Skip to main content
Guide for website owners

Website Maintenance Cost: What You Pay For and What a Care Plan Should Include

By Obaid Tariq, Founder & Lead Engineer · Published · Updated

Disclosure: AI Dev Planner is a software development agency that builds and supports web applications, so we have an interest in this question. We say below when we are not the right choice. See our disclosure policy.

The short answer

There is no single fair price. Monthly website maintenance cost depends on five things: whether the site runs on a CMS or is a custom application, how often it needs updates, how quickly you need problems fixed, whether hosting is included, and how much content work you expect. Compare packages by what they include and exclude, not by the headline monthly fee.

How much should website maintenance cost per month?

We do not publish an average monthly figure, because we have not found a reliable, independent source for one and the range between a five-page brochure site and a customer portal is too wide to be useful. What we can do is show what drives the price and which parts of it you can check against published figures.

What pushes the monthly cost of website maintenance down or up
Cost driverPushes the cost downPushes the cost up
PlatformA site on a managed website builder or a simple CMS with few pluginsA custom web application with its own code, database, user accounts and integrations
Update frequencyFew dependencies, and updates that can wait for a monthly windowMany plugins or packages, and security fixes that need applying within days
Response time (SLA)Next business day, during business hoursOut-of-hours cover or a guaranteed response within an hour or two
HostingYou pay the host directly; the package covers labour onlyHosting, CDN, email and licences bundled into one fee
Content changesYour team edits content itself; the agency handles technical workA monthly allowance of agency hours for page edits, new sections or forms
Risk and complianceA brochure site with no logins or paymentsOnline payments, personal data or regulated sectors that need logging, reviews and evidence

Why update frequency matters

Security fixes do not arrive on a predictable timetable. WordPress.org’s security archive lists six core security releases between 17 July and 6 October 2026, from version 7.0.2 to 7.1.3, and describes 7.0.2 and 7.1.2 as fixing critical-severity issues (WordPress.org, accessed 18 October 2026). WordPress applies minor and security core updates in the background on most sites (Updating WordPress), but plugins, themes and custom code still need someone to update and test them. Custom applications have the same problem with their package dependencies. The more moving parts, the more hours a month this takes.

Hosting: the part you can price yourself

Hosting is often bundled into a care plan, so it helps to know what it costs on its own. Two published examples, both in US dollars and excluding taxes (accessed 18 October 2026):

  • WordPress.com: the Personal, Premium, Business and Commerce plans cost US$4, US$8, US$25 and US$45 a month billed yearly, or US$9, US$18, US$40 and US$70 billed monthly (WordPress.com pricing).
  • Vercel (common for Next.js applications): the Pro plan is $20 a month per developer seat, including a $20 monthly usage credit, with pay-as-you-go usage beyond that; Enterprise is quoted (Vercel pricing).

Neither figure includes anyone’s time. The bigger part of a maintenance fee is usually labour: updates, testing, monitoring, fixes and changes. Ask any agency to split its quote into hosting and infrastructure, third-party licences, and labour, so you can see what you are paying for and compare like with like.

If the website is really a web application, with logins, payments or a database behind it, budget for it as software rather than as a website. Our guide to custom web application development cost in the UK covers what the build costs; the MVP cost calculator gives an indicative range for a first version.

What should a website maintenance package include?

A useful care plan names each service, says how often it happens and says how you will know it happened. Use this checklist to compare packages, and ask the question in the last column of every supplier.

Website maintenance package checklist: what good looks like and the question to ask
ServiceWhat good looks likeQuestion to ask
Updates and patchingCore, plugins, themes, packages and server software updated on a stated schedule, tested on staging first; security fixes applied fasterHow quickly do you apply a critical security fix?
Backups and restore testsAutomatic backups of files and database, stored away from the live server, with a restore tested on a scheduleWhen did you last restore one of these backups, and how long did it take?
Uptime monitoringExternal checks every few minutes, with alerts to the agency and to youWho gets the alert, and what happens next out of hours?
Security scanningDependency and vulnerability checks, malware scanning where relevant, review of admin accountsWhich tools do you use, and what do you do with the findings?
SSL and domain renewalsCertificates renewed automatically and monitored; domain renewal dates tracked, with the domain registered in your nameWhose account is the domain in?
Performance checksCore Web Vitals reviewed from field data, with fixes proposed when a page drops below the thresholdsWhat were our LCP, INP and CLS figures last month?
Small content changesA stated number of hours or changes each month, with a clear line between a change and new workWhat happens to unused hours, and how is extra work priced?
ReportingA short monthly report: updates applied, backups checked, incidents, uptime, performance and recommendationsCan I see an example report?
Response timesWritten response targets by severity, the hours they apply and how to raise an urgent issueIs that a response time or a fix time?

