Website maintenance is the work a site needs after launch, and it is the line most quotes leave out. A new site looks finished on the day it goes live. Six months later the contact form has quietly stopped delivering. Meanwhile the plugin behind the booking page sits three versions out of date, and nobody has noticed either thing.
This is not a scare story. It is a budgeting problem. Website maintenance stays small and predictable when somebody owns it, and it turns expensive when nobody does.
What website maintenance actually covers
Most owners picture design tweaks. In practice the work splits into five kinds, and only one of them is visible to a visitor.
- Software updates, which cover the platform, the plugins and the server underneath.
- Backups, taken often enough to matter and restored at least once to prove they work.
- Monitoring, so you hear about a failure before a customer phones to report it.
- Renewals: the domain, the certificate, the licences and the hosting plan.
- Small content fixes, because prices, staff and opening hours keep changing.
Security runs across all five rather than sitting beside them. If you want that side in more depth, our piece on the security basics every site owner needs goes further than this one will.
Why the bill arrives whether you plan for it or not
Skipping this work does not remove it. Instead it moves the cost into a worse month.
An unpatched plugin becomes a cleanup job. An expired certificate becomes a browser warning on every page until somebody fixes it. A site nobody has touched for two years becomes a rebuild, because updating it in one jump breaks things that then take days to trace.
So the real question is not whether to pay for website maintenance. It is whether to pay a little on a schedule, or a lot at the worst possible moment. Maintenance is the last stage of a build rather than an afterthought, and our plain guide to building a website or an app shows where it sits in the wider project.
The website maintenance jobs, by how often they fall due
Different jobs run on different clocks. Here is a rhythm that suits most small business sites.
| How often | The job | Why it earns the time |
|---|---|---|
| Weekly | Apply security updates, then confirm the backup ran | Because a published fix also tells attackers where the hole is |
| Monthly | Fill in every form, read the error log, check uptime | Silent failures cost enquiries rather than headlines |
| Quarterly | Restore a backup somewhere private, review speed | Since an untested backup is only a hope |
| Yearly | Renewals, a licence review, a sweep of stale content | When something expires, it fails on a fixed date |
Print that, put a name against each row, and most of the argument disappears.
Updates, and what really happens when you skip them
Every platform ships fixes for holes somebody has already found. Attackers read those release notes too. When a fix is public and your site is behind, the hole is now common knowledge.
Automatic updates help, yet they are not a plan on their own. A minor update usually applies itself safely. A major version jump can break a layout or a checkout, so it needs a copy of the site to test on first.
So the working rule is short. Patch quickly, schedule the big jumps, and never attempt either for the first time on a Friday afternoon.
Backups, and the test almost nobody runs
Turning backups on is the easy half. Putting one back is the half nobody rehearses, and only that half is worth anything.
An untested backup is a claim rather than a safety net. The file may sit there while the database dump stops halfway, or while the pictures live in a folder the backup never looked at. You find out during the emergency, which is the worst possible time.
Ask three questions instead. How far back can we go? What does a full restore take, in hours? Who in this room has done one? If nobody can answer the last one, that is your next job.
Monitoring, because a website fails quietly
A site rarely falls over with a bang. Usually it fails in one corner. The contact form stops delivering, or the payment page throws an error for one card type, or a search engine starts seeing a server error that never appears in your browser.
Two cheap habits catch most of it. First, an uptime check that messages a human being. Second, a monthly walk through every form and every checkout path, done by a person rather than a script.
Also read the error reports in your search console. A crawler visits pages a customer never reaches, so it often spots trouble first.
Renewals: the outages you can see coming
Domains expire. Certificates expire. Licences expire too, and a lapsed licence usually stops the updates rather than the site, which makes it easy to miss for months.
Put every renewal date in one calendar that the business owns, rather than in the inbox of whoever built the site. Set the reminders early. Keep the billing card current, since a dead card takes a domain down as surely as a forgotten date.
One more thing worth checking today. Make sure the domain sits in your company name. Control follows whoever the registrar has on record, so a name on that record beats a promise.
Speed drifts back, so schedule a check
A site is usually at its fastest on launch day. Then somebody adds a tracking tag, a chat widget, a web font and a photo gallery, and each one costs a little. None of it feels significant on the day it goes in.
Because of that drift, a speed check belongs on the quarterly list rather than in a crisis. Our article on what actually slows a site down sets out the order to fix things in, which matters far more than the tool you measure with.
Your platform decides how much website maintenance you buy
The workload is really a design decision taken months earlier. A site assembled from thirty plugins has thirty update streams and thirty things that can conflict. A hosted platform hands most of that to the vendor, at the price of doing less that is unusual.
Neither answer suits everybody. Still, it is worth understanding the trade before you commit, which is the point of choosing a CMS your team will actually use.
What a website maintenance plan should include
Plans vary wildly. The same phrase covers a monthly patch run and a retained development team, so get the scope in writing before money changes hands.
- Updates, with a stated response time for an urgent security fix.
- Backups: how often they run, how far back they go, and where they live.
- Uptime monitoring, and the name of the person who receives the alert.
- Licences, so you know which ones the fee covers and which you buy yourself.
- A stated number of hours for small changes, plus what happens to unused hours.
- Reporting you can read, showing what happened and what changed.
- An exit clause covering your data, your code and your access.
Notice how little of that concerns design. Ultimately a plan is a set of promises about response, not a promise to make the site prettier. So an offer that lists tools rather than commitments has not answered the question.
Where website maintenance ends and project work begins
Disagreements about a retainer usually turn out to be disagreements about scope. Both sides agreed on the word, then found they meant different jobs by it.
