A website is not finished when it launches. The software under it keeps changing, browsers change, and your business changes. Maintenance is what keeps the site working and safe in the meantime. What it costs depends less on the size of the site than on how it was built and how much of the work you want to handle yourself.
What maintenance actually covers
Website maintenance is a bundle of separate jobs. Every plan you are offered includes some of them and leaves others out:
| Task | What it is | How often |
|---|---|---|
| Hosting | The server your site runs on, usually with its SSL certificate | Paid monthly or yearly |
| Software updates | Core, theme and plugin updates on WordPress or a similar system | Weekly to monthly |
| Backups | Copies of the files and the database, stored somewhere other than the server | Daily or weekly, and tested |
| Security monitoring | Watching for malware, attacks on the login page and plugins with known holes | Continuous |
| Uptime monitoring | An alert when the site stops answering | Continuous |
| Performance checks | Re-running speed tests after updates and new content | Monthly, or after changes |
| Content edits | New photos, prices, staff and service pages | As needed |
| Domain and email | Renewals and DNS records | Yearly |
The difference between a cheap plan and an expensive one is usually which of these rows are included, and how quickly someone responds when something breaks.
Why WordPress sites need more of it
WordPress runs a large share of small business websites because it is flexible and easy to edit. Much of that flexibility comes from plugins, and every plugin is code from a different author that has to be kept up to date. Each update can close a security hole, and each one can also break something. That is why updates belong with a fresh backup and a quick check afterwards, not on autopilot with nobody looking.
Sites with fewer moving parts need less looking after: a lean theme with a handful of well-chosen plugins, or a setup where WordPress only manages the content and the public site runs separately, with no plugins exposed to visitors at all. This is one reason the way a site is built affects what it costs to run for years afterwards.
What you can safely do yourself
- Content edits, if the site was built so you can edit it. This is the biggest saving, and it is a fair thing to ask for before a site is built.
- Domain renewals: turn on auto-renew and keep the registrar account in your own name.
- Watching the numbers: run a speed test after big changes and look at Google Search Console once a month for errors and falling traffic.
What you should never skip
- Backups stored away from the server. A backup on the same server disappears together with it.
- Tested restores. A backup nobody has ever restored is a hope, not a plan.
- Updates, followed by a check. Outdated plugins are one of the most common ways WordPress sites get hacked.
- A named owner for every login. Know who has admin access, remove people who have left, and turn on two-factor login.
How to read a maintenance quote
Ask every provider the same five questions:
- Which tasks from the table above are included, and how often?
- Where are backups stored, and when was a restore last tested?
- How fast do you respond when the site is down, and how do I reach you?
- Are small content edits included, and how many per month?
- If I leave, do I keep the hosting account, the domain and the code?
The last question matters most. A cheap plan that keeps your domain or hosting in the provider’s name can become very expensive on the day you want to leave.
What no maintenance really costs
Skipping maintenance does not save money so much as move the cost to a worse day. The usual outcomes are a hacked site that shows spam or gets flagged in search results, a plugin update that quietly breaks the contact form, an expired certificate that puts a browser warning in front of every visitor, or a site that gets a little slower every month as content and scripts pile up.
Each of these costs more to fix than to prevent. Some, like a broken form, cost you enquiries you will never know you lost.
Not sure what state your site is in? Our free site check runs Google’s PageSpeed test on the mobile version of your site. If the result shows problems, we can look deeper and tell you what a sensible maintenance setup for your site would include. See our WordPress and CMS work.