Also check what is excluded: new features, redesigns, third-party outages and fixing problems caused by someone else’s changes are commonly priced separately.

What security, backup and monitoring should an agency provide after launch?

These are the services that matter most when something goes wrong, and the hardest to judge from a sales page. Here is what the published guidance says, and what it means for a website.

Patching, quickly and checked

The UK’s National Cyber Security Centre advises enabling automatic updates where possible, installing updates promptly, ideally within a few days, checking occasionally that automatic updates are actually working, and replacing unsupported software as soon as you are able (NCSC device security guidance, accessed 18 October 2026). For a website that means a stated timescale for security fixes, a staging copy to test them on, and a plan for any plugin, framework or server version that has reached end of support.

Backups you have restored, not just taken

US-CERT’s backup guidance, published through CISA, sets out the 3-2-1 rule: keep three copies of important data (one primary and two backups), on two different media types, with one copy offsite (Data Backup Options). WordPress’s own guidance says a site backup has two parts, the database and the files, and recommends keeping at least 3–5 recent backups stored in different places and on different media (WordPress Backups). The NCSC’s small business guide adds that you should know how to restore a backup and check that it contains all your important data, and protect online backups with two-step verification (NCSC backing up your data). All accessed 18 October 2026.

In practice: backups held by your host alone are not enough, because one account problem can take out the site and the backups together. Ask for at least one copy in storage you own, and for a restore test on a schedule.

Security reviews against a recognised list

The OWASP Top 10:2025 is the current version of OWASP’s list of critical web application security risks (OWASP Top 10:2025, accessed 18 October 2026). Three entries map directly onto maintenance work: Security Misconfiguration (A02), Software Supply Chain Failures (A03), which covers the third-party packages and plugins a site depends on, and Security Logging and Alerting Failures (A09). An agency that maintains a custom application should be able to explain how it handles each one. Reviewing who has admin access, and removing accounts for people who have left, belongs here too.

Monitoring that tells someone

Uptime checks from outside your hosting, error tracking for applications, and alerts that reach a named person. Ask who receives an alert at 2am on a Sunday, and what they are expected to do.

SSL certificates and domains

Certificate renewal is becoming a job for automation, not a calendar reminder. Let’s Encrypt’s default certificates are valid for 90 days, and it recommends renewing them every 60 days (Let’s Encrypt FAQ). Across all public certificate authorities, the CA/Browser Forum’s Ballot SC-081v3 reduces the maximum validity of public TLS certificates from 398 days to 47 days in steps between March 2026 and March 2029 (CA/Browser Forum). Both accessed 18 October 2026. Your package should renew certificates automatically and monitor for failed renewals. Domain renewals should be tracked too, with the domain registered in your organisation’s name.

How can I improve a slow website without rebuilding it?

Measure first. Google’s web.dev sets “good” Core Web Vitals thresholds of 2.5 seconds or less for Largest Contentful Paint (LCP, loading), 200 milliseconds or less for Interaction to Next Paint (INP, responsiveness) and 0.1 or less for Cumulative Layout Shift (CLS, visual stability). It recommends judging them at the 75th percentile of page loads from real visitors, split by mobile and desktop (web.dev Web Vitals, accessed 18 October 2026). Find out which metric fails on which pages before changing anything. Most slow sites can be improved in place, in roughly this order:

  1. Server response, hosting and caching. web.dev’s LCP guide puts the initial HTML response first: cut redirects, use a CDN, cache aggressively with an efficient cache-control policy, and prefer prerendered pages where possible (Optimize LCP). Moving to better hosting or adding page caching is often the cheapest large gain.
  2. Images. Serve the right size, in a modern format such as AVIF or WebP, compressed. Never lazy-load the main image at the top of the page, and give it fetchpriority="high" (same guide).
  3. Third-party scripts. Chat widgets, tag managers, trackers and embeds add up. web.dev recommends regular audits, removing any script that does not add clear value, loading the rest with async or defer, and lazy-loading embeds (Loading third-party JavaScript).
  4. Fonts. Use a font-display value other than auto or block so text is not held back, preload critical fonts and use a fallback with similar metrics to reduce layout shift (Optimize LCP, Optimize CLS).
  5. Layout shift. Set width and height on images and video, and reserve space for ads, embeds and anything injected late (Optimize CLS).
  6. Responsiveness. If INP fails, the usual causes are long JavaScript tasks and large pages. web.dev recommends breaking up long tasks, yielding to the main thread, reducing JavaScript work and keeping the DOM small (Optimize INP).

All web.dev sources accessed 18 October 2026. If the speed problems come from the way the site was built, such as a heavy page builder or a theme that loads everything on every page, improvements in place have a ceiling. That is one of the signals in the next section.

When does maintenance stop being worth it?

Maintenance is the right answer while the site does its job and changes stay cheap. Signs that point the other way:

  • the platform, framework or a plugin you depend on is out of support, and the NCSC’s advice is to replace unsupported software;
  • small changes regularly break something else, or take days instead of hours;
  • speed fixes have reached their ceiling and the site still fails Core Web Vitals on mobile;
  • the business now needs features the current platform cannot support without workarounds;
  • over a year or two, the cost of fixes and workarounds is heading towards the cost of building it properly.

Our guide on when to redesign or rebuild your website works through that decision in detail. If the problem is the supplier rather than the site, read how to move your website maintenance to a new agency first: with the code, hosting and domain in your own accounts, changing who maintains the site is far simpler than changing the site. If your application was built with AI coding tools and is getting harder to maintain, the app readiness checker gives a quick view of where it stands.

Where AI Dev Planner fits, and when we are not the right choice

We build and support web applications and custom software, mostly in Next.js and React, from an engineering team in Islamabad, Pakistan, working remotely with clients worldwide. After launch, a 60–90 day warranty covers defects in what we delivered. Ongoing maintenance after that is scoped to the application, and we quote it after we have seen the code, the hosting and what you need; we do not publish a standard monthly retainer price. See our web development services, or, if an existing application needs stabilising first, our app rescue service.

We are not the right choice if:

  • you have a simple brochure site on WordPress or a website builder that needs occasional edits; a managed host or a WordPress specialist is usually better value;
  • you mainly need regular content updates and marketing pages rather than engineering work;
  • you need someone on site, or urgent support during hours that our time zone does not cover without a written arrangement agreed in advance;
  • your contracts require your systems to be accessed only from your own country.

Comparing several suppliers? Our guide on how to choose a software development company covers the questions to ask and the contract clauses to check.

FAQs about website maintenance costs and care plans

Is website maintenance a monthly or a yearly cost?

Usually both. Labour such as updates, monitoring and small changes is normally billed monthly, while domain renewals, some hosting plans and premium plugin or theme licences are often billed yearly. Ask for a list of every recurring charge, who pays it and when it renews, so a yearly bill does not arrive as a surprise.

Do I still need a maintenance plan if my host updates WordPress automatically?

Probably, yes. WordPress applies minor and security core updates in the background on most sites, but plugins, themes, custom code and PHP versions still need someone to update and test them. Automatic updates can also fail quietly, which is why the UK's NCSC advises checking occasionally that they are actually working.

How often should my website be backed up?

It depends on how often the content changes. WordPress's own guidance suggests weekly backups for smaller sites and daily backups for high-activity sites, and always before an upgrade. A site that takes orders or bookings may need more frequent database backups than that. Whatever the schedule, keep copies in more than one place and test that you can restore them.

What is the difference between hosting and a website care plan?

Hosting is the infrastructure your site runs on: servers, bandwidth and sometimes a CDN. A care plan is the work done on the site itself: updates, backups you have checked, monitoring, fixes and small changes. Some packages bundle both; ask for the two to be priced separately so you can compare them and move one without the other.

Can I maintain my own website instead of paying an agency?