Upkeep keeps the site doing what it already did: patches, backups, monitoring, renewals and small text edits. Project work makes the site do something new, such as a redesigned page, an extra language, or a booking system. The line matters because those are different purchases. Project work needs a brief, an estimate and a date, while upkeep only needs a rhythm.
Write the line down before you sign. A short list of what counts as a small change, with a time limit on it, gives both sides something to point at.
What changes the price of website maintenance
Nobody can quote this from a distance, and any figure printed here would be a guess. Still, the drivers are predictable enough to argue about sensibly.
Size and complexity come first, since a brochure site and a shop with stock feeds are different animals. Then the platform, because some stacks need far more hand holding than others. Response time matters too: an hour on a Sunday costs more than a ticket answered on Tuesday. Finally there is the change work included, which is the part that varies most between two quotes that look alike.
A worked example, with round numbers chosen to make the arithmetic easy rather than to describe a typical site. Suppose the routine jobs take 2 hours a month, and you also want 4 hours for small changes. That is 6 hours a month, so 72 hours across the year. Compare that against a single emergency that swallows a week of somebody's time, and the schedule starts to look like the cheap option.
Doing website maintenance in house
Plenty of businesses manage this themselves. It needs one named person, an hour or two a month, and a written checklist so the job survives a holiday.
Ownership is where it usually goes wrong. If the work belongs to everybody, it belongs to nobody, and the first busy quarter ends the habit. A calendar entry with a name on it beats a good intention.
Some jobs still need a developer, particularly a major version jump, a server move, or anything touching payments. Know which side of that line you are standing on before you start clicking.
When patching is no longer the answer
Sometimes the honest advice is to stop. A site running on an unsupported platform, with a theme nobody sells any more, is a rebuild wearing a maintenance contract.
The tell is where the hours go. If most of the time goes on keeping the thing upright rather than improving it, your money now props up a decision made years ago. Our guide to planning a redesign that keeps your traffic covers how to do that without losing the rankings you already have.
Your first hour on this, today
Three jobs, in this order, and none of them needs a contract.
- Find out when your domain and your certificate expire, then put both dates in a shared calendar.
- Restore last night's backup somewhere private, even if it costs you an afternoon.
- Fill in your own contact form and confirm that the message really arrives.
Once those three are true, the rest of website maintenance is mostly bookkeeping. Book a recurring hour, write down what you check, and the work stops arriving as a surprise.
Frequently asked questions
What does website maintenance actually include?
Website maintenance covers five kinds of work: software updates, backups, monitoring, renewals and small content fixes. Four of those never show up on the screen, so they slip off a budget easily. Judge a plan by whether it names who does each job. Look at response times too, rather than at the tools it lists. New pages, new features and a redesign sit outside upkeep, so expect a separate quote for those.
How often does a website need updating?
Security patches should go on within days, because a published fix tells attackers exactly where the hole is. Larger version jumps are different. Those deserve a scheduled slot and a copy of the site to test on first, since they can break a layout or a checkout. A weekly patch run with a quarterly review of the bigger upgrades suits a small site well.
Can I handle website maintenance myself?
Many owners can, especially on a hosted platform that updates itself. The work needs a named person, a short written checklist, and somewhere shared to record each run. Website maintenance fails in house when it belongs to everybody, because then nobody misses it during a busy month. Bring in a developer for major version jumps, server moves and anything touching payments, since those fail in expensive ways.
How much does website maintenance cost?
It depends on the site rather than on a standard rate. So treat any figure quoted before somebody has seen your site with suspicion. Size and complexity matter most, then the platform, then how fast you expect an answer out of hours. To compare two quotes fairly, ask both to price the same list. Name the response time, the backup schedule and the number of change hours you want. Differences that survive that exercise are real ones.
What happens if I skip maintenance for a year?
Usually nothing visible, right up until something breaks badly. Plugins drift out of date, so a known hole stays open. A certificate or a domain expires and the site goes down on a fixed date. Meanwhile forms fail quietly and nobody notices the missing enquiries. The eventual repair is usually bigger than the year of routine work you avoided, because upgrading in one jump breaks more than upgrading gradually.
Is web hosting the same as maintenance?
No. Hosting is the rented space and the server your site runs on, so the host keeps the hardware and the network alive. Website maintenance is the work on your actual site: updates, backups, monitoring and fixes. Some hosts bundle basic backups and platform updates, which is useful, yet it rarely covers your plugins, your forms or your content. Read what the host promises before assuming anyone else is watching.
How often should backups run, and where should they live?
Match the frequency to how much work you could bear to lose. A shop taking orders daily wants a daily backup at least, while a brochure site that changes twice a year can go weekly. Keep at least one copy away from the server itself, because a failure that takes the site out often takes local backups with it. Then restore one, because an untested backup is only a claim.
Do I need a maintenance plan for a small brochure site?
You need the jobs done, though not necessarily a contract. A small site on a hosted platform might need an hour a month from somebody in the office. A site built on plugins needs more attention and usually more skill. Decide by counting the moving parts rather than the pages. A five page site with a booking system carries more risk than a twenty page brochure.
When should I rebuild instead of paying for website maintenance?
Rebuild when the upkeep stops buying progress. The clearest test is whether the platform still gets security fixes. When nobody upstream ships a fix, you cannot close the hole from your end. Then website maintenance is only buying time. After that test, weigh the next twelve months of upkeep against the cost of a replacement. Keep every existing address when you move, since a rushed rebuild can lose the rankings the old site earned.