Start · Simple

What website maintenance really costs per month, and what it must include

A website is finished on launch day and starts ageing the day after. This guide explains what a monthly maintenance fee should actually buy, what quietly goes wrong without it, and how to compare two offers that look nothing alike.

7 min read

Wrenches and tools of a train mechanic laid out in a workshop.

Photo: Jennifer Bourn, public domain (CC0)

In this guide

Why a finished website still needs monthly work

A company website runs on software that other people keep changing: the content management system, its plugins and themes, the programming language on the server, the server’s operating system, and the browsers of your visitors. Each of these receives updates, and some of those updates close security holes that are being exploited the same week.

At the same time the business around the site changes. Prices move, people join and leave, a product is discontinued, a new law asks for a line on the imprint. A site nobody touches drifts away from reality and from the search results it used to appear in.

Maintenance is the work that keeps both in step: the technical base current and safe, and the content true. The monthly fee is the price of someone being responsible for that, every month, whether or not anything visible happens.

What website maintenance must include

Offers use the same word for very different things. One supplier means “we host it”, another means “we answer the phone”, a third means a full care contract. Before comparing prices, compare what is covered. A complete package has eight parts.

The parts of website maintenance and what each one covers
Part What it covers Typical rhythm
Hosting The server, its operating system, SSL certificate, domain renewal reminders Continuous
Updates Core system, plugins, themes, server software, tested before and after Weekly to monthly
Backups Copies of files and database, kept off the server, restore tested Daily copies, regular restore test
Security Firewall, login protection, malware scans, removal of unused extensions Continuous, reviewed monthly
Monitoring Uptime checks, error logs, expiring certificates and domains, broken forms Continuous
Performance Page speed, caching, image sizes, database clean-up Monthly check
Content changes Small edits, new pages, images, texts you send in A fixed number of hours
Support and reporting A named contact, a response time, a short monthly summary Per request, monthly report

Two of these deserve a closer look because they are the ones most often missing in cheap offers.

Testing of updates. Clicking “update all” takes a minute. Checking afterwards that the contact form still sends, the shop still takes orders and the pages still look right takes longer, and that is the part you are paying for. Ask whether updates are tested, and where: on a copy of the site or on the live site.

Restore tests. A backup that has never been restored is a hope, not a backup. A good contract names how often a restore is tried and how long a full restore takes. The details of what to look for are in our page on security and backups.

What goes wrong when maintenance is skipped

Nothing happens for a while, which is exactly why maintenance is the first thing cut. The costs arrive later and all at once.

Skipped part and the usual consequence
Skipped What usually happens When you notice
Updates A known vulnerability stays open; the site is taken over and used to send spam or host other people’s files When the hosting company suspends the site or customers report strange emails
Backups A failed update or a hacked site cannot be rolled back; the site is rebuilt from scratch On the day of the failure
Monitoring The contact form stops sending after an update and nobody knows for weeks When a customer phones to ask why nobody answered
Security Weak logins are guessed; hidden pages advertise other products in your search results When a customer or Google reports it
Performance Pages get slower with every plugin and image added; rankings and enquiries drop Gradually, so often never attributed
Content Old prices, former staff, discontinued products stay online When a customer relies on them

The pattern is the same in every row: the saving is small and steady, the cost is large and sudden. Rebuilding a compromised site, cleaning it from blocklists and explaining to customers why your domain sent them spam costs more than several years of care, and that is before lost enquiries are counted.

An illustrative monthly breakdown

The figures below are an example, not a price list. They describe a company website of about thirty pages with a contact form, no shop, in a care package with two hours of content changes a month. The total of 300 is a round number chosen to make the shares easy to read; your own figure depends on the size of the site, the number of integrations and the response time you need. The point of the example is the proportions.

Illustrative monthly breakdown for a thirty-page company website (example figures)
Part Example amount per month Share
Hosting and backups 75 25%
Updates and testing 75 25%
Security and monitoring 45 15%
Content changes (two hours) 45 15%
Performance check 30 10%
Support and reporting 30 10%
Total 300 100%

Illustrative shares of a monthly maintenance fee

Three observations from the example. Hosting is a quarter of the fee at most; a package that is almost all hosting is a hosting plan with a different name. Updates with testing cost as much as hosting, because they are human time, not server time. And content changes are the one part that scales with how much you send in: if you never send anything, ask for a package without hours rather than paying for them. Our own plans are built on these parts, so the comparison works there too.

A shop or a site with several languages moves the proportions: payment and shipping integrations need their own tests after every update, and a multilingual site has more pages to check. The parts stay the same.

How to read a maintenance offer

Put the two offers side by side and answer the same questions for each. An offer that cannot answer a question is cheaper for a reason.

  • Which software is updated, how often, and is it tested before the live site is touched
  • Where backups are stored (not on the same server), how long they are kept, and when a restore was last tested
  • What is monitored, who is alerted, and within what time someone reacts outside office hours
  • How many hours of content changes are included, what an extra hour costs, and whether unused hours carry over
  • What the response time is for a normal request and for an outage, in hours, in writing
  • Whether the site, domain, hosting and all accounts stay in your company’s name
  • What is excluded: new functions, design changes, redesigns, third-party licence fees
  • What you receive each month as proof that the work happened
  • How the contract ends and what you get handed over when it does

The last two points are easy to skip and matter most. A monthly summary (updates applied, backups taken, uptime, hours used) is the only way to know you are paying for work rather than a promise. And the exit terms decide whether you can leave: with your domain, your files, your database and your logins, as described in our overview of website care.

Fixed fee, hourly or a mix

There are three common ways to pay, and each suits a different kind of site.

  1. Fixed monthly fee. A defined package of hosting, updates, backups, monitoring and a block of hours. Predictable, and the supplier has an interest in preventing problems rather than billing for them. Best for most company sites.
  2. Hourly, on call. No fixed fee; you pay when you ask. Cheap in a quiet year, expensive in a bad one, and nobody is watching between calls. Only sensible for a site that can be offline for days without harm.
  3. Fixed base plus hourly extras. The technical base is covered by a fee, larger content or development work is quoted separately. The usual choice for shops and sites that change often.

Whichever model you choose, keep one rule: the technical base (updates, backups, security, monitoring) is never “on request”. Those are the parts that protect you precisely when nobody is thinking about the website.

Questions we hear often

Yes, because the risks come from the software, not from the size. A five-page site on an unpatched system is taken over as easily as a large one, and the clean-up costs the same.

You can, if someone in the company has the time every month, knows how to test after an update and can restore a backup under pressure. Most companies find that the person exists on paper and not in the diary.

Hosting keeps the server running. Maintenance keeps the website on that server updated, backed up, monitored and correct. You need both, and they are often sold by different suppliers.

The updates applied and their dates, confirmation of backups and the last restore test, uptime and any incidents, the hours used for content, and anything the supplier recommends for next month.

Want this sorted without doing it yourself?

Tell us what you are working on. A person replies within one working day.