Yes, for a simple site on a managed platform, if someone on your team has the time to apply updates, check backups and watch for problems every week. It gets harder with custom code, integrations, payments or personal data, where an update can break something in ways that need a developer to diagnose and fix.

What does response time mean in a website maintenance SLA?

Response time is how quickly someone acknowledges and starts working on an issue; resolution time is how quickly it is fixed. Many agreements commit only to response times. Check the hours they apply (business hours or 24/7), the time zone, how you report an urgent issue, and what counts as urgent.

Does website maintenance include SEO?

Not usually, unless the package says so. Maintenance can cover technical health that affects search, such as uptime, speed, broken links and SSL, but keyword research, content and link building are separate work. If a package claims to include SEO, ask exactly which tasks are done each month.

Who should own the domain, hosting and backups?

Your business. Register the domain and open the hosting, code repository and backup storage accounts in your organisation's name, and give the agency access rather than ownership. That way you can change supplier without asking anyone's permission to take your own website with you.

Sources

Each source is labelled with the country it covers or the currency it quotes, where it has one, and the date we accessed it.

  1. WordPress.org News: Security category — Core security releases from 7.0.2 (17 July 2026) to 7.1.3 (6 October 2026), including critical-severity fixes in 7.0.2 and 7.1.2. Accessed 18 October 2026.
  2. WordPress.org Documentation: Updating WordPress — Automatic background updates for minor and security releases; backing up before updating. Accessed 18 October 2026.
  3. WordPress Developer Resources: WordPress Backups — Back up both the database and the files; weekly for smaller sites, daily for high-activity sites; keep 3–5 recent backups in different places and on different media. Accessed 18 October 2026.
  4. WordPress.com: Pricing (US$) — Plan prices for Personal, Premium, Business and Commerce, billed monthly or yearly, excluding taxes. Accessed 18 October 2026.
  5. Vercel: Pricing (US$) — Hobby plan at $0, Pro at $20 per month per developer seat with included usage credit, Enterprise quoted. Accessed 18 October 2026.
  6. NCSC: Keeping devices and software up to date (UK) — Enable automatic updates where possible, install updates promptly (ideally within a few days), check that updates are working, replace unsupported software. Accessed 18 October 2026.
  7. NCSC Small Business Guide: Backing up your data (UK) — Back up the data the business needs, including websites; keep device backups disconnected when not in use; protect online backups with two-step verification; know how to restore. Accessed 18 October 2026.
  8. US-CERT (CISA): Data Backup Options (US) — The 3-2-1 rule: three copies, on two different media types, with one copy offsite. Accessed 18 October 2026.
  9. OWASP Top 10:2025 — The current list of the most critical web application security risks, including Software Supply Chain Failures (A03) and Security Logging and Alerting Failures (A09). Accessed 18 October 2026.
  10. Let's Encrypt: FAQ — Default certificates are valid for 90 days; renew 90-day certificates every 60 days. Accessed 18 October 2026.
  11. CA/Browser Forum: Ballot SC-081v3 — Schedule reducing the maximum public TLS certificate validity from 398 days to 47 days, between March 2026 and March 2029. Accessed 18 October 2026.
  12. web.dev: Web Vitals — Good thresholds: LCP 2.5 seconds or less, INP 200 milliseconds or less, CLS 0.1 or less, at the 75th percentile of page loads, split by mobile and desktop. Accessed 18 October 2026.
  13. web.dev: Optimize Largest Contentful Paint — Server response, CDN, caching, image size and format, fetchpriority, never lazy-loading the LCP image, font-display. Accessed 18 October 2026.
  14. web.dev: Optimize Interaction to Next Paint — Break up long tasks, yield to the main thread, reduce JavaScript work, keep the DOM small. Accessed 18 October 2026.
  15. web.dev: Optimize Cumulative Layout Shift — Set image dimensions, reserve space for ads and embeds, handle late-loaded content and web fonts. Accessed 18 October 2026.
  16. web.dev: Loading third-party JavaScript — Audit third-party scripts, remove those without clear value, use async or defer, lazy-load embeds. Accessed 18 October 2026.

Need a maintenance quote you can compare?

Tell us what your application runs on and what support you need. We will scope it and split the quote into hosting, licences and labour, or tell you if someone else is a better fit.

Ask for a maintenance quote See web development services