invoices for.

Questions to ask before signing

• How often are backups taken, where are they stored, and when did you last test a restore?
• What is the guaranteed response time for a site that is down, and does it apply outside office hours?
• Are updates tested on staging before they reach production?
• How many change hours are included, and do unused hours carry over?
• What is explicitly excluded — and what does out-of-scope work cost per hour?
• Will I get a monthly report showing what was actually done?
• If we leave, what do we take with us, and how quickly?

A provider who answers all seven precisely is usually worth a little more than one who cannot. The answers also tell you whether maintenance is a real service in their business or a retainer attached to a